Hi. And welcome. For the next hour, we're going to be talking about femto cells. A femto cell is a low-cost, low-power consumer product designed to increase cellular signal coverage. It's basically a mini cell tower. It's also a Linux box. And if you hack it, you can intercept the phone calls, text messages, and web surfing of nearly anyone within range. We're not going to talk about prism or Snowden or any other political stuff. This presentation is going to focus on technical facts. Mostly technical facts. There's been many conversations over the last few days, and after lengthy discussions, Verizon has asked us to include these bullets. And moving on. Before we go too much further, quick note on handset pairing. Your phone will associate to a femto cell automatically and without your knowledge. It's not like joining a Wi-Fi network. You don't have a choice. In fact, there may be some members of the audience connected to our network right now. Those signs out front are not just for show. You might want to put your phone in airplane mode. And one more thing. This research has everything to do with the tower and very little to do with the actual phone. We don't break or alter anything on your phone, at least not yet. We also want to clearly state before we go too much further that the vendor has addressed the vulnerabilities that we used to get root on the device. We originally disclosed to the vendor just about eight months ago, and they worked very quickly over Christmas to release a patch. It bears mentioning that the security issues we'll be discussing apply to more than just one carrier. And as you all know, nothing is 100% secure and we do have some architectural concerns related to femto cells. And this should come as no surprise to you, but we're not the first people to have these concerns. As you can see, researchers have been popping femto cells since at least 2010. The latest example was here in Las Vegas at Black Hat in 2011 where a group of hackers on the crap out of a femto cell from a French carrier. Prior to them, the hackers' choice picked on a Vodafone box. We also want to mention that RSAXVC and Doug Kelly and their tear down hacking of the same model femto cell was very helpful to us during our earlier testing. As it turns out, someone looked at these things and didn't immediately think, let's use this for evil. A team from LMG Security will be presenting a talk using the same model femto cell as a cellular IDS. And I believe that happens tomorrow. So we're going to cover some similar topics, but on a carrier that affects one in three Americans. To the best of our knowledge, no one has publicly presented an attack on a femto cell on a North American CDMA carrier. If you haven't figured it out yet, we're talking about Verizon. By the numbers, we're talking roughly 300 million people in the U.S. and roughly 100 million Verizon subscribers. I'm really not that good at math, but if my calculations are correct, that's about a third of the country. We will hopefully demonstrate how we can record and listen to phone calls, text messages, picture messages and data. We even perform active man in the middle attacks on data connections as well as SSL stripping. And if that weren't enough, we thrown some cloning fraud for good measure. So to break it down further, we will discuss how we obtained access to the femto cell, what we did once we got on it, the custom code we wrote to get the traffic we wanted, and our thoughts on how to fix these things. For those of you that may not be familiar with the femto cell architecture, here's a high-level diagram. Your phone connects to the femto cell over cellular radio, in this case it happens to be CDMA. The femto cell then uses a broadband internet connection to create an IP sec tunnel back to the carrier's internal network. Verizon currently has two models of consumer-grade femto cells, the SCS26UC4 and the SCS2U01. The UC4 was released in early 2009 and only supports three simultaneous users at 1X speeds. The 2U01 was released in late 2010 and supports six simultaneous users at 3G speeds. We were able to route both of these devices, but we created most of our proof of concept code on the 2U01 because it's newer, faster, and better looking. As we were doing some high-level due diligence, we discovered that sprint has a femto cell too. As it turns out, both Verizon models and one sprint model are made by the same manufacturer, Samsung. We really didn't have that much time to do a ton of testing on the sprint model, but the one on the left is very similar to the UC4 and is vulnerable to similar attacks. However, we are told that sprint is end-of-life in this model of femto cell next month and replacing it with a newer model. We took a quick look at this newer model and we can say it's not vulnerable to the exact same attacks. So let's talk about the femto cell we spent most of our time on. The 2U01 has an ARM processor, one NAND flash memory, and a Lattice FPGA, which we assume is for digital signal processing. Externally, it's got a GPS antenna, a CDMA antenna, as well as ethernet and HDMI ports. I know what you're thinking. Did he just say HDMI port? Yes, I did. It's a little tough to make out in this picture, but on the bottom of this device hidden under a rubber plug is an HDMI port. So we knew it could possibly be used for video, so we figured it has to be a console port and we were right. Why is it HDMI?  So how does one connect to an HDMI console port?  We really have to thank RSAXVC and Doug Kelly for figuring this one out. One more thing, I'd like to talk briefly about the range of this thing since it's a question we get quite a lot. The device documentation states that a phone must be within 15 feet to register to the femtocell and must stay within approximately 40 feet to stay connected, but in reality it depends. Your phone will connect to the tower that's got the strongest signal, so if you're in an area with very good cell coverage, the real towers tend to drown out this small base station. We think there's some tweak in that can be done in the software to boost the signal, but probably the easiest thing to do is just buy a big-ass amplified antenna. Of course, if you're in an area where you actually need something like this, then we imagine the capsule range would probably be pretty good. We did purchase an aftermarket directional antenna, mostly because we want to minimize the number of phones that we capture, and this antenna creates a nice tight cone. All right, so I wasn't entirely truthful. One last mention of the older model femtocell. On the UC4, you can get root by interrupting the boot process. That was patched a while ago, and it's fixed in the 2U01, so we had to find our own way in. On the newer model, we found that we could abort the boot process using the magic sysret key, which drops you to a prompt where you can log in as root. Because we're interrupting the boot process before the device is fully functional, we then had to manually run some startup scripts. Once at the proper run level, the device will start custom UB cell binaries and connect the device to the carrier's network. And as we mentioned, these techniques will no longer get you root on a patched device, but they're pretty handy and could probably come in, will probably be very useful when testing other embedded devices. So now that we've established a presence on a mini cell tower, let's poke around this device and see what we can see. The 2U01 runs a customized version of Monovista Linux 5, Kernel version 2.6.18. It includes a very stripped-down Linux system, a few device divers, and proprietary software to control its operation as a base station. It also includes Authentic's QuickSec VPN client, which is packaged as a kernel module, and I'll get more into that later. So this is great. We're root, but it's a pretty bare-bones Linux system, and there's not too many helpful commands available. There's no text editor. If you started a long-running command, you can't control C to kill it, stuff like that. It's very annoying. So said, it's a little unwieldy, but we can use it to edit SSHD config to allow interactive password root login. So we did that. We flushed IP tables, and it made things much easier to work with. So great. We can SSH in, but we still have to run this said command on every boot because the file system is pulled fresh every time you power cycle. So we figured we could edit and reflash the firmware, but we really didn't want to run the risk of creating a doorstop. So we continued looking around, and eventually we noticed a persistent file system location. Things are starting to get a little more interesting, right? We found a persistent place to store files, but that doesn't necessarily give us persistent root access, right? So we just catted all the things and spent a lot of time in Slash Etsy, and we finally came across a script that appears to control some kind of debug mode. And for the record, that's not our typo in the echo statement. So I want to make that clear. We created a file named .ubrc, put it in the mount own end directory, and we're rewarded with a typo in the boot output. It worked. More importantly, since this .ubrc file gets executed on startup, we can put our own commands in there, and they'll be executed by root every time the unit boots. So it's an incredible time saver. We use it to patch SSHD, flush IP tables, and then drop it in a root shell automatically. So we overcame the next hurdle. We now have persistent root access, so let's get some packets and do some eavesdropping. Should be easy, right? We'll just run TCP dump on the tunnel interface, and nothing. All we see are encrypted IPsec packets everywhere.  So it turns out that QuickSec is implemented as a net filter kernel module. It steals the packets before they ever hit a regular network interface, does encryption decryption, and sends the traffic so you can't see anything good using a normal packet capture utility like TCP dump. So it seems like the fun is over. Now what? Well, luckily it's all just engineering, and with that, I'll turn it over to Tom. That's a pretty good representation of how the programming worked on this project. So setting up the cross compilation environment for this was a real pain in the neck, but that's why we have interns. We were finally able to find the right version of the Montevista Linux tool chain, and then we could compile our code against that to make binaries and kernel modules that would run on the FEMTO cell. So we figured out that we needed to write our kernel module and insert it in such a way. We'd be able to copy the packets before they were encrypted going out, and after they were decrypted on the way in. Took a little trial and error, but with that module loaded, we can pass the packets out to user land for logging to a P-CAP. So with that hurdle over, we can go after the fun stuff. So we've got some plain text packets, but it's a mess. Wireshark doesn't really parse much that helps us, and the ports shown are completely foreign. We can surmise that a phone call generates lots of small UDP packets as any VoIP protocol will do, but who's talking to who and where's the audio? We could tell Wireshark to interpret the data as RTP, which gets us a small step closer, but as you can see circled here, the RTP payload type is in the dynamic range, and according to the spec, dynamic is code for do whatever you want and don't expect to interoperate with anybody. So we had to try and figure out what type of codec we were dealing with, which we did by downloading every single RFC and grepping through them en masse for codecs whose frame sizes matched what we saw. And we eventually found one we thought it might be, EVRC. Now, EVRC is one of those random cellular codecs that no media player implements, so we couldn't just pop it into VLC. So what do you do when you can't figure something out and you've hit a dead end? You go to Stack Overflow. But this had already been asked and received no answers. So here's the real secret of productive hackers. It's not asking questions on Stack Overflow, it's bountying questions on Stack Overflow. So what we got was a link to the actual reference implementation of EVRC that was published by the 3GPP2 multi-carrier working group thingy. And it took some endian and byte fiddling, but after passing it through the reference implementation and the Linux utility socks, we were able to get some audio out of it. And with that, let's hopefully go for the live voice demo. So Doug is placing a call on a phone that is associated to the Femto Sal. And hopefully Andrew's phone will ring in just a moment. Alright, so the call is complete, so I need to switch over actually. Okay, so Andrew is going to pull it off of the Femto Sal and pass it through the... Sorry, I hope this works. So that was before the call was placed. Did you know your mic was active then? Now it's ringing. Hello? Hey Andrew, did you hear about that new phishing scheme? It's off the hook. Talk to you later Doug. And there's live voice interception. And this was the backup video. So for SMS, it took us a while to figure out SMS also, but we'll spare you the gory details this time. The text message itself is encoded in seven-bit blocks, so it's a bit of a pain, but we can get the data out. And in fact, we made a Wireshark disector, but that's not nearly as interesting as doing another live demo. So let's try for that. So we should be displaying a couple of text messages that we've asked people to send us. Is that them right there? Okay, so they've already gone through at the bottom, so they just kind of popped right up. Can we get another couple sent real quick? There are a lot of encoding formats for SMS and we don't parse all of them. Okay, there's a couple more. All right, so that's SMS. All right, so we've got voice calls in SMS, but we live in the smartphone era. So let's see some actual data. And thankfully it was plain text. It's so much easier. Everything is parsed and displayed in Wireshark. There are some layers and tunnels that encapsulate the data they'll talk about in a sec, but overall it looks like pretty much any other LAN capture. So with passive interception we can pick up your MMS. You did know that didn't go over SSL, right? So we took a photo of the audience and sent it because it takes a little bit for MMS to go out in DefCon. And we will show it to you right now. And there you all are. Okay, so we can view all the plain text. Passive interception is done and working. Let's do some active attacks. And the easiest thing to do with data is to drop it on the floor. Now, there's a lot of debate about how iMessage works, just how secure it is. But what's certain is that it uses SSL to talk home to Apple. So we can't see those messages with passive interception. But if you block the SSL connection back home to Apple, iMessage fails over to SMS. And SMS is plain text and we can see that just fine. Okay, so it is plain text, but it's encapsulated all up and down. If we're lucky, it's a fairly nice encapsulation that Wireshark will handle for us. If we're unlucky, the normal IP, TCP and HTTP that you're used to gets encoded and then split across GRE packets. And this is what it looks like when you're unlucky. In the lower right, you can see some normal HTTP.  But that's actually the data section of the upper left hand inset. And then if you can read the Wireshark part, there's these PPP fragments. That's the IP fragments split across multiple GRE frames. So our goal is to edit a web page in the simplest way possible. And changing anything in HTTP means changing the TCP checksum. And since we're encapsulated in PPP, changing anything also means changing the PPP checksum. TCP checksum is at the beginning. PPP checksum is at the end. And the frames might be out of order. So it's going to be a little tricky. The first thing we tried doing was doing it in line in the kernel. Really quickly, we figured out that the carrier has a transparent proxy on all your web browsing on your phone. Let me repeat that. Verizon has a transparent proxy on all the web browsing on your phone. It's kind of creepy doing this without your knowledge, but frankly, we weren't really surprised. One of the things that they do with this transparent proxy is apply HTTP compression to anything that doesn't already have it, which makes sense because HTTP compression does actually speed things up. We didn't detect any SSL man in the middle or JavaScript injection. And I don't think that Verizon is alone or the only carrier doing this. But nonetheless, it's there and from a technical standpoint, we had to work around it. We tried disabling the compression but no dice. So we tried doing DNS hijacking, but the transparent proxy ignores the IP address that you actually try and talk to and does their own DNS look up on the host header. So then we tried something crazy and this got us pretty close. We did the DNS hijacking and in the kernel we rewrote the traffic from port 80 to port 81 so that the carrier wouldn't proxy it. Our server listens on port 81 and responds back and then on the inbound the kernel module rewrites it back to 80. And this worked most of the time. The problem was there were a couple of corner cases and on hundreds or thousands of packets for a web page load that's enough to sync it. So what ended up working was doing all of that except the server that listens on port 81 will redirect the browser to port 80, 80, which the carrier also doesn't proxy. So in the end what ends up happening is you open a website, say cnn.com. We DNS hijack you. You try to talk to our server on port 80 but the femtocell kernel module rewrites your connection to our server on port 81 to bypass the proxy. We listen on 81, respond and the kernel rewrites it back to port 80.  So then you talk to our server on port 80, 80 directly bypassing the proxy with no port rewriting. And then we command in the middle the user pretty effectively. We strip off SSL, pass along the cookies.  So because it is a little bit slow we're going to show a video of this one. In the bottom right hand corner we are typing in a bank, wellsfargo.com. In the lower left hand corner you can see the resource loads. So a couple from Google and then we'll start seeing the Wells Fargo resources. In the upper left hand is where the username and password will show up. So there's Wells Fargo and we're going to click on sign in and then we will type the username character by painful character. And then the password. And there is the username and password in the upper left. All right so that is data middling. And with that I'll turn it back over to Doug. So this is all really cool and we're very excited about it but these things are mini cell towers. So it's got to be possible to do more with them, right? So if there's anything cooler than intercepting and modifying phone calls and text messages it's becoming the person holding the phone. For those of you familiar with GSM terms like IMEI or MC, CDMA has their own slightly different identifiers that serve the same purpose. The key difference here is that SIM cards aren't typically used in U.S. CDMA networks so instead of an MC the M-I-N is just a 10 digit phone number. This is sometimes the same as your actual phone number but not always because of porting numbers between carriers. This is an important distinction because we discovered that most but not all of the communication between the handset and the carrier uses the ESN and M-I-N for identification. And unfortunately there's not really any obvious correlation between the M-I-N and the actual phone number. The ESN is an analog of the IMEI. It was previously used as a unique number but carriers ran out officially in 2010. ESNs have since been superseded by MEIDs. Pseudo ESNs are always prefixed with the 8-0. The remaining bytes are the 24 least significant bits of the Sha-1 hash of the handset's MEID. Pseudo ESNs are not guaranteed to be unique since the MEID is the unique identifier for those handsets that have one. Older model phones use the ESN to identify themselves to the network. Newer phones use the MEID but still retain a Pseudo ESN since it is required for compatibility reasons. So to clone a phone all you have to do is grab somebody's phone, write down the ESN or MEID in their phone number, then copy these numbers to another handset to get a valid clone. Right? Well years ago these used to be all it took. Since the MIN was usually the same as the phone number and the ESN was printed on any given device it was trivial for an attacker to get these values and use someone else's expensive wireless minutes to make calls. So Qualcomm and the CDMA carriers had to come up with a solution. We won't get into a ton of detail but the cave authentication mechanism makes it very difficult to successfully clone a CDMA phone. Additional keys are used in a challenge response protocol to authenticate the customer and the call. Manufacturers of CDMA devices are supposed to make these keys difficult to obtain so that a full clone is not possible. All that being said, let's see if our rogue FEMTO cell has any more secrets it wants to give up. Hint. As we mentioned earlier, the FEMTO cell acts like a typical cell tower except with at least one key difference. The FEMTO cell only uses the ESN and MIN to authenticate handsets. We're not entirely sure why we really have no idea but it may suggest a legacy CDMA implementation. But the real problem here is that we discovered that the FEMTO cell did not have cave enabled. It behaved like a legacy tower and just ignored those keys relying solely on the ESN and MIN for authentication so cloning becomes extremely easy just like the good old days. Note that the cloned phone will only work while connected to the FEMTO cell but it can be any FEMTO cell not necessarily one that's been modified. So we just need to somehow obtain the ESN and MIN of our victim and program those numbers into another handset. You're generally not supposed to be able to write the ESN but some phone models do allow it. So it's just like the movies right? We wait until our victim runs to the bathroom, you grab their phone, write down the ESN and MIN and clone the phone right? But it's just so messy. We have to invite our victim out to eat. We have to wait till they go to the bathroom. We have to risk getting caught going through their phone and what happens if they take their phone with them to the bathroom?  There's got to be an easier way to defraud my friends. So remember that time I told you that we can see every packet that goes through the FEMTO cell? Well that includes handset registration packets that contain the ESN and MIN of the phone associated to the FEMTO cell. So all I have to do is capture packets on my rogue FEMTO cell, wait for an unsuspecting mobile phone to come within range. When the phone associates to the FEMTO cell I catch the ESN and MIN without physical access to the phone and without any indication of the user. So picture is worth a thousand words right? Here it is step by step. The victim phone comes within range of a malicious FEMTO cell and as the handset registers the carrier network the ESN and MIN are captured and written to a separate target handset. The target handset can then be used as a perfect clone of the victim as long as it is associated to the FEMTO cell. It be possible to capture phones in New York City using a rogue FEMTO cell and email the numbers to an accomplice in Seattle who's using a stock FEMTO cell. It's almost the perfect crime. While we were testing for cloning we noticed our results were a little inconsistent. It wouldn't work too well if you were trying to use it as your personal cell phone. But if your aim was to make money through toll fraud you could probably make enough money to buy a boat that has smaller boats inside of it. We maybe a couple jet skis too. We suspect our problems may have something to do with the relative signal strength of neighboring cell towers as we saw slightly different results when testing in a urban environment as opposed to a more rural one. But the short answer is we just don't know. So we tested cloning with voice, SMS and data. And some of the results were expected and some were not. But probably the most interesting thing we saw was the not quite three way call. So I'm going to describe a few scenarios with the next few slides and the following definitions will be helpful. Our victim is the person with a shiny new iPhone whose phone that we want to clone. The target is the bad guy running this old crappy flip phone and that's been modified to act like a copy or clone of the victim phone. So the easiest scenario is if the victim's phone is turned off, jammed otherwise not connected to any cell towers. Everything works as expected. There's no issues with service. You've got an exact working copy of the victim's phone for all intents and purposes. So when both phones are associated to the same femto cell we noticed a few different things. Of course the clone phone, the target, must be associated to the femto cell in order to work properly. It is only possible to place outgoing calls one at a time. No matter which phone initiates the outgoing call, any subsequent call placed will force that call to drop. Doesn't matter which phone is which, either the victim or the target can cause each other to drop calls. We didn't notice any issues with outgoing text messages and for incoming SMS the usual behavior seemed to be that both phones would get the text message. So with incoming calls, sometimes one of two behaviors is possible. The first is that only one of the two phones rings. It could be the victim of the target, it doesn't matter. Other times both phones will ring at the same time. The phone that picks up the call first usually wins which means it gets to stay on the call. But the coolest part is that sometimes if the two phones answered within a few seconds of each other, we got what we're calling a two and a half way call. So what would happen is both the target and the victim phones would connect and each would be able to hear the inbound caller, but not each other. So the eavesdropping scenario here is pretty clear. The bad guy can clone a phone and as soon as an incoming call comes in, picks up the call, mutes his mic and can hear everything said by the incoming caller. In our second scenario, the target is associated to the femto cell as required, but the victim is out and about connected to an actual cell tower. The phone that gets the incoming call appears to depend on which phone has had more recent communication with the carrier network, like a call or a text message. We couldn't reproduce the two and a half way call since both phones never rang at the same time. SMS was pretty similar, we never got an SMS on both phones at the same time. So outgoing calls are a little more interesting. So let's say the target, the cloned phone, is on an active phone call. This works fine until our unsuspecting victim places an outgoing call to another party. The bad guy's call gets dropped and the call of our innocent victim is allowed to connect reliably. However, if the victim is on an active call, like pictured, and the target places an outgoing call, the call will connect allowing two independent phone calls. So these implications are clear as well.  So I said earlier we were going to talk about cloning data and here we are. It appears to be slightly more difficult to establish a data connection on a clone than it is to clone voice and text services. Data services on Verizon's network are required for MMS, account management features and internet connectivity. Long story short, the carrier network requires more numerical identifiers for data connection than for voice and SMS. We're not saying it's impossible, but it's just more difficult. We didn't really dig too deep into it. So we have a video to demonstrate a two and a half way call. Whoops. Alright. So that's me making a phone call to a single number. Both phones are ringing. The victim phone is the one on the left and the target is the one on the right. We're going to fast forward. I'm noxiously. Both calls get answered. Both calls connect and stay connected. And now we're going to do some very sophisticated voice testing. Stand by to prove that the two calls are connected. Oh, there it is. Just on inside secret to phone testers. It's very, very technical. All handle that. Alright. And so that's that. So we mentioned this in the beginning, but this issue was resolved by Verizon on the back end many months ago. And which is great because authentication should be checked on the internal network that the carriers control not on the small box that they don't. And with that I'll turn it back over to the code, Tom. Okay. So it'd be easy to think that this is all about Verizon, but this is really about everybody. There are over 30 carriers worldwide who have femto cells and three of the four major U.S. carriers. And clearly there are issues here. So what's a multi-billion dollar multinational corporation to do? Well, you can harden the actual device, but as we all know there's nothing you're going to be able to do on the platform to prevent people with physical access from breaking in. Root is always possible. We didn't have to do more sophisticated attacks, but obviously you shouldn't rule them out. There are lots of ways onto an embedded device and frankly we went in through the door. So what else can a vendor do? Well, you could force registration. Make the femto cell owner list the phones allowed to connect through their femto cell and then confirm with the phone owner that they're cool with allowing that. And if they try connecting through any other femto cell, don't let them. And do this whitelist inside the carrier network of course not on the actual device. And this would make it a lot harder to take one of these down to Times Square or Las Vegas and just start gobbling up everyone around them. So device registration clearly reduces the attack service. Here's a breakdown of the major U.S. cell carriers and how they handle handset registration on their femto cells at least according to their documentation. Besides T-Mobile who doesn't have a femto cell AT&T is leading in this category because they require registration. The other carriers, Sprint and Verizon do not. So phone registration does prevent the easiest attack but it doesn't win us over completely. It doesn't prevent attacks where I isolate you from the carrier network. You'll still see four bars, send beacons with your MIN and ESN, try and make phone calls and send text messages. And even though I never deliver any of that up to the carrier, I'll still see them. I can track you and read your SMS and we verify this experimentally. It's actually what we're doing right now. We isolate any phone that's not whitelisted so we don't receive inbound text messages or data sessions or actually see what you're sending because we whited out. With more engineering it'd be possible to connect these phone calls to our phone line, spoof SMSes for you to receive and even route the data traffic out the femto cell on the normal internet connection and let you browse the internet all without connecting to the carrier network. So the carrier never knows that you're attached. So device registration where the phone opts in to using a femto cell and the femto cell opts in to using a phone, it's a good minimum level of security but we don't think it's enough. Really what you should be doing is ditching them all together. You guys know that there will be bugs in everything but that said we like Wi-Fi calling.  We think you get a much stronger architecture. You have to do the same type of cell phone authentication you do with the tower to avoid theft of service but that's no weaker than what we have now. And what you get is not needing femto cells and that's a win. Being able to make calls on any random Wi-Fi and that's a win and those calls are encrypted against the Wi-Fi operator which is a win and pretty necessary. So going even further you can build in end to end encryption to protect the contents of the call against both untrusted Wi-Fi operators and the carrier. And as you all know there are individual apps that do this but they all require the recipient to have the same app. If Google and Apple and BlackBerry built this into their phones and carriers supported the model we think there'd be a huge increase in adoption. So I was just talking about this but let's sum up and present a couple of other band-aids that you can try. Hardening the femto cells is due diligence but ultimately a losing proposition. Requiring registration prevents untargeted attacks to some degree. But long-term we're pretty nervous about giving random people, like yourselves, small cell phone towers and just hoping you don't break into them. Now can you tell if you're connected to a femto cell? We said in the beginning no but it had an asterisk. We noticed that some Android phones have an icon indicating they are connected to a femto cell. Now this was only in phones that Verizon had modified. It's not in the Android source or any stock or flashed ROMs. An iPhone for the record has no visual indicator at all. There's a short beep at the beginning of phone calls but it's really easy to miss and you have to make a phone call. But somehow these Android phones were detecting femto cells and showing an icon. So we reverse engineered that and then we're halfway done with our own app. The femto catcher. So we noticed that the network ID indicates if it's a femto cell. And although it's possible to lie about that we didn't really investigate how hard it would be. So using this we can write a tool to put a phone into airplane mode when it detects itself being connected to a femto cell. Now to be clear we're not marketing this widely or to your extended family. We're building this because we want it. We would rather not have service than be connected to one of these especially at DEF CON. And we're going to be sharing it because we thought that you folks in this room might also want that option. And this is going to be available soon. We have a few kinks to work out. We'd like to thank Mira Tamboretti a lot for pretty much doing all the work on this. So what else can you do proactively? Well you can encrypt what you do on your phone and there are a multitude of free and paid apps to do so. If you can convince your communication partner to use the same app. So what else can you do if you root this or another femto cell? And you are operating a small cell tower. Well there's WAP. WAP is basically web browsing for flip phones. It uses custom protocols, it's heavily proxied, it does SSL, middling, whether they tell you that or not. I'm looking at you Nokia. And you might think that WAP is dead right? But it's actually used by a couple of billion people in the developing world. And smartphone manufacturers and carriers are still developing and investing heavily in it. So we think it's a worthwhile research target. And of course there's that binary blob that has complete control over your entire phone that nobody's been able to inspect in any straightforward way. At least not that we can actually see the results of. You could totally fuzz the base band with a femto cell. And it probably let you get a little bit deeper into any carrier specific stuff that they're doing than just using a general software defined radio. And since the device makes a VPN into the carrier network, you can poke around inside of their network. You can look at attacking other femto cells from your femto cell or look at the carrier's network itself. And the talk from two years ago at Black Hat did this with fantastic results. They were actually able to wiretap not just their femto cell, but every single femto cell that was on the French carrier. And that's a little bit farther than we wanted to go without permission from the carrier. So we worked hard to wrap up a little bit early because we wanted to leave time for questions and hopefully another demo. But before questions, we had to thank a lot of people. Andrew is one of the interns who worked on that really painful cross compilation but now is full-fledged member of ISEC and operating this demo and all the hard stuff. RSAXVC and Doug Kelly who helped us with a lot of the initial work. We used their research Davis and Tim who also helped us when we got stuck. Mira, Michael Pratik, Peter Ailert, our COO Joel, really all of ISEC and of course last but not least our external and internal legal councils. So I really have no idea if this is going to work but we are going to try and do another demo. So if you want to send a text message that shows up on the screen, there is the number have at it. And I will take questions while that happens. How did we get around the GPS? So the device needs a GPS signal. Long, just a long GPS cable will work. Do the custom ROMs have the transparent proxy? When we were testing, all phones were sent through the transparent proxy. It doesn't have to do with the ROM. The question was, did we try flashing a phone to prefer FEMTO cells? We were waiting for that. So the question was, did we try flashing a ROM to prefer FEMTO cells to wire tap people more easily? No, we did not. Custom PRL. We looked into it but we didn't get any success. Have we been inside a real cell tower and seen if any of this might apply there? We have not. We would love to get in one if you have real keys to it. So the device allows up to six. I don't think we have more than six. I'm sorry? Okay. You can have more passively associated but only six simultaneous voice calls. I forgot the two folks who are the volunteers, please come up and see if your phones are associated and send some text messages. Any other questions?  You're going to have to shout, sorry. Would a sprint device also connect to our FEMTO cell? We don't believe so. And yeah, if anyone has a sprint device. We don't believe so and really like we just created our proof of concept code on Verizon. This is applicable to people like most FEMTO cells. How does Verizon deploy the patches? They push the patch down to the unit. It's not like you have to plug in a USB stick or anything. It's auto updates itself. The question was the mics are active before you place a phone call. Is that the truth even if you're not connected to a FEMTO cell? I don't know. The question was about 3G and 4G. In our testing, our experience was that if you have a 4G data connection, we won't see your data but we will see your SMS and your phone calls. Yes, it's the phone that is associated to the FEMTO cell that we intercept, not the sender. We're just showing the text messages that are coming in. Try sending a text message. We'll see an outgoing one. I'm sorry, I still can't hear you. We, I think, something about a single amplifier. We have an external antenna, a directional one. You could certainly hook up more antennas, powered antennas. We're not, I mean we didn't really try. We were trying to minimize the number of phones we were getting. The question was about the key for the IPsec tunnel. We did look at multiple devices. The key is not the same across them. We tried this with MiFi. We've not tried getting a MiFi device onto it. We did look at that a little bit. If there are no other questions, we will pack up. Thank you very much.


Hi everyone, Joe for Jasper's case breaks.com convention live from the national in Chicago. It's our last day here a Sunday. What a what a great week. So thanks everybody for for coming to visit us and all that. So all right. 2021 Panini select basketball six box half case random team break number six second half of the case we popped open yesterday all card ship everyone gets a random team big thanks to everybody here for getting in on the action I appreciate it again all 30 teams are in and let's roll it let's randomize it names and teams three and a one four times one two three and a one fourth and final time that Eric down to Brad three and a one four times for the teams one two three and a one fourth and final time got the Hornets on top down to the Houston Rockets all right so Eric Baron congrats you got the Charlotte Hornets Brad with the Mavs Matt with the Wizards Brad with the Clippers and Trailblazers Matthew with the Kings Mike with the Suns Jason with the Sixers and the Pacers Brad with the Heat Leo with the Spurs Fred with the Bulls Brad with the Pistons Nicholas with the Matthew and Brad with the Hawks and Pelicans Matthew with the Nets Nicholas with the Warriors Brad you got my Lakers Matthew with the Raptors Brad with the Nuggets and Tim Brad with the Nuggets Taylor with the Timberwolves Brad with the Cavs the Jazz and the Grizzlies Matt with the Knicks Matthew Shira with the Celtics and Brad you have the rest Bucks Thunder Rockets all right so let's get all this on one page and let's sort by column B we're going to keep the video running and I know not everyone is probably here this early in the morning but if you want to trade feel free to trade no this is uh Luca was a case or two ago no this is break six I think Luca was in break four so a couple cases ago or a couple breaks ago no no it doesn't work that way oh jasmine's pulled that card so everyone gets a discount I know right let me have to tell everyone else to get discounts on that too all right trade window going once trade window going twice trade window closed all right so remember I marked all of these six imagine if we if we did that for the Luca we'd have to do it for every single card how crazy would that be every hit that gets pulled you have to like fractionally lower the price if we if we knew exactly how many cases they made that might actually be possible but it'd be it'd be a lot of unnecessary work I know I think don't release that kind of information more than everything yeah precisely all right and Jason is live on instagram last day for instagram obviously last day for all of jasmine's here at the national at jasmine's breaks on instagram uh help us uh help us not bring as much stuff back home but base right at the top all right good luck everyone well first off we got that lamello ball base card how many of those there are like those other guys oh there's lamello right there nice and that is for Eric Barron and the Charlotte Hornets see if I could adjust the focus here a little bit on this just don't hear give me a second here let me try to adjust the focus on this I think that's that's pretty decent all right set it right there all right there we go I know we start lowering those prices again Adam you know some people actually seriously ask that there's Kristaps for zingas to 175 you know see what's going on yeah I would love to do more big hit express today's our last day and uh the sunday is a very abbreviated day we will be we will be out of here uh fairly early there's Zeke Najee to 299 Patrick Williams so we'll be out of here around uh two o'clock local time central time we've got to break down a couple booths and start start packing everything for uh for the trip back home there's Jordan and Wara 246 out of 249 nice autograph for the bucks that's going to go to Brad correct Adam yeah maybe NT Zion logo man would would maybe move the needle on pricing market wide but but really if you're going to if you go down that road then it's a that's a rough road to go down because then you have to start you'd be like oh so how much do we lower the Pacers now now that we pull the Miles Turner relic some people don't get that though here's Miles Turner for the Pacers that's going to go to Jason there's an avesha courtside for the wizards rookie silver for the pelicans matt johnson has the wizards and the pelicans will be for brad and then we've got another wizard here davis bertanz to 149 um i think we're Malachi flint scope and a lamello ball uh not that the other one was concourse i think this must be these topplers are terrible but i'm sure they cost like that yeah every other one is like yeah this one works we have to use some off-rand topplers this is a premiere level yeah that's what we found on the floor i thought we had packed enough i can't believe we went through all this aeron a smith scope there's zion right there theomaldon 64 out in 199 jersey and autograph ok c brad with the thunder zignagi try color cream get the money dollar dollar bills y'all cash rules everything around me and just a fair warning if you're joining us remember uh if you're just joining us remember we have a very abbreviated day check the schedule in the chat but we've got a very abbreviated day on the on the last day of the national here on sunday not sure if anyone's going live on on youtube after this but as for us here in chicago we'll be done two o'clock chicago time and start breaking down our booth and start putting packing things up into the truck and all that jazz so that means whatever live at national breaks you can see live at national title whatever national breaks that we have we can still do back home but we won't be able to do those until later later in the week so you basically have to wait until the end of the week and that means waiting longer for the uh for the national promo to run it'll still run but you just have to wait so just fyi i know i think the national breaks are remaining on the site i think we can do all of them if we wanted to with the proper motivation we can proper momentum josh ok ok yeah yeah the setting up and breaking down is never the is never the fun part of the show there's nicole yokich the 199 for denver that'll be for brad ooh and a nice uh james weisman scope that'll be for nicholas and the gold state warriors concourse edition got a patrick williams and a anthony davis die cut to 175 for the lakers brad's got my lakers tyrese halliburton we got a ja marant to 149 it's pretty cool grizzlies brad with the grizz tyrese halliburton base car for matthew shearer concourse level and akira louis jr to 99 jersey and autograph will be for the pelicans brad with the pelz 31 out of 99 we've got a ziknaji tricolor for the nuggets kaleb martin for the hornets let's see if we can find his teammate in that parallel the bron james immanuel quickly silver nice rookie silver so this is a zion silver for all sorts of things happening oh that's cool john one of your old fifth grade students placed fifth in the 100 meter finals at the olympics what if he was just like i'd like to thank mr samison and of course there's a lot of other things like to thank mr s for believing in me back in fifth grade when he said when he told me to run towards your dreams i could have finished fourth but i wanted to finish fifth for my fifth grade teacher mr s i feel maled on lime green uh for okc brad with the thunder 96 out of 99 oh kevin durant apparently past car mellow anthing is the all-time points leader in u.s basketball history there's marvin bagley tricolor and another manuel quickly silver there's rustel lesbrook new laker uh-huh he thinks his physical education teacher no love for mr s show them on on your yearbook page though mr johns likes me and the philippines won their first gold medal ever as a country in women's weightlifting wow women's weightlifting so can you imagine what the look is the 16 in l in slovenia basketball play the us imagine the u.s and they like win a medal wow like how would look at like the gold medal helps it has to especially if you beat if especially if they beat us along the way that's how that helps luka a lot yeah if you was american yeah absolutely rudy gobert to 249 that i mean that imagine how cool that would be to win the first gold medal for your country ever yeah like that's huge yeah she'll never have to like five no yeah she's never buying a drink or a meal ever again all right man let me check all this really quick she said for life you can you imagine how many like philippines tv radio commercials she's going to do for the rest of her life endorsements all the time obviously the olympics is a good thing although so expensive for certain countries like it's just like coca-cola will do ads for her in the in the philippines for decades just cashing on that there's kevin martin timberwolves yeah i can't imagine that alaska is the home of top notch journalism there well good for her congrats to the philippines it's kevin martin timberwolves uh once again that's for taylor and remember of course all card ship in this so whatever i'm passing everything will ship there's trey young 37 out of 49 autograph brad with the hawks hey yeah i got the luke day yeah that was awesome 37 out of 49 ice tray for brad really great playoffs for him chilean haze try color wow bermuda also won their first gold smallest country to ever win a gold population on it what was the event and there's andre drum and lakers edition and that will be for brad and the lakers hey how are you i'm gary gordon gary gordon what's going on man how are you doing good doing good just doing my thing nice to meet you too sorry no no i appreciate all of your support zack levine to 299 and the bummer is like a lot of people who are come and say hello we don't really have as much time as we want to to hang out with them there's a westbrook new laker which i'm very curious to see how it works out alex caruso caruso his his instagram model girlfriend tweeted out that he may be going to new york is it free is it yeah but i don't know it's not official but if he gets paid yeah absolutely absolutely like i came out of nowhere and if if new like the nicks who have a ton of cap space if they give him a ton of money he's like yeah go for it alex you're not going to get that ever again you know halfway through this half case break another 15 20 minutes to go on this one appreciate everybody supporting us not only this week but uh but everywhere all all time we appreciate it we can't can't do things like this without without you without your support can't guard which video can i watch where i pull the luka one of one select i'm pretty sure you know when i when we get back home uh when i get back home i'll i'll be sure to tag the video i'm pretty certain it was pick your team four the first select break of saturday okay randon team four right was it randon team four no it would have been five it would have been five no i didn't pull it in this case right this is six i didn't pull it in five in the first half in this case it was the case before right right i'm pretty sure it was four no maybe it was three it was the first box remember the first box of the case look through them yeah just just look through them look through them like all the videos subscribe i should attack the video i apologize i should have been like luka one of one but i think it was the first first select break of saturday yeah yeah dame thank you i think it was the first break of saturday morning adam thinks it's number three next box and we got another laker denis schroeder also a free agent i like them on the thunder i just don't know if you feel so welcome i thought you would i thought you would too i really was excited about denis schroeder i mean he may end up back in the lakers but i think he's looking for this is 24 out of 99 he's looking for like 24 million bucks yeah he's looking for 20 plus million dollars a year i don't know if the lakers are prepared to do that but someone won't give him that money there's draymond to 299 at lakers relic once again going to brad and my lakers we got kenyon martin jr try color and chris paul to 199 kenyon martin jr showed some moments last season some good moments last season brad with the rockets and x-factor memorabilia signatures terry comings 90 out of 99 jersey and auto for seattle and seattle stuff goes to okc that'll be for brad we've got a couple patrick williams is here is same same ones and more rockets eric gordon die cut to 299 patrick williams is pretty solid all of those going to fred williams and the bulls last spot mojo let's see if we can find his autograph that'd be nice and precious ishua lime green autograph going to brad and the miami heat the heat is on 31 out of 99 and a sadeek bay silver nice that is a premier level addition so sadeek bay with the number one overall pay that to detroit has kind of has a young interesting young core possibly developing front of her eyes got isaac steward to sadeek bay safe with the boy etc etc etc for what what product oh that's back home in l.a. porterhouse steak what's going on i was uh i was thinking about you at dinner darin because we went to gibson steakhouse here in rosemont and there was a porterhouse steak there as as a steakhouse would like would usually have but i'm not a uh i'm not a large human the porterhouse is is bigger than yeah it'd be like eating the the weight of my head would be like a porterhouse steak i can't do that i cannot eat a porterhouse steak i suppose i could split a porterhouse steak i probably do i can't believe he was able to do that right i feel like a bowling ball in your stomach yeah that's good i had the i had the strip steak with the bone bone in strip steak medium rare bone and strip steak i like the bone in a little bit of a little bit of bone juices and marrow and stuff that are that kind of soak into the the strip steak as well paired it with a nice uh a nice malbec i had a beer as an appetizer oh man it was good i had sautéed mushrooms double double baked potatoes you had that you had that it was that how's that asparagus i didn't get around to that asparagus and get around to that was anthony edwards just to base anthony edwards for taylor and the tea wolves kasha stanley is a die cut that's going to be for jason and the pacers yeah that was nice darin yeah i was almost confused why didn't say darin porterhouse steak in front of this it's like oh look at the darin porterhouse steak would say no that's not what they really are it's just a regular just it's just porterhouse steak not darin porterhouse steak there's jason richardson to 249 that's an autograph in flight auto there he is in flight that'll be for the warriors nicholas l warriors come out to play tyrese halliburton tricolor i love those tricolors they look sharp matthew shearer last night oh hi tot oh and a lebron james uh court side thanks for coming by appreciate it i'm glad i'm glad we had stuff to give you not today i'm afraid we're doing the last one right now all right thank you there's lebron james court side yeah i think the strip steak that i got was uh was a 16 ounce and i think a few of those ounces were probably the bone do they do they weigh the bone on that i think so maybe they don't at a 149 a josh green and the tyrese maxi the 99 tyrese maxi jersey and auto for the sixers jason with philadelphia 44 out of 99 there's isiah stewart scope for detroit it's going to go to brad for the uh personal boxes oh a tyrese halliburton premier level silver kings matthew shearer nice silver obi toppen sabon lee and an onyeka akongu to 99 piece of his jersey it's pretty solid grad with the hawks with the atl three out of 99 steven adams to 299 and pj washington all right last box ram team six it has not subsided darin i still have to take care of that when i get home they're they're trying to they're trying to take a valuable parking spot away from me so i have to see if i could negotiate myself of the parking spot i think that'll that that should go over well with the property management company adam i'll go over there do you know who i am allow allow me to show you some of my big hit videos they will be uh i'm sure they'll be quivering in their boots ooh nice jersey and auto obi toppen that's for matt johnson and the new york nix congrats 162 out of 199 it's a top hit top top hit here he is again right this is true darin not as bad as like new york city proper but but yeah parking spots in la are very valuable there's onyeko kongu rookie silver for brad and the hawks alexa pokosevski piece of his jersey going to the thunder also for brad proverbial way steven adams his team i guess not his teammate but out of 25 still uh in his pelicans gear i thought he was still in his okc gear anyway tie dye pelicans tie dye for brad there's a lamello another one for charlotte eric barron and a tom chamber 78 out of 249 in flight autograph tom chambers a high flyer mike tower with the phoenix suns maybe he was the amaladon for okc so first off we got a james wiseman for golden state that's for nicholas premiere level that kenya martin jr for the rockets 201 out of 299 for houston that's for brad silver malachi flinn for the raptors premiere level matheshiro and a silver isaacoro i think phenoms insert i believe and the last stack here is cashew stanley tricolor got a jimmy butler die cut to 65 for the heat that'll be for brad blank card a lebron james silver and a devonta gram lebron james silver from premier premier premier premier level premier league lebron james premiere edition for the lakers yeah i learned that you know you don't do well you get kicked down to the yeah it's the relegation for the motion system yeah actually i actually binge that all week i've been i finished the first season the first couple of yeah it's a really good show that's what they had to do it at the end right that's pretty good pretty pretty good all right uh no randomizers no nothing let's do a quick recap no duet selections no randomizers to do so here's a little mitchell ronzin here's a little example of some of the relics and other highlights that we had in random team break number six big thanks everybody who supported us all week long at the national i appreciate it we appreciate it jaspy's appreciate it we appreciate you thanks for watching thanks for breaking with us i'm joe for jaspy's casebreaks.com see you next time for the next one bye bye


All right, I got some leaves to blow.  Let's see if we can fix it. Okay guys Shave every one thousand here again as you seen I Replaced a primer bulb on this not too long ago and when I went to start it. Well my rope broke I've had this thing for a while. I bought it at a yard sale or a flea market or something So hopefully Without changing the rope. It's only broke right there. I may be able to To just pull enough out of there and reattach it to here But first of all we have to take this cover off now to get to this cover here We have got Some bolts that are little screws are way down inside there. So what I'm going to do Is I'm going to go ahead and I'm going to take Take the engine. I'm going to take the backpack part. It's a backpack blower I'm going to take the engine off there that way. We're not going to have this in our way So let me get some tools. These are Torrex Torrex screws or Some folks like to call them star bit or star, but the technical name is Torrex You see that so I'm going to get the stuff we need And it's the same ones on the bottom of this. I'm going to get the stuff we need and We're going to get we're going to go ahead and take this part off the backpack The first thing we're going to do. I'm sorry about the light guys. You may see a shadow here and there I've got this light hanging up there To try to help you guys a little bit to see It is It's one of them late nights in the garage. It's nine o'clock right now. What I'm going to do is I'm going to take your plastic bag right here Just in case because these caps are vintage you don't want them to leak because you know We may have to we're going to be turning this up on its side and stuff. So This should keep it from from leaking, but we'll still do our best to make sure that it doesn't so we're just going to Put that right there for now. I'm still want to kind of turn it up on that side Now them screws I was showing you here wherever see these springs These springs right here. Okay, they're screws up under here. They are T 25 Torrex You might be able to get by with a number two square, but since I've got the Torrex bits. I'm going to use them So let's go ahead trying to stutter guys play here. I'm going to take these out So that way we can get the base off of this other one here. I think there's only three on this one You're on the backpack part So we'll get this top off and then we'll be there's this one of one of these Torrex screws down inside here There's one there. There's one up front right here one up front right there screws out If this will allow me to go down inside there and It will much the same length. So if they are just remember this is what we've got to work on down in here. You can see Maybe this is also known as recoil So get this out of here find out if this came off of my niece's home light I did a video on taking the turn the Cylinder head off of it. You just is still good But I mean this part of it is still want to be fine. It's just you know, I have to put replace the the pull rope So what I'm going to do and then pull this clear out The rope clear out of it a little smaller in diameter than that one But it may work until I get a more suitable one So what I'm going to do is I'm holding that like that with my thumb And I'm going to reach you down in here with my clippers and I'm just going to Clip that off Can Guess my clippers aren't going to cut it. I'll just be careful when you let that go Just go easy Because if you let it go, you could break the spring in. All right, so let's set this back over here We're done. That I'm back to this guy Now some of these you can take off and not worry about the spring flying out. This is one of them So there's a little screw right here in the center of that. I'm going to take this out It's like that. Now. This is a very important washer. Don't lose it or this screw You may be able to substitute the screw, but that washer is very concaved So you're not going to want to so pull that out just like that And down in here is the knot for your rope And it goes through that little hole Knot's up right there. So we're going to take these shaky today All right I think I'm going to do a live feed tomorrow night Well Friday night because he might not get this till tomorrow next Saturday. So go ahead and pull this out If you can't just cut it, you know, it's It's already shot, you know, so let's go ahead Cut this No, just like that. Okay. So now we have this Okay, now when we put this it back in there won't have to wind this I'm going to show you how we do that But first since this goes down like that. We won't be able to get it In there correctly and knotted right. So what I'm going to do is I'm going to go ahead and put the string in here the string we pulled off of the You know what? Let's get a little better cut on that. Let's go ahead and cut that off a little bit better There we go. And what you're going to want to do is you're going to want to melt that. Okay, use this little guy Because if not that'll fray out on you won't go through the hole. Okay, just get it and then Just something like that Okay, and then that way it'll keep it from fraying Now in the meantime We're going to have to take this end off too so And I'll show you what here Momentarily, so we're going to take this end Take this end off. Now this end has a knot on it Okay, so let's take this knot out See this one looks like a shoestring and I know it's not because My niece had bought that unit brand new so all right now what we're going to want to do is Right down inside here get the light on for me a little hole right there see that hole right there All right, we're going to stick that down through there I know it's kind of hard to see let's see if we can get if this will help any Hope it's not blinding you We're going to try to stick this in here Because it's got to come out through there so If I don't go try to squeeze that a little bit I might have bubbled it up too much I know I could just use this end And it'd go right in there But the reason why I want to do this end is I want to show you how These things can be finicky and the problems you may Run into as you're trying to do it.  Let's just nip A little bit of this off Let's try it again And this this rope may be a little too long to I don't know But we'll just have to see how it winds up Once you get it started down in there, you may be able to grab that With your needle nose and pull it through Now what you're going to want to do is make a little knot I know a lot of you guys have done a hundred of these go come on It's easy But for the do it yourself or that's never done one because they're thinking it's too hard Give it a shot I mean that's already broke right you can't Break it worse And there you go put down in there like that Okay There it is Now what we're going to do Is we're going to put this back on here And you have to turn this Until you feel it Pop in just like that, okay Now we're going to put our screw Remember I said don't lose that I just lost it We're going to put our screw back in Now what I like This is great for rubber and plastic This stuff here now I'm not in you know they're not I'm not getting paid it's just something I use Just for stuff like this Just to give it a little you know because that that is a moving You know that is a moving part in there so and it is plastic All right make sure I want to make sure that that popped down in there Okay it did all right All right guys now moving forward again Again you can use your your uh Impact driver if you wish I just you know this is going into plastics and kind of leery about that I've you know stripped things like this out before doing stuff like that Tighten it up Now That comes out Right through that hole There So what I'm going to want to do So I'm going to want to wind this all the way up But not the string don't wind the string up yet Just wind your spool. Okay. Don't wind your spring up. So I'm going to wind this spool All the way up as far as I can get it Now you can't see much good Just be careful Because it can get you you don't want to try to get this other end that hole It's tough to see you guys. I'm sorry Without letting go of it. Okay pull it through here Now it's got to go up through the other one It's coming out through not through there. Now what you're going to want to do Now let's wind up hold it tight and let it come back very slowly faster than what I wanted it to go Very slowly All right, so that's going to be enough. So now what we're going to do What a lot of guys will do they'll put a pair of ice grips or something on there and hold that But I'm always afraid it'll fray it there no pun intended so now We're going to want to tie our our thing off Which I should have already had this out of here, but All he did is just pull that out By the way, I have used boot strings and stuff for these before and a pinch And I've had them work for a year Now your results may vary now We're going to pull this up here and we're going to tie tie this into a knot big enough to where It's not going to pull through that hole, which that's probably big enough there, but let's just make sure There you go. Let's get you sorry again for the lighting and piss poor camera works like it's uh Make sure everything's good to go There's nothing in the way You see that? We're going to have this running here shortly Now I'm going to put all these screws back in And then we're going to start it. Okay, she's back together folks now You know your application may be may differ differ from this but I know I said a lot, but basically it's the same principle It's pretty much the same thing Now we're going to take this outside We're going to see if it'll fire up. All right guys. There you go Sounds like I may need to adjust the carburetor a little bit Tweak it out, you know, it's been sitting for a long time So But other than that, that's pretty much how you do it. It's all on the same principle the same basis Just be careful. Don't break your springs watch where your screws come out of Most importantly take pictures videotape whatever you got to do and That way if you forget something you can roll it back and go Aha that screw went here or that bolt went there So anyway guys, don't forget to check out my patreon page. Stop by and say hello and remember Thanks for watching Please comment rate and subscribe And if you subscribe to me, I will subscribe back to you So that means said guys shea bearer the myth the man the legend. I'm gone for now Bye. Bye guys. Take care


Whilst you're taking out your items you can also check your account info by clicking on the account info button in the bottom Right corner Wait a couple of seconds While your account information loads Here you'll be able to see how many items you have checked out if you have any items on hold and Also, if you have any fines Whilst taking out your items you can also renew items if you just click the renew items button Here you'll see a list of items that you have on your account to renew an item select the item or items and Then click the renew items and this will renew your borrowed items


And the way how I set the records is that I only use my core and the mermaid fin and I don't use my arms for a full stroke because I want to raise awareness that oceans are dying and fishes are getting stuck on plastic and fishing nets. So I kind of applied the ocean activism to my Guinness World Record attempt. My message is that we all can do more. We can give back twice than we took it. So if you don't know how, believe and you will and you will build a better planet. If you have heart pumping and brainworking, you can keep going in this world, whatever obstacles or swim against the current. We are the tool who can fix the world and you are the tool what can help. So change the mindset because it's in you.