Number one it bears repeating whole grains are not health foods. Let me tell you a story from yesterday. Yesterday I got a new patient who's actually the head of a big supplement-selling company and this gentleman was referred to me because in his early fifties now he's had not only coronary bypass but also a couple of stents. In fact he's scheduled for one next week and people in my circle suggested that he might want to see me to see what was up. Well this gentleman is thin and he's absolutely perplexed and he of course is in the health supplement business and so he's really healthy. One problem he has a hemoglobin A1C which you've seen on TV every day. I got my A1C down of 6.1. Now there are many of us who consider 6.0 and above as diabetes.  So here's a guy who's healthy as a horse eats healthy and yet he's a diabetic. So we started talking about what he eats. He said well ever since I got my diagnosis of heart disease I gave up milk and I've changed over to oat milk and I have about three glasses of oat milk every day because it's so healthy for me and I go well you know you just drink the oat milk he says oh no I pour it on my organic granola every morning and have that as my breakfast. Why is he a diabetic? Well number one as I've talked about before oat milk may be one of the most poisonous beverages you can put in your mouth for reasons I've mentioned before but it is a whole grain. Oats contain a protein that cross reacts with gluten and gluten as you know is that mischievous lectin in wheat, rye, barley and oats and that healthy granola is made from whole grains notably lots of oats and you probably know that consumer reports tested multiple oat products in the United States and found that all of them contained high levels of glyphosate including several organic granola products. Top that off with the fact that it's basically a giant sugar bomb so imagine that his whole grain breakfast his whole grain oat milk is one of the reasons that he's now seeing me for heart disease please there is no truth to the fact that whole grains are good for you. Now remember a lot of these studies were done in mice and rats and guess what mice and rats eat grains that's so what they like and they have a completely different system of enzymes that break down the proteins like gluten and the other lectins in grains like wheat germa gluten that we don't have so taking a mouse study and giving them whole grains and say hey they do really good you should too has nothing to do with whole grain goodness for you recently people gone well I'm not into whole grains I'm into pseudo grains like quinoa and everybody knows how good quinoa is because the ant Aztecs ate quinoa well yes the Aztecs did eat quinoa but what most people don't know is the Aztecs knew how bad quinoa was for them that they actually fermented their quinoa they let it rot so that the digestion of the lectins in quinoa and it's loaded with lectins was accomplished by the bacteria and only then they cook their quinoa and it's not on the package directions the same way with corn Central American Indians have been eating corn for 10,000 years and look how healthy they were not so fast we know that traditionally corn was always soaked in lime juice to break the hall of corn and turn it into hominy hominy intern had the niacin in corn bound so that it was not lost and it became safe because you removed the hall where most of the problem is that in turn was ground into rits and flour harissa flour and masa harissa was the only way tortillas was made in the good old days now unfortunately Cortes and the other Spaniards did not know this Columbus did not know this and so they brought corn back to the old world intact and as I've talked about before it grew very well in upper Italy near Milan and they changed to a corn culture and for several generations they gave birth to mentally retarded children with very small brains they were called Cretans Cretanism and it was directly related to the corn consumption that had not been treated with lie in fact to this day the eating of corn is banned in France because France abutted Italy and they saw the dire consequences and in France corn is fed to pigs not to people so whole grain goodness is the worst thing for you now there's plenty of healthy alternatives sorghum and millet don't have a hall so you're perfectly safe using sorghum and millet flowers sorghum and millet as an alternative to oatmeal they're perfectly safe you can get pop sorghum which tastes exactly like popcorn so lots of great ways to get your whole seed goodness without the grains all right number two artificial sweeteners the truth is some of the most popular sugar alternatives out there can be even worse for your health than sugar saccharine aspartame sucralose these are poison you might better know them by their brand name sweeten low equal and splendor these all kill gut bacteria in fact one Duke study from a number of years ago showed that one packet of splendor sucralose can kill off 50% of your gut bacteria they actually promote weight gain by fooling your brain that you have actually had sugar and then when sugar doesn't arrive in your brain your brain goes wait a minute I know you tasted sugar I tasted it it didn't arrive you got cheated go back and find some more and when I was a Diet Coke addict drinking eight Diet Cokes a day and 70 pounds overweight I knew that I was constantly hungry and the more Diet Coke I ate the fatter I got and the hungrier I got because my brain kept getting fooled now luckily there's some really good natural alternatives my favorite as you probably know is alulose alulose is a true rare sugar but it has not only no calories but it has the additional benefit that it is a prebiotic fiber so it actually feeds good gut bacteria and there are several studies that show alulose actually lowers your blood sugar so it's a win-win monk fruit is also a very useful sweetener it's not a prebiotic fiber but it also will not kill off your gut bacteria but alulose is a win-win no calories feeds friendly bacteria lowers your blood sugar and that's why I actually now make alulose at Gundry MD and you'll see it appearing in a lot of Gundry MD food products for that reason number three soy and soy products you know soy is getting more and more and more popular in plant-based diets but I'm going to put on my Loma Linda professor hat and take you back to Loma Linda University Medical School the Adventists use as one of their main meat substitutes what's called texturized vegetable protein TVP now TVP is fascinating it is soy that has been heated de-fatted and pressurized to produce this meat-like byproduct and those clever Adventists have taken away two of the biggest problems with soy number one they've taken soy oil which is a really nasty omega-6 fat and taking it out of soy number two with pressure and heat they've destroyed the really nasty lectins and soy and so TVP is actually a remarkably safe meat alternative all thanks to the Adventists the problem is that most soy foods have not had that done so soy milk tofu veggie burgers these are loaded with omega short chain omega-6 fats and they're loaded with lectins and they're even loaded with phytoestrogens which can become estrogen disruptors endocrine disruptors that's probably not a good thing soy and these as endocrine disruptors actually tells your body to store fat soy also contains goiter gins now those are compounds that actually suppress thyroid function and a number of my vegan patients who depend on their soy foods their tofu their veggie burgers have suppressed thyroid function and when we get those products away from them then their thyroid returns to normal the same way with these new exciting burger alternatives like Beyond Meat and Impossible Burger they're two meat alternatives that are made from soy so that healthy impossible burger you ordered through the drive-thru maybe just as bad as the meat burger you were replacing in fact in many ways it may actually be worse for you so be cautious when approaching soy number four store-bought salad dressings now you think you're doing yourself a favor by having a salad for lunch not so fast if you're using store-bought salad dressing chances are you're just as better off having french fries instead why most store-bought salad dressings are loaded with hidden sugars unhealthy fats they're made from these corn oils soybean oil cotton seed oil they are omega-6 short chain fatty acids linoleic acid which is really really bad for you and we've talked about the dangers of short chain omega-6 fats but there they are swimming around in your salad dressing other oils you sunflower oil peanut oil again all you're getting is a massive dose not only of omega-6 fats but all of these oils contain health-destroying lectins now don't get me wrong salads are incredibly good for you you simply need to make your own salad dressings at home and it's super easy to do you know I personally love to mix olive oil and balsamic vinegar or apple cider vinegar or champagne vinegar you name the vinegar it's going to go a long way to help your health along with the benefits of the polyphenols and olive oil as I've written about and unlocking the keto code in my upcoming book gut check vinegars are really one of the best ways to give your gut buddies the precursors they need to make this all important short chain fatty acid called butyrate or butyric acid so you can't go wrong and it's so easy now I have a ton of salad dressing recipes right here on my YouTube channel and in all my books I have everything from creamy ranch dressing to tangy vinaigrettes so there's no reason to ever waste money on store-bought dressing again more amazing episodes just like this one watch now this is organic green bananas you've heard me talk about the benefit of green bananas and now it's available in a pasta the great thing about this is it's loaded with dietary fiber


At the women and girls of our country, be given training so that they may do their share in the war and the urgency. How this training is given, and who does it, is of great interest to us all. To some of us, the National Youth Administration stands out as the agency which is doing the best job along these lines at present. Therefore, I congratulate Mr. Aubrey Williams on having inaugurated this training, and I congratulate the young people at having this administration with which to work. Of course this year, the National Youth Administration has done much to broaden opportunity for American youth. Today, it is broadening opportunities for service in the training of thousands of young women who are world leaders. Some of this training has been in fields traditionally occupied by women. Thousands of young women are gaining experience in power sewing to meet demand occasioned by the war. Others are being trained in character work, in photography, and in poster work. During the training period, they also do productive work for the armed services for the Red Cross, and for selective service goals. In many cases, they have released men for active duty in the armed forces.  The demand for trained nurses is so great today that assistance is badly needed to relieve them from routine duties in hospital work. The NYA is preparing thousands of young women of Hospital Aids to take their faces as assistance to our technically trained hospital staff. These young women are taking over such tasks as bed-making, feeding and care patients, sterilization of instruments, and assistance in laboratory and x-ray work. The value of NYA Hospital Aids was demonstrated beyond any doubt after the Pearl Harbor attack, when every hospital on Wahuaila requested their services. Reports from Honolulu authorities are that the manner in which they conducted themselves is a credit to our women. In large-scale food preparation will also be of value in emergency situations. Men have always worked in the shops to supply man's needs in peacetime and war. But today, as increasing numbers of men are called to military service, young women must be ready to step into their places without loss of time. Months ago, the National Youth Administration anticipating that need began to prepare young women for jobs in war industries. Skilled workmen with long years of experience supervised the work and training of girls in NYA shops. The entire emphasis of the NYA training program is on practical work experience using modern production methods under the direction of men to know through farm and farm industries. Employers in the war production industries are now making use of young women in handling small machine tools such as small lanes, drill presses and grinders. Young women have done especially well in those jobs requiring precision and a high degree of manual expert. Negro girls play an important part in the NYA training program and have made outstanding records in their shop work. Hundreds of girls are gaining experience in training and sheet metal work. Such training is essential for many jobs in aircraft and other war industries. In shops such as this, young women learn production methods through actual work. They have an opportunity to acquire skill in such jobs as cutting, bending, drilling, soldering. Young women are being trained by the NYA in the field of communications. Hundreds are gaining experience through practical work and the repair and construction of radio receivers and transmitters and other communications equipment. A great deal of work has been done for the Army and Navy as well as for other war agencies. Other young women are gaining experience as operators of radio equipment and are ready to take places of responsibility in the maintenance of essential communications, particularly during emergency periods. Some NYA girls are repairing Army telephones and other communications equipment. These young women are employed by the National Youth Administration in New Haven, Connecticut, doing welding and sheet metal work in the construction of a fixed bucket, a piece of emergency apparatus from local fire departments. This is an excellent example of the combination of useful production under industrial methods and the training of youth for war production, which characterizes all NYA work. In a period when every machine must count, the NYA's making its equipment serves two purposes, the training of young people for war industries and the production of goods, which also serves the nation's needs. In this instance, as in many others, youth are gaining valuable training and the community is better prepared for emergency. The passing of skills from father to son is well known in our American culture, but here is a case where brother shows sister how it is done. Tutored in the production of NYA machine shops, are many orders for small nuisance pods, boats and spoons for the armed forces. Thus, NYA youth are already playing their part in war production by being trained for jobs in war industries. Infection is a job for women's fingers. Carefulness checking at this stage is essential for the new functioning of the completed mechanism. Employers find young women especially capable in this type of work. These parts, shaped in work from rough materials, are now ready for use. NYA youth trained in productive work are at the nation's best.


I'm in the heat maps booth with Cyprian, the CEO, and he's going to show us some that looks pretty dog on cool. Yes, I will show you today how the heat maps works in iOS applications. It's basically a software for developers who create great applications for iPhone and iPad to see how their users interact with it. It's a software to find little twitches or problems in applications. People wanted to zoom in on a text, but developers didn't do zoom, or people want to scroll down on an interface that doesn't support scrolling. And sometimes... That sounds really cool, because how do you normally get that information, right? You just got to watch people. Yeah, you got to watch. And what we did is we created a software that you ship to the app store, and I mean, thousands of people can use it, and you get data from real people, and you get a lot of interesting, cool stuff, like finding out if they like to use their software in the portrait mode or vertical mode, because some people just prefer using a bigger screen, you know? And... So I'm a little confused. So let's say I sell Allison's great app to the app store. I also put a copy of this in the app store to go with it, like a tandem app. Absolutely, this is a static library. You just drag and drop it into your framework, into your application, as a developer, that's what you do. Oh, you ship it as part of the product? Yes, you do. Yeah, Apple approves that, because it sends anonymous data to our servers, and we aggregate the data, and we let you see it inside your application. Nowhere on the website, inside your application, looking... Let me show you a demo. Well, application... Let's turn this way. Yeah. Let's see, I'm just gonna shake this app, and our menu comes out, and I have a choice of viewing all touches, or single touch. This is one of our clients' application. Yeah, did you have to pick that app? Yeah, let's see. That's okay, keep going. So, let's see, this is the place where they want to touch. They don't want to log in, they don't want to register, they just want to go somewhere else. Let's see what the gestures they do. Well, let's see the gestures. They don't really rotate too much. They don't zoom in. And this is also audio, so I'm gonna tell a little bit about this. It shows clockwise, only four people, counterclockwise, eight, but pinching and zooming appears to be big. Yeah, more of swiping. I mean, people want to swipe even though it doesn't support swiping. Oh, interesting. 29% of the people tried to go down and it doesn't. Yeah, that's correct. So, I always laugh at this because when Google first introduced their website, people were also scrolling because there was just one little box. There's gotta be something more. Absolutely, so they find out that they need to put the Google copyright on the bottom to make them stop strolling. So it's interesting that we don't think about those little things, but users, if you don't tell them, they will try to do things. And for you as a developer, it's a good idea to see how people interact in their original environment, at home, at work. Right, right, and you can make it be more natural if the button was in the upper right, but everybody's touching the lower left to get to it, it wouldn't work.  Not everybody has a good eyes. Depending on what's your target, right? If you have older people as a target, you may need to get the feedback to make the application larger because they would want it to be. And this software will let you see that. That is really cool. So how do you price this? Okay, it's free for one screen of the application because, you know, we want to give the people ability to see it and if they like it, they can buy another screen for 10 bucks. So what does a screen and another screen mean? Okay, well, this is one screen, right? And for instance, if I go to settings, that could be another screen. If I go to, what's the screen? Oh, I see what you mean, a screen within the application. Yeah, within the application, yeah. So you said it was free for the first screen, but how much for the? $10, $10 for another screen. So if you had 10 screens, it'd be $100? Yeah, but it would be cheaper because we give discounts more, you buy less, you pay. So it would be probably around 80. That is absolutely fascinating. This is really a new thing. I haven't ever seen anything like it. It is a new thing. We've spent about a year working on it, making it better, overcoming problems because generating Hitmap is a very long process, but we do it with a powerful service and we just send you the results. So you don't have to wait and you get it always the fresh, real-time data. That is fantastic. Well, thank you very much, Ibring. Good luck. Thank you so much.


Thanks for the introduction. So this is joint work with Guillaume Castagnos from Rio Catalano, Fabian Laguomi, and Federico Savasta. So I'm going to explain how we build a generic construction for two-party ECDSA from hash-proof systems and how we efficiently instantiate these from class groups. So before I go into the details, let me give you some intuition for why this work is of practical interest. So ECDSA stands for Elliptic Curve Digital Signature Algorithms. So it's a standardized digital signature algorithm, which relies on Elliptic Curve Cryptography. And it's the signature which is used in Bitcoin cryptocurrency to validate transactions. In particular, this means that if someone steals your secret signing key, they can spend your bitcoins. So we have this single point of failure which we'd like to avoid. And this is where a distributed version of ECDSA saves the day. So by sharing the key among multiple devices, we not only reduce the risk of key theft, but we also enable cryptocurrency custody solutions where you need multiple parties to cooperate in order to perform sensitive operations. So we focus on the two-party setting. So this would allow you, for instance, to share your secret key between your phone and your laptop. So the secret signing key is shared between two parties, P1 and P2, such that collaboratively, P1 and P2 can sign any message. But alone, neither party should be able to forge signatures or learn anything about the reconstructed secret key. So for other signature algorithms, efficient solutions have been around for a long time. In particular, for Schnurr algorithms, whose Elliptic Curve variant is very similar to ECDSA, efficient solutions have been around since the 90s. But devising a two-party ECDSA scheme has proved much more challenging. And let me give you some intuition why. So we'll compare the Schnurr signing algorithm to the ECDSA signing algorithm for both schemes. The public parameters are the group of points of an Elliptic Curve, G, of prime-order Q, and generated by P. The secret key is a random X sampled from ZQ, and the public key is X multiplied by the generated P. So as you can see in the Schnurr signing algorithm, all the steps are linear. The only nonlinear step is the hashing of the message, but since both parties know the message, this isn't going to be a problem. However, if we look at the ECDSA signing algorithm, so things are very similar up until we compute S here, and we need to multiply by the inverse of K. And computing this inverse of K is what makes things really complicated. So imagine we wanted to just additively share X and K. For Schnurr, everything works fine. Each party can compute, can, sorry, each party can sample a share of X and a share of K, and they can each compute a share of the signature, which they just then need to add up to get the overall signature. On the other hand, for ECDSA, it's really unclear how we can efficiently compute K minus one, I mean the inverse of K from additive shares of K. So before I go any further, let me give you an idea of where we're heading. So I'll first talk about previous work in this field, and in particular that which we build upon. And I'll outline the drawbacks that these works have. In particular, the reliance on a non-standard interactive assumption. I'll explain how we remove this assumption by using hash-proof systems, and I'll provide the generic construction that we give and improve its security. And finally, I'll explain how we instantiate this generic construction from class groups, which allows us to remove range-proofs and significantly improve our communication cost. So previous work. In gray on this timeline, there's some work in the full threshold case. So some great work has been done in this field recently, but since once restricted to the two-party setting, these yield less efficient protocols, I won't go into the details here. IEEE S&P, Donner Al put forth a two-out-of-N scheme, which is fast, but it relies on oblivious transfer, so it has quite high communication cost. And we wanted to avoid that. So the work that we build upon essentially started at Crypto 2001 with Mackenzie and Raytor. So they had the idea of multiplicatively sharing X and K. And then they use the linear homomorphic properties of the Ballier encryption scheme in order to reconstruct the signature. The problem of their work is that for each signature, they need to perform expensive zero-knowledge proofs of knowledge in order to prove that the ciphertexts are well-formed. Much more recently at Crypto 2017, Lindel came up with a great idea which allows to remove all expensive zero-knowledge proofs on the signature algorithm so that they're only done once at key generation. So this is great improvement, but there are still some drawbacks in his work, in particular, due to the fact that the Ballier encryption scheme has a composite order message space, whereas the elements were going to be encrypting live mod Q. He needs to use range proofs. And he also needs to introduce in his security proof, artificial aborts. And when he's proving security in the simulation-based model, he also actually introduces a very ad hoc interactive assumption, which I'll talk a bit more about later. So since we build upon Lindel's work, I'll explain at a high level how his protocol works. So recall that our problem is that of jointly computing S. And so P1 and P2 each have a multiplicative share of X and K and they can set up the public key Q and the randomness R via a simulatable Diffie-Hellman key exchanges. And if we call this part of the message here S' notice that all operations relative to X1 are linear. So if P2 has an encryption of X1 that was sent to him by P1, it can compute an encryption of S' using the linear homomorphic properties of Ballier. And then if it sends this encryption of S' back to P1, P1 can decrypt, multiply by his share of K, and then he gets S. And it gets better because actually, since X1 is sampled at key generation, P1 is going to send an encryption of X1, a proof that what he encrypted is indeed the same X1 as that used to compute Q and arrange proof to P2, but he only needs to do these proofs once at key generation. He doesn't have to do anything afterwards. And now every time that P1 and P2 want to collaboratively sign a message, P1 can just compute an encryption of S' using his freshly sampled K2, send this encryption of S' to P1 who can decrypt to recover S' multiply by his share of K, and he gets the signature. And P2 doesn't have to perform any proofs that he performed the correct homomorphic operations because P1 can just use the public verification algorithm to check that the signature is valid. If it's valid, then he just outputs this signature. Otherwise he aborts. Okay, so this is great, but there are still some issues in particular due to the fact that we're using Pallier. In the Pallier crypto system, your challenger isn't allowed to use the, isn't allowed to know the secret key. Otherwise the algorithmic assumption doesn't hold anymore. And so in the security proof, when we're simulating P1 against a malicious P2, we can't actually decrypt to check whether the signature is valid and we can't check that P2 performed the correct operations. And so in the game-based proof, the way Lindell deals with this is he just guesses if and when player two cheats. So we have a security loss which is proportional to the number of signatures that RECDSA adversary is allowed to query from its Oracle. In the simulation-based proof, this guessing doesn't work. So Lindell introduces a non-interactive, sorry, an interactive and non-standard assumption which basically states that security for the Pallier encryption scheme still holds even if the adversary has access to an Oracle which tells you if a given ciphertext is a linear combination of the challenge ciphertext. And then the other problem is that, as mentioned earlier, the Pallier message space is a composite order whereas we're encrypting elements mod Q and so we need range proofs to ensure that no wraparounds occur. So in our work, we wanted to provide a two-party protocol for ECDSA which doesn't rely, well, which is efficient both in terms of computational complexity and in terms of bandwidth which doesn't require any non-standard interactive assumptions and which has a tight security proof. So to this end, we need a linearly homomorphic encryption scheme where security doesn't rely on the challenger not knowing the secret key. And if we can further have an encryption scheme where the message space is of prime order, then we can remove the range proofs. So we achieve this by using linearly homomorphic encryption schemes from hash proof systems. And when we instantiate this generic construction with a hash proof system from class groups, we can also remove the range proofs. So let's first see how we remove this interactive assumption. So we do this using hash proof systems. Hash proof systems were introduced by Kamehanshu at Eurocrypt 2002 as a means of efficiently computing both trace and plain text and chosen psychotech secure encryption schemes. So security in this setting relies on the hardness of a subgroup membership problem. So we have this finite abelian group X which contains a subgroup L which defines an NP language and does search, there's the witness set W which defines this NP language. And the hardness of the problem requires that given a random element sampled from X it's hard to tell if it's in the language or not. And so in this context we have two hashing algorithms, one which works over any element in the whole group X and which takes as input a secret key and hashes an element in X and another hashing algorithm here which takes as input a public key an element in the language and the associated witness and outputs a hash and correctness imposes that both algorithms should evaluate to the same value if they're evaluated over elements in the language. So from this we can, well they devise encryption schemes. So to encrypt an element basically you just sample a random element from the language with the associated witness you use the public projective hashing algorithm to compute a hash of X and you use this to mask your encoding of the message. So I've encoded the message in the exponent of F because we want a linearly homomorphic encryption scheme but the idea is just that you're masking the message. And then you return your masked message and the element of the language but not the witness. And so now the decryptor who knows the secret key can compute the same hash value using the secret key and the element X and can remove this mask to recover the message. And clearly knowing the secret key here doesn't actually help solve the underlying algorithmic assumption. With the secret key you can evaluate the hash function over any element in X but it doesn't help you tell if a random element in X is in the language or not. Conversely in the value crypto system which relies on the decisional composite as a Geosodyne assumption knowing the factorization of N actually makes the problem easy. So if we use an encryption scheme from hash proof systems our simulator can use the secret key and it won't compromise security. So now I can present our two-party protocol. It's very similar to that of Lindell's except for the aforementioned changes. So player one and player two each sample a random share of X. They can perform a simulatable Diffy-Hellman key exchange to set up the public key Q. Then P one is going to sample the secret and public key for the encryption scheme from hash proof systems. It encrypts X one sends this encryption of X one along with a proof that it knows the encrypted value X one and the randomness used for encryption and that the encrypted value is indeed the same X one as that used to compute Q. Both parties store the public key Q their share of X P one also stores his decryption key and P two also stores the encryption of X one that it got from P one. And then in order to sign a message each party samples their share of K they perform a simulatable Diffy-Hellman key exchange to set up the randomness R. P two can compute an encryption of S prime and send this to P one, P two decrypts multiplied by his share of K and verifies the signature if it's valid it outputs it otherwise it supports. Okay, so to prove security in this setting so for a two-party ECDSA protocol what we do is we demonstrate that if a party alone can forge signatures then a simulator which is going to simulate the environment for this corrupted player can output a signature of forgery for a standard ECDSA. And so we reduce the security of the two-party protocol to that of standard ECDSA. So in standard ECDSA a forger gets his input a public key Q which is X times P and it has access to an oracle which will sign messages of its choice and then it has to output a message and a signature which it didn't get from its oracle. So if I denote PI star are corrupted party for the two-party protocol if our simulator can set up the same public key Q as it got as input from like from its challenge then every time the corrupted player asks to collaboratively sign a message with the simulator it can just request a signature of this message from its oracle and then it's going to simulate the signing phase to output the same signature as it received from its oracle. And now if our party PI star outputs a forgery for the two-party protocol since they set up the same public key the simulator can use this forgery as its own forgery and he's broken standard ECDSA. So I'll now justify the security of our scheme. So I'll only talk about the part where our techniques kick in which is when we're considering a corrupted player two and so we need to simulate player one. So the simulator gets as input this public key Q it can simulate the Diffie-Hellman key exchange with the corrupted player two and from this simulated Diffie-Hellman key exchange it can extract the value X2 that was input by player two. Then the simulator samples a secret key and a public key for the encryption scheme and notice that it doesn't actually know the value X such that Q is equal to X times P. And so it doesn't know the X1 it should be sending an encryption of to P2. So it just samples a random X1 star encrypts this value and sends it along with a simulated proof to the corrupted player two and then they store the values that they want to store. And so this is where the indistinguishability of the encryption scheme is important because our simulator is just sending the encryption of a random value. Next to simulate the signing step. So P2 asks to sign a message M. The simulator is going to request a signature of this message from its oracle RS. From this signature it can extract the randomness R used for this signature. And then it can perform the simulated Diffie-Hellman key exchange with the corrupted player two in order to set up the same randomness R and it extracts the value K2 that was input by P2. And now when it gets the encrypted value C prime from the corrupted player two, it can decrypt using the secret key which it's now allowed to decrypt to use and check that player two performs the correct operations. If so, it returns the signature that it received from its oracle and if not it aborts. So thanks to this simple change we don't need to guess if player two cheats we don't need to use any non-standard or interactive assumptions. And yeah, that's it. So now that I've shown how to get rid of the strange assumption, let's now see how we can remove range proofs. So to do this we need an encryption scheme which relies on hash proof systems which has a prime order message space where we can actually choose this order to be the order of the group of points of the elliptic curve which is used for ECDSA. So this isn't common but we can achieve this from the framework which was introduced by Cassanius and Legumi at CTRSA 2015. So that of a group with an easy discreet logarithm subgroup. So we have a cyclic group G of order Q times S where the GCD of Q and S is one. Q is a large prime and we have a subgroup F of G generated by little f which is of order Q and another subgroup GQ which consists of the Q powers in G which is of order S. And we require that the discreet logarithm problem be easy in F. In this framework Cassanius, Legumi and myself introduced the HSM hard subgroup membership problem which essentially states that it's hard to distinguish random elements of the group G from random elements of the subgroup GQ. So from, if I compare to the framework of Cameron Schu that I talked about earlier, so here the language is GQ and the whole group is the group G and so if we witness for an element in the language is going to be a W such that X is GQ to the power W. And so we can create a linearly homomorphic encryption scheme from this setting and the secret key doesn't help distinguish Q powers in G. Cassanius and Legumi also provided and concrete instantiation for this framework from class groups. So here K is our imaginary quadratic field of discriminant delta K. And if we choose this discriminant to be divisible by Q then denoting O delta, the non-maximal order of discriminant Q squared delta K then we can exhibit a cyclic group of order Q in this, in the class group of this non-maximal order where the discrete logarithm problem is easy. And in this setting the security of solving the HSM assumption that I talked to earlier reduces to the problem of computing the class number and best number, the best known algorithm, sorry for this problem have complexity L one half as opposed to L one third for factorization or discrete logarithm in traditional finite fields. So in particular this means that we can use shorter elements than those used in the value encryption scheme which further reduces communication cost. So we implemented both our scheme and I mean our protocol and that of Lindell to compare speed and bandwidth. So yeah, in terms of speed for a lower levels of security we're slower but the more you increase security the better we perform and in terms of bandwidth we do consistently better. So to conclude we provided a generic two-party ECDSA protocol from hash proof systems where we don't have any interactive or non-standard assumptions. There's one thing that I didn't really mention is that the zero knowledge proof isn't completely generic it kind of depends on the instance of hash proof system that we use and we provide an instantiation in class groups which is practical and has very low bandwidth. And we're currently working on extending this to the full threshold setting. So thank you for your attention and if you have any questions. All right, thank you there. We would have time for only a quick question if you have one at the mic while the next speaker sets up. Okay, there's no question, that's thank you again.


Hi guys, this is Linda from Brain Education TV. If this is your first time, welcome. Please consider subscribing to our channel, like this video and click the bell for new notifications of each new episode. In this video, I'm gonna talk about eight lifestyle habits that will transform your health. We tend to think of good health as something we either have or something we're hoping to regain. But actually, good health comes from an accumulation of small little habits that make a healthy lifestyle. In other words, simply put, health is a habit. So here are eight healthy habits that you can incorporate into your daily life. Number one, don't skip breakfast. Did you know that a study done by the American Heart Association found that people who ate breakfast had lower levels of high blood pressure, heart disease and cholesterol levels? And did you know that different organs in your body are active at different points throughout the day? And your body metabolism is also different throughout the day too. So the best timing for your body to absorb nutrients is actually earlier in the day than later. This means even if you have a really busy morning, it's very important that you prepare a nutritious meal for yourself, particularly a food that gives your body and brain energy to process throughout the day. Number two, speaking of breakfast, prepare your food mindfully. Many times, especially when we're busy, we make food in a very hurried way. We just throw things randomly together and just mix it all up and then just eat it. But the energy that you put into the food when you prepare it is very important.  And what's worse, if you have to prepare food for other people, the angry energy that you put into the food is gonna be transferred to everyone who eats that food. So a very important, healthy habit is to prepare your food with mindfulness and gratitude. The energy that you put in is the energy you're going to consume and the energy that you consume is what makes up your body. So this means even if it's as simple as slicing vegetables or frying an egg or putting toast in your toaster, make every action an act of gratitude, act of mindfulness and an act of love and that energy will transfer into the food that you prepare. Number three, don't multitask. Did you know that our brains can only focus on one thing at a time? So multitasking is actually an illusion. You can be working on multiple projects at once, but at any given time, your brain can only focus on one thing. So rather than trying to overcrowd your brain and overstress yourself out, doing many things at one time, give yourself the space and the time to be present on one task, finish it, next task, finish it, so that you can do it with mindfulness rather than being scattered all over the place. You'll find that when you focus on one thing at a time and letting your mind be present on the current task, you'll waste a lot less energy and you'll come home feeling less tired. In this busy, busy world, allow yourself the luxury of slowing down. Number four, drink plenty of water. I'm sure you've heard this one before. It's not anything new, but we can't state this enough. We have to keep our bodies hydrated. All of the metabolic processes that happen in our body run on water. If we don't have enough water, our bodies can't eliminate toxins properly, which causes a whole range of health problems. Some symptoms you might be facing if you're dehydrated are kidney stones, bad digestion, headache, acne breakout, dry skin, lack of energy, and more. Since every cell in our body depends on water, having enough fluid in your body is very important for great digestion, proper circulation, and homeostasis. A good trick to figure out how much water you need to take every single day, take your body weight in pounds, divide it by half, and that's the amount of fluid ounces that your body needs. So for example, if you're 120 pounds, you divide that by half 60, then you get 60 fluid ounces. That's the perfect amount for your body weight. Number five, keep moving. Get up off your computer seat and move your body to get your heart rate going, air in your lungs, circulation, and reduced body pain. Exercise helps blood and energy move through your muscles and joints, which can help reduce the risk of diabetes and heart disease. Moving your body also boosts your mood and helps create endorphins, which are feel-good hormones. So it can be very helpful to combat anxiety and depression as well. Especially if most of your work comprises of sitting by a computer or sitting on your phone or not moving much, take at least 15 to 20 minutes throughout your day to just walk. And if you're so busy that you can't carve out 15 to 20 minutes to walk, then take a one minute break at the top of every hour. And during that one minute, move your body in a high-intensity way, like you can do squats or running in place or push-ups or sit-ups for just one minute at the top of every hour. This will help get stagnant energy up and running and moving inside of your body so that you'll feel more refreshed throughout the day and go home less tired. Number six, get a good night's sleep. Your body recharges and refreshes while you sleep. It's no surprise that we need to rest enough so that our bodies can recharge and perform optimally the next day. But going a step further than that, not only is it important to get a good night's sleep, but it's very important to sleep regularly every night. So just because you're getting seven to eight hours of sleep, it's not as efficient if you sleep at five in the morning and then wake up at noon or one o'clock. Sleeping at a regular time at night and waking up at an appropriate hour in the morning is the best practice for getting your eight hours in.  And taking care of those elements will determine how the rest of your day unfolds. If you have some trouble sleeping, try doing some toe-tapping exercise. I'll link a video in the description below to help you fall asleep much faster. Number seven, recharge in nature. Just like your body needs nutrients to be recharged and rejuvenated, your mind also needs to be recharged and rejuvenated through nature. Sunshine, birds, trees, clouds, flowers, grass, all of these things are gifts from nature that help our minds refresh and recharge. Many successful people like Bill Gates have a habit of going on a morning walk every single day. And these people report that they get their most creative best ideas when they're out in nature, not bothered by honking and machinery and computers and all of this when they can just relax and recharge and communicate with nature. A good way to relax and recharge in nature is to completely open up all of your five senses and soak it all in. Listen to the sounds of the insects, the birds, feel the breeze on your face. Listen to the leaves rustling, all of these things. Feel the earth with your feet. All of these things will help you recharge and relax your mind.  Number eight, connect with yourself. So many of us so often are so focused on things outside of ourselves, taking care of our family, taking care of our coworkers, taking care of our boss, taking care of our situations, our attentions are forever taken outside of us where we place other people as a priority before my own health and well-being. Not to mention our society has a very unhealthy feeling of guilt for self-care. Let me say it here loud and clear, self-care is not selfish. When we take some time to meditate every single day to see what we want, what our dreams are, what are my goals, where is my life headed, then your life will be more clear and you can live a more purposeful life. And studies show that the difference between people who feel satisfied in their lives and people who don't, the satisfied group, they have a clear purpose. And that purpose gives them reason to live and reason to move on. And the only way to find your purpose is to connect with yourself. Also, when you connect with yourself, you can see where your obstacles are. Think of creative problems to overcome your obstacles and you can also see how you can better your human relationships, whether that be a romantic relationship, a friend relationship, a family relationship. You can see clearly how you can improve those things to make your life much better. A great practice to connect with yourself and meditate is to do positive affirmations. I made a video about positive affirmations so I'll link that video in the description below. Make sure you check it out. Or another great resource is to read the book Connect by Ilchili. There you will find detailed meditations, principles and practice of how to best connect with yourself and what you can do concretely to resolve problems and to find solutions in your life. Good, physical, emotional, mental health is an ongoing practice that requires your attention every step of the way. And following these tips may be easier said than done, but if you start small and try to make these small changes every single day, you will create a healthy habit that will last you a lifetime. Do you have any personal tips that help you stay healthy? Please let me know in the comments below. I'd love to hear what your tips are. Or if you have any comments or things to add from my tips, please let me know in the comments as well. Thanks so much for tuning in guys. See you in another video. Bye.


Hello everyone, another year to see you in its special mode. Welcome to our talk, Cauchu Reveal and Exploit IPC Logic Box inside Apple. First, a self-introduction. DuPontmore is a senior security researcher. He is a member of EcoSec Team at Tencent Security Sherm Lab. His research focuses on microS, iOS and Windows platform security. He has found and reported many vulnerabilities to Apple and Microsoft. He is a speaker of Black Hat Europe 2018 and Defconn28. Reven Sun is a co-author of this presentation. He is a senior security researcher of EcoSec Team. He focuses on microS and iOS platform security. Jonathan is also a co-author of this presentation. He leads the EcoSec Team and is a speaker of Black Hat Europe 2018, Defconn China 2018 and Defconn28. This is the agenda of our talk. First, an introduction to IPC and Logic Vulnerability. Then we talk about the IPC mechanisms on Apple platforms. After that, we will share some interesting logic vulnerabilities we found in preferences and App Store.  Let's talk about some background knowledge. What is IPC? IPC means inter-process communication. It's a set of techniques provided by the operating system. It allows standalone processes to communicate with each other. The communication could be about the process notifying an under-process about some event or transferring of data from one process to another. The processes involved in IPC could have two roles, client and server. The client requests the server and server may respond to the client if needed. The web kernel provides the IPC channel to allow the client and server processes to send or reply to messages. There are three advantages that IPC provides. First, modularity. Modern software is more and more complex. With the help of IPC, developers could divide the complex system into separated modules. It reduced the complexity of software and avoids reinventing the wheel. Second, stability. If all data encodes are inside one process, a little error would probably crash the entire system. By dividing a complex system into separated modules, a module crash would not crash the entire system, which makes the system more stable. Third, privilege separation. With IPC, developers not just separate functionality, but also separate the privilege. Isolating sensitive operations into separated processes, keeping the processes the least privileged. Even if part of the system is hacked, it would not compromise the entire system and increase the security and protection from the attacks. Let's see an example of IPC usage. For web browser, it's nearly impossible to build a rendering engine that never crashes on hands. It's also nearly impossible to build a rendering engine that's perfectly secure. To solve this issue, modern browsers mostly use multi-process architecture. For example, it may divide the components into rendering process and networking process. The different processes of browsers would communicate with each other through IPC and often also needs to request the offering system system service. You may not feel it, but IPC is everywhere. The using of IPC divides the entire system into separated processes. Different processes have different privileges. Process may have low privilege or high privilege. Process may be sandboxed or non-sandboxed. There is a security boundary between them and IPC may break it. IPC is a bridge between different processes. So it is also a window between different privileges. IPC vulnerability is a key to high privilege. So it is one of the most valuable targets for privilege escalation. Logic vulnerability is different from memory corruption vulnerability. We do not want to play with memory corruption since they are boring to us. We like to find logic flaws. There are two kinds of logic flaws that is introduced during design phase and one is introduced during implementation phase. In fact, most of the time, abusing existing features are enough for us to compromise the entire system. Apple's new MacBook and iPad Pro have equipped with the new Apple M1 chip. The new chip brings many additional security features such as system integrity, data protection and pointer authentication code. The pointer authentication code or PAC is a hardware level security mechanism against memory bug which makes memory games much harder. Logic vulnerability is not playing with memory corruption and may not be affected. So it is the spring of logic vulnerability finally coming. Before introducing the IPC logic vulnerabilities, let's start with some fundamental knowledge of IPC on Apple platforms. Apple's IPC has different specific implementation methods. This includes shared files, shared memory and sockets which other systems support as well. There are also some that are unique to Apple such as marker messages, Apple events, distributed notifications and so on. However, the latest and most advanced IPC methods on Apple platform currently are XPC and NSXPC. Apple implements them on top of mark message. Next we will walk you through the principle and usages of them. Markport is an endpoint of unidirectional communication channel which is one of the fundamental primitives of XNU kernel for messaging. Messages can be sent or received from it. Users of markport never actually sees the port itself but accesses through a type of indirection called port writes. The sender of the message can send the message to markport through the send write. The receiver of the message can get the received message from the markport through the receive write. The message transmitted through the markport is called mark message. The system trap level API mark message and mark message overwrite can be used to send or receive mark messages. The structure contains a header, an optional complex data and message buffer. The header contains the sender and receiver of the message. The optional complex data part can transfer complex data such as file handle, shared memory and markport. Message buffer is used to send binary data. Mark message is low level and powerful, but it is also ancient and poorly documented. Developers need to construct entire structure to transmit data and handle different data type by themselves. It is difficult to use and Apple also does not recommend developers to use it directly. Instead, Apple provides high level IPC mechanisms that are easier to use. On top of mark messages, Apple built another communication mechanism called XPC. XPC is managed by LaunchD process. LaunchD is a naming server. The XPC server registers with LaunchD and declares that it will handle message sent to its endpoint. The client looks up an endpoint name via LaunchD and sends a message request. The server will receive the request, handle it and reply to the client if needed. Behind the scene, LaunchD starts and terminates the target server process on demand. The message sent through XPC is called XPC message, which is a more structural dictionary format. XPC users do not need to pay attention to the details of the underlying mark message processing. Through the XPC dictionary set APIs, we can easily construct an XPC dictionary message. Besides supporting the transmission of basic types of data such as typical string, integer and boolean, XPC message also supports complex data types such as file descriptor and shared memory. XPC message is serialized into mark message and transmitted to the other end of the IPC via the XNU kernel. The received mark messages is all serialized to XPC message and then can be used through the XPC dictionary get APIs. At API level, the XPC server calls XPC connection create mark service API with the XPC connection mark service listener flag set to register itself to LaunchD as an XPC service and then the client can connect to the XPC service through the same API. The message sending is completed by the XPC connection set message. After the process received the XPC message, the registered message handler via XPC connection set event handler will be called to process the message. The mainstream languages for app developers are the object-oriented objectives C and Swift. So Apple has encapsulated a layer of object-oriented implementation on top of XPC called NSXPC. NSXPC provides a set of remote procedural interface implementations instead of caring about the underlying message like XPC. After establishing the connection, the client can directly call the open interface of the NSXPC server across processes just like calling local methods. Apple provides many NSXPC classes for developers. The server registers the service with LaunchD through the NSXPC listener and specifies a NSXPC listener delegate to handle the connection request. The connection between a client and server is managed by NSXPC connection. What method can a client call in a server? The NSXPC server defines this through the Objective C protocol which defines programmatic interface between the calling application and service. An interface's definitions, common arithmetic types and basic types such as strings and arrays are directly supported as parameters. The interface also supports custom defined class objects to be passed as parameters. The custom object needs to implement the NS secure coding protocol. Here is an example. Here's an architectural diagram from Apple. The server registers the service through NSXPC listener. The app establishes a connection with the service through the NSXPC connection. In this process, both parties can directly call remote methods across process boundary without caring about the underlying implementation details. We will now share some interesting logic vulnerabilities we found and exploited on Apple platforms. We found and reported three logic bugs in preferences components. With these vulnerabilities, a local user may be able to modify protected parts of the file system. What are preferences? Preferences are user-defined settings. They are persistent data stored in preferences file. Its format is property list, also called plist. The service, CFCrefsD, has the responsibility to manage preferences. Each from or right to preferences file according to client requests. Apple provides two kinds of high-level preferences API. Using the foundation APIs, apps could use the NS user-defaults class to access its preferences. Each app has a single instance of this class, accessible from the standard user-defaults class method. Through the shared user-defaults object, apps could get and set individual preferences values. Apps can also use many of the underlying core foundation APIs. For example, CFCrefsD setAppValue and CFCrefsCopyAppValue could be used to get or set the preferences data. After reverse engineering CFCrefsD, we found it creates the XPC service named com.apple.cfrefsd.demon, which runs with root privilege and without sandbox. When a client requests CFCrefsD, even handler will be scheduled to handle the request. As a foundational service, preferences could be accessed from almost everywhere. Even the most restricted process needs to access preferences. Here is a sandbox profile for Safari web process. It allows the sandbox process to access com.apple.cfrefsd.demon. Because CFCrefsD is an XPC service, we could also request it by sending XPC message directly. It is a low-level method that could control the operation more precisely. Here is a sample request. First, we use XPCConnectionCreateMarkService to create a service connection. Then we create the XPC dictionary and set the key value that is used to control the operation. Finally, we send the XPC message through the XPCConnectionSetMessage API. Where does CFCrefsD save the preferences data? The preferences file path is constructed from multiple components. Part of it is the fixed value in CFCrefsD. Parts of it come from the client through XPC message. First, let's see the preferences directory where the preferences file is stored in. There are some predefined locations to store the file. PreferencesDomain is the value that is passed through the CFCrefsDomain key. By default, the file path is composed of preferences directory, preferences domain, and the service string.plist. How is the file path constructed? There are two main components. First, format the file path with CFStringCreateWisFormat, which connect the preferences domain with .plist, then using CFURLCreateWisFileSystemPathRelativeToBase to generate the full path. The base URL is the preferences directory, and the file path is the path returned above. Logic vulnerabilities always combine some features, and we found that CFURLCreateWisFileSystemPathRelativeToBase have two features that may be abused. First, this function has pass traversal feature. If file path contains ..slash, the returned file path could traverse to any path we want. The second feature is that if the file path is an absolute path, it will return the file path no matter what the base URL is. We could use the pass traversal feature or absolute path feature to control the preferences file path and return any file path we want. What if the controllable file path does not exist on the file system? The function named cacheActualPathCreatingIfNecessary is very interesting. Seems you will create the file path if it does not exist. First, it will try to open a file. If the file path exists, it will return the path. But if the file path does not exist, it will get the directory part of the file path, and it will create the directory. After creating the directory, it tries to open the file path again, and then return the file path. The CFPrefCreatePreferences directory is the function used to create the non-existed directories. It first split the path into multiple sub-items by slash, and then creates them recursively with make directory add. After the directory is created, its ownership will be modified through a file change owner. But where does the user ID and group ID came from? The owner of the newly created directories is determined by several factors. By default, the owner is the identity of the XPC client, and CFPrefsD gets the identity of the client user through XPCConnectionGetEffectiveUserID and XPCConnectionGetEffectiveGroupID. However, the XPC client can also specify the expected user. Therefore, the ownership of the newly created directory is also under our control. We can let CFPrefsD help us create any directory with controlled owner. There are many ways to convert arbitrary directory creation to code execution with root privilege. Here we share a method mentioned by Shubhub Fizzle through periodic script. Periodic script is a mechanism to schedule script execution. The daily directory does not exist by default, but the operating system will periodically scan and execute the files in it. By exploiting the vulnerability, we can create the daily directory and set the owner of the directory to the current user. And then we can write any script to the daily directory. Wait a day, and the script will execute with root privilege. The patch for the vulnerability is simple and straightforward. It can be explained even by looking at the function name. The cache actual path creating if necessary function has been replaced with cache file info for writing. There is no creating anymore. In fact, CFPrefsD will no longer help the user create the non-existing prefaces directory. If client passing a directory which does not exist, CFPrefsD will ask the client to create it. How does CFPrefsD read the prefaces data? When the client wants to get the data, the client needs to request CFPrefsD. By default, you will read the data and return them in the reply directly.  To avoid subsequent changes to the file, you will clone a copy before you return the file descriptor. This function is the implementation of CFPrefsD to process large prefaces file. First, it gets the file path, then it determines whether the file size exceeds one megabyte. Then it generates a random temporal file path according to the rules and then clone the original file to a temporary file. Finally, open the temporary file and return its file descriptor. It calls clone file to clone the file to a temporary file with a random name. The temporary file and the original file are in the same directory. The path of the temporary file is generated by make temp according to a rule. The rule is that the file path is spliced with .cfp and 7 random characters. So the final temporary file name is random. But can it guaranteed to be random? The make temp will replace the 7x at the end of the rule with random characters. The space for random characters is very large. Is there any other way to make make temp generate a faked file name? One key point is that snprintf specifies the maximum length of 0x400 when generating rules. If plist path is very long, what happens if the splicing rule exceeds 0x400? snprintf will overflow and the characters exceeding 0x400 will not be written into the written buffer. To be more precise, if the length of the file path plus .cfp string is exactly 0x400-1, the rule generated by snprintf will not contain x at the end. And make temp will generate a fixed temporary file path. The full clone file is called there is a file check. In exploit code, we can first pass in a normal file path. This will ensure that .cfprefst can successfully pass this check and enter the subsequent clone file process. After the file check and before the clone file, there is a window for its condition. If we replace the controllable file with the symbolic link during this time, .cfprefst will call clone file to help us copy arbitrary file to the temporary file path we control. We got a fixed temporary file name, but can we link it to enter the place ahead of make temp function? No. This file name is guaranteed not to exist at the time of function invocation. But after the make temp return successfully and before the clone file, this is also a window for its condition. We could replace the temporary file with a symbolic link. In this way, we can achieve arbitrary file write. In the patch, Apple added an overflow checking and the subsequent clone file will not be executed if overflow occurs. The previous method of forcing fixed file name no longer works. How does .cfprefst write preferences data? When .cfprefst saves preferences data for the client, first a extract key and value from xpc message, then it reads the original data from the target file and generates new data based on the incoming key and value data, writes to the new data to the temporary file and then you rename the temporary file back to the target file. When saving data, .cfprefst verifies the client has write permission to target file. The client needs to pass in a file descriptor with write permission. After the previous check, .cfprefst would generate a temporary file and write data to it. Then we'll rename this temporary file back to the target file. Can a normal user replace the source file of the rename with a symbolic link? No, this temporary file has a root-owned directory and normal user does not have permission to write to this directory. Can a normal user replace the rename target with a symbolic link? Normal user has write permission for the target but the target file will be deleted first when the rename is called. So even if it can be replaced with a symbolic link it will not work. Regarding this feature, the rename API documentation says if the final component of the target is a symbolic link, the symbolic link is renamed not the file or directory to a tree points. But wait, the document says that if the final component of the target is a symbolic link rename will delete it first. What if it's not the final component? What if the middle component of PListPath is a symbolic link? Suppose the path of preferences is slash temp slash test slash hello.plist If we replace the directory with a symbolic link pointing to the launchDemons directory then the hello.plist is used as the target path of rename. What will happen? The symbolic link will be followed and the temporary file will be moved to launchDemons directory. Before renaming the temporary file, it verifies the caller has right permission. However, after the file check and before the rename function, there is a time window to replace the middle component of file path with symbolic link. When renaming files it will move the temporary file with controllable content to arbitrary path. The patch for the rename vulnerability is very simple. Rename is replaced with rename.at. Rename.at locates the target file according to the directory descriptor to ensure that the final move target must be in a certain directory. So even if we replace the directory with a symbolic link it will not work anymore. Here is a demo. We use the vulnerabilities to achieve arbitrary file read and write and we could gain root privileges on macOS and read privacy data on iOS. First, we use prefixes vulnerabilities to achieve root privilege. We could see the system integrity protection is enabled the current user is a normal user, not root. We could get the root privileges very quickly. Next, we use prefixes probabilities to read privacy data on iOS. You could see our demo application is not allowed to access photos and contacts. However, when we take a photo, then open the demo application or demo application can steal the photo and send it to our server. Last year, we found and reported an interesting logic vulnerabilities in macOS app store component. An application could abuse it to gain elevated privilege. The vulnerability exists in NSXPC server com.apple.storedownloadd.demon. The server is implemented in store downloadd application which runs with root privilege. Fortunately, this process is running in sandbox. But unfortunately, as an app download service, it must have the ability to write to some sensitive locations. For example, it is allowed to write to applications and keychains directory. As an NSXPC server, it provides many interfaces for client. Here we listed the set store client and perform download interface. The perform download interface is very interesting. This interface performs downloading jobs for client. But what can it download and what is the SS download parameter? For NSXPC, the objective CU object that implements NS secure coding protocol could be used as parameters. SS download is such an object. This object only has one property, assets. And it is an array. The element in the assets array is SS download asset object. It is also an objective C object and it has three properties. The URL, download path dashes. The SS download asset object is passed from client to server. The properties of SS download asset will be serialized in client, the function encode with coder will be called to serialize the specified properties to XPC message. At the server side, the XPC message would be on serialized with any twist coder and construct the SS download asset object with specified properties. The properties of the object would be fully controllable. How does stored download D perform downloading tasks? You will perform download tasks according to the URL. Then it verifies the response contents based on the hashes. Finally, you write the contents to the specified download path. There is a hash verification in the download logic. This function will calculate the hash of the response contents and then compare it with the hashes the client specified. But it's not a security check just a data integrity verification. Because we can control the download URL, the content hash and download path we could write arbitrary file path with D stored download D's privilege. Attackers could say hi still download D please help me download the file from this URL. Its hash is this and then write the contents to this download path. Thanks. Then the stored download D would do all the jobs well for the attacker. How did Apple fix this vulnerability? The issue was adjusted by removing the vulnerable code they said. To be more precise they completely removed the service. There is no com.apple. the stored download D.demon anymore. Here is the demo of App Store vulnerability. We just downloaded the test.keychain intent directory to keychains directory with the help of stored download D. There are other interesting logic vulnerabilities we found and detailed in our blog. An XPC service implementation flaw which is a logic bug inside launch D for managing the XPC service. An NSXPC vulnerability in Adobe Acrobat reader for macOS. There are many security mechanisms on Apple platform that tries to make vulnerabilities harder to exploit. Like DEP, ASLR, PAC and so on. But you probably noticed that logic bugs are not affected by these security features. That's just awesome. Logic vulnerabilities has many advantages. Though it is hard to find it is easy to exploit. The exploitation is always stable. The logic vulnerabilities exist across platforms often so one exploit could roll them all. Logic bugs in core frameworks like preferences let us rule all Apple platforms Intel and Apple Silicon alike without changing one line of our exploit. Apple is also working hard to try to reduce the IPC attack services. For example, by adding more restrictive sandbox rules it reduced the IPC services accessible to applications. They keep deleting the unnecessary high privilege services and they are adding more and more private entitlements to make many high privilege services only accessible to Apple applications. It is hard to make sure everything is perfectly secure so Apple is also trying to limit the damage. For example they are putting IPC services in sandboxes and give them the least privilege. They are also using rootlist to limit the root privilege. In this presentation we talked about the latest IPC mechanism on Apple platforms XPC and NSXPC We walked you through some of the interesting IPC logic vulnerabilities three logic vulnerabilities in preferences and one in App Store. We detailed the design logic and implementation of these components the flaws inside them and how we exploit them to elevate privilege. And we also talked about the advantage of IPC logic vulnerability and the state of Apple IPC security. Logic bugs are always found too harmful we think you will love it just as we do. We would like to thank Shaba Spizzle, Ian Beane and Jujo for their previous work and shares.