Hello everyone welcome to my talk. Today I'm going to share my research about how to attack Microsoft exchange servers in Active Directory with only a normal domain account. I'm Tian Zedin. I'm from Tencent Security's Xiong lab. I'm focusing on Active Directory security, web team operations and web application security. I have reported some vulnerabilities to several well-known companies such as Microsoft, Apple and Google. I have also shared my research at Blackhead Azure or Blackhead USA Arsenal. Here is the agenda of this talk.  Next I will share two new vulnerabilities. I will show you how I can take over any exchange mailbox and how I treat RCE on exchange servers. As then I will detail a new method to help you perform lateral movements and escalate your privileges to domain admins after exchange server RCE. You may ask why I choose the exchange server as a research target. Microsoft exchange server is one of the most famous mail servers in the world especially for enterprise users. It stores large amounts of sensitive coverage information such as emails, email attachments, contacts, calendars of all users in your company. In emails there may be something that attackers are very interested in such as business plans, work arrangements, customer information and even contacts passwords. Most more, the service server is highly integrated with Microsoft Active Directory. Exchange server uses Active Directory for user authentication and the mailbox user user growth management. And it also stores amongst all configurations in Active Directory. HGC server must communicate with Active Directory to retrieve information about recipients and information about other exchange servers. So Active Directory must be available for exchange to function correctly. There are also some high privileged ideal jacks along with exchange servers. Usually you need to use enterprise admins to install your first exchange server in an organization. So there may be enterprise admins sessions on exchange servers. If an attacker compromised your exchange servers he may also have ability to compromise their enterprise admins. In all the versions in exchange servers, the exchange winners permission group has right DSTL rights on the domain object. If an attacker compromised your exchange server he could grant himself this sync rights and then escalate his privileges to domain admins. So exchange server not only stores a large amount of sensitive coverage information but also an effective way to escalate privileges to domain admins. So it has become a high value target for both APT groups and red teams. If only for vulnerable entities, we should have an overview of exchange server architecture and attack surface and pay more attention to those attack surface that are annoyed by other researches. As a mail server, exchange server has many client access services such as some exchange ACDS endpoints, some traditional mail services like POP3, NMEP, SMTPC, and unified messaging service for telephone. These exposed services are favorites of attackers, especially the web service. There are lots of exchange endpoints available to attackers such as OWE and ACP, which you can access directly with a browser, and other endpoints like EWS, MAPI, etc. which are mainly used by other loop. In the past few months, some high-risk vulnerability in exchange server has been exposed. Most of them mainly touch vulnerable ASP.net codes running on the IS server. But the architecture of exchange server is complicated. Is there any other attack surface in exchange server? In my opinion, the architecture of exchange server also contains the IS server based on my past web security research experiments. It's a very common situation that the web server was misconfigured by their web application developers. So maybe there will be some misconfiguration on the exchange IS server too. And Windows server is also an attack service. There are some services available to attackers in active directory environments. But in the server also supports both balancing architecture. There may be more than one exchange service in active directory, which may also bring new attack surface. And exchange server is highly integrated with the active directory. This may also bring new attack surface to both exchange servers and active directory. I will discuss this attack service in a following talk. Next, let's talk about the story of how to take over arbitrary exchange mailbox with only a normal domain account. When I was researching the exchange server, I found many ECP operations on the exchange PowerShell command lines support users to use UNC paths for file access. So this means if we have access to this ECP operations or this PowerShell command lines, we can trigger an assembly connection from exchange server to an assembly server. Next, we need to figure out which user's credential will be used in the assembly connection. This server uses a system account to run all its services. The system account is a local account. In active directory, more process running with the system account wants to perform network authentication. The credential of the machine account will be used for the authentication. As shown in the workshop, the exchange server will use the machine account exchange $1 to perform NTLM authentication in the assembly connection. So what can we do with the assembly connection and the NTLM authentication? How useful is it? Let's talk about the NTLM protocol first. NTLM is a very old authentication protocol in Windows system, but it's well-modulated for its Microsoft ecosystem in order to maintain compatibility with legacy clients and servers. And NTLM still plays an important role in active directory authentication. NTLM is an embedded protocol, which means it can be embedded in other protocols which need authentication functionalities, such as NTLM over SMB, NTLM over HTTP to server. And there is a famous attack about NTLM called NTLM Relay Attack. It's very old, but very useful in active operations. The NTLM Relay Attack works like this. If the victim is somehow tricked into accessing a malicious SMB server hosted by the attacker, the victim will be authenticated to the attacker. It will say, hey, let me log in to the SMB server. The attacker can relay the message from the victim to the attack team target and say, hey, I want to log in to the vulnerable service. The attack team target will send an NTLM challenge message to the attacker and say, hey, here's a challenge stream with hot sheets with your password. The attacker relay this message to the victim. Hey, victim, here's a challenge from a targeted target hashed with your password. Then the victim uses his password to calculate a challenge response and send it to the attacker. The attacker relay the challenge response directly to the targeted target and the targeted target check whether the challenge response is correct with the network on protocol. Finally, the attacker successfully logs in to the vulnerable service on the targeted target as domain text class victim. If the victim has some special privilege on the targeted target, the attacker can do something sensitive, can do some sensitive operations with the victim's identity, even RCE. So now we can trigger NTLM authentication of the exchange server machine count to perform NTLM relay attack. There are some preconditions for NTLM relay attack. Firstly, we need to figure out are there any vulnerable services on exchange server as the target of NTLM relay attacks? Then does the exchange server machine count has any special privileges on these services? A exchange server is highly integrated with Microsoft active-degree directory. There are many exchange endpoints for NTLM authentication such as the MAPI, EWS, RPC, auto-discovery, etc. Some of these endpoints are used by Outlook, which means that if an attacker can log in to these endpoints, he can perform almost any operations like a normal auto-look. Can we relay NTLM authentication to these endpoints? If the victim and the targeted target are the same machine, the NTLM relay attack is also called NTLM reflection. If there is only one exchange server in the active directory, can we perform the NTLM reflection attack? Can we relay the NTLM authentication of the machine account exchange one dollar back to exchange one? The answer is of course no. The patch of CVE 2018-8581 remote disabled loopback check configuration from the exchange server. So NTLM reflection is disabled on exchange server. And what if there is more than one exchange server in the AD? In my routine operations, it's a very common situation in enterprise environments that there are more than one exchange server in the active directory because of the need for load balancing. So we can relay the NTLM authentication from one exchange server to another. But there is a protection called EPA. What is EPA? EPA is a standard protection for authentication. It's a protection to defend against NTLM relay attacks for SSLR connection. There is a protection called channel banning in EPA. If channel banning is enabled in a web server, the client needs to calculate a channel banning token based on the TLS certificate of the ADTPS server and the user's NT hash. And as a token to the NTLM auth message, if the channel banning token is wrong, the server will not allow the client to log in. Attackers cannot afford a channel banning token without knowing the user's NT hash. Channel banning token and NTLM authentication over SMB are all zero by default. So if EPA is enabled, we can't relay NTLM authentication to exchange server and points. But fortunately, EPA is disabled on this exchange endpoints by default. Usually, most machine accounts in active directory are low-privileged accounts. Thus, there are exchange server machine accounts. Exchange server $1 has any special privileges on these endpoints. The answer is yes. Exchange machine account has an extended right called MS exchange API token serialization. As the output of the getAD permission command shots, all members of the exchange server group have token serialization rights on all exchange servers in their active directory. The exchange machine accounts are the members of the exchange server group. This means the exchange machine accounts have these special extended rights. For the EWS endpoints, if there is a serialized security contest field in an XML-RGDP request, it will try to create security access tokens based on the value of this field. If the client user has token serialization rights, he can use serialized security contest to force EWS to impersonate other exchange users, which means exchange machine accounts can impersonate other exchange users on EWS endpoints. An XML request with serialized security context is like this. You need to set the SID of the user you want to impersonate in serialized security context. And if you have a domain account in the active directory of the main user or the main computer account, you can easily read all the main user's SIDs or its LDAP query. You can also use SympactExchange.py to read all active mailboxes and corresponding user SIDs. After getting the user SIDs, you can set user SIDs in the serialized security context and impersonate any exchange user you want. So what can we do after logging in to the EWS endpoints as any exchange user? EWS is used by Outlook for Mac OS. So EWS supports almost all operations supported by Outlook. Such as FunFolder can be used to find all predefined and custom folders of mailbox users. FunItem can get emails in these folders and GetItem can read email contents. So if you can relay NTL authentication of exchange machine accounts to EWS, you can impersonate any exchange users and use this EWS API to read emails down the email attachments and emails as any exchange users. As we discussed before, we can trigger SMB connections with some ECB operations or some PowerShark manuals, but all these manuals are required high-privileged users. We can trigger NTL authentication with only a normal domain user without any special privileges. The printbar can do this. Tipkin found there is an RPC function called RPC Remote Find First Printer Change Notification in the print RPC. And this function is accessible by all domain users and domain computers. So any domain users or machine accounts in an active directory can make a request to the printer server and send their PSA local machine to an UNC pass. The printer server is running with a system account. It will immediately connect to the UNC pass and authenticate it to it with the machine account. So we can make a request to the exchange server and force their exchange machine account to authenticate it to us. So let's chat them all together. The XLAB backslash attacker is a normal domain user without any special privileges. I can talk to exchange one with printbar. Hey, exchange one authenticated to me as exchange $1 account. Then the exchange one established a semi-connection with the malicious SMB server hosted by the attacker and send NTLM authentication message to it. The attacker directly relates the NTLM authentication to the EWS endpoint on exchange two successfully looks in as exchange $1. Exchange $1 has token serialization rights on the EWS, so the attacker can impersonate any exchange users, which means the attacker can read emails, download attachments, send emails as any exchange user. I created a tool based on exchange relics to exploit this vulnerability. And here's a demo. There are two exchange servers in the active directory. The attacker says exchange two as the targeted target. The attacker can trigger an ACP connection from the exchange $1 to the attacker's machine with printbar. Next, the attacker can dump all mailboxes and user IDs. The attacker tries to take over victim's mailbox. The attacker can read victim's emails, download their email attachment. The emails read by the attacker are the same as the emails in the victim's outlook. Other contents of the attachment is also the same. Next, the attacker tries to take over administrator's mailbox. The attacker can read administrator's emails. Next, the attacker tries to send an email to victim as the administrator. The victim successfully received the email sent by the attacker. Let's talk about the patches. The APRO patch works as an exploit chain because the patch no longer allows machine accounts to log in to any exchange endpoints. And the vulnerability file was based on patch two exchange rack and assigned a single number CVE-2021-3768. In concurrent, if you have compromised a normal domain account, a domain user, or a machine account, and if there is more than one exchange server in the active directory, you can take over any exchange user's mailbox. So, are there any chance to achieve RCE on an exchange server with similar attack methods? When an exchange server was originally installed, it creates a high-privileged group named Exchange Fasted Subsystem Group in Active Directory. All members in this group have local administrator privileges on all exchange servers in a domain. And exchange server and machine accounts are members of these high-privileged groups. If we can relate anti-armor authentication of exchange server and machine accounts to some remote management service drawn around windows, maybe we can achieve RCE. Someone might say that maybe we can relate anti-armor authentication to the SMB and do something like PSEXEXCC, but unfortunately, SMB sign-in is enabled by default on an exchange server, so we can't relate anti-armor authentication to SMB of another exchange server. There are also some other remote management protocols like WNRM. WNRM also supports anti-armor authentication, but sign-in and sign-in are all enabled on its HTTP service, and channel winding is enabled in its HTTPS channel. So, relate anti-armor authentication to WNRM is also impossible. MSRPC is a remote-produced protocol implemented by Microsoft based on DCRPC. MSRPC supports multiple RPC types. The most common RPC types that can be accessed remotely over the network are ICACN-MP and ICACN-IPTCP can relate to anti-armor SMB to Microsoft RPC. To Microsoft RPC, ICACN-MP uses SMB as their transport protocol. Obviously, it cannot be our attack target. ICACN-IPTCP uses ports 135 and a dynamic port designed by the EPM to accept connections from RPC clients. There are many RPC interfaces available for us. RPC clients can set the OST type to RPC-C-OSTN WNT to use NTRM-SSP to authenticate to these RPC interfaces. Some security researchers have disclosed some RPC interfaces that are affected by the anti-armor related attack, such as the CVE-2020-1113. If the anti-armor related vulnerability exists in the task scheduler service, a attacker can relay NTRM authentication to task scheduler RPC and finally skewed commands remotely. CVE-2020-1167H is a NTRM-related vulnerability that exists in the print explorer service. attacker can relay NTRM authentication to print explorer RPC and finally conducts any files on the remote system. DECOM is filled on top of MS RPC, so how about DECOM? Is there an anti-armor related vulnerability in DECOM? Let's take a look. The common DECOM connection goes like this. Clients first connect to the port-100-35 on the DECOM server and send the anti-armor indication to it. After a successful login, the client will make a remote pretty instance request and the request includes both the class ID and interface ID. Then the remote service control manager on the DECOM server becomes responsible for the DECOM object activation. If the remote object is well-activated, an interface pointer OBGIF will be sent back to the client. The OBGIF contains a field called stream binings and the DECOM client can reach the object explorer with the stream binings. The client will then connect to the IP and the port according to the stream binings and send an anti-armor indication to the server. After a successful indication, the client can object the RPC request to use the remote COM object. The MSRPC supports several authentication levels. The RPC-C-Orson-Level-Connect authentication level indicates that the RPC connection doesn't need to be encrypted and signed. Understanding and solving are not supposed to enable which aren't DECOM servers. The authentication level of an RPC connection can be completely determined by the DECOM client. So, attackers can also set the RPC-Orson-Level to RPC-Orson-Level-Connect to avoid encrypting and signing and relay anti-armor indication over SMB to DECOM. Now, we can relay anti-armor indication to DECOM. We need to find a COM object to help us use skilled commands on the remote system. As a well-known technology based on DECOM and SWMI, it allows emitters to manage the remote system and skilled commands on the remote systems. But the protocol of WMI is a bit complicated. There are also some simple COM objects and all of them can be used to execute commands on the remote system. Here, we choose an MSC-20 application to help us execute commands on the remote system after a successful anti-armor relay. MSC-20 application has an API called a skilled short command which can be used to execute commands on the remote system. Why finally choose to use MSC-20 to execute commands? Compared to Shellwindow and Shellbrowserwindow, MSC-20 application is still available on latest Windows Server 2019. And compared to WMI, WMI requires authenticating to too many RPC interfaces. But MSC-20 only requires twice anti-armor indications. Just like the workshop shows, the MSC-20 needs to authenticate to the iSystemActivator interface on the IP dispatch interface. It's friendly to the exploitive development, so MSC-20 is the best choice for us. So, let's chat them all together. The XLAB backslash attacker is a normal domain user without any special privileges. I can talk to the exchange one with printback hey exchange one authenticated to me as exchange $1 account. Then the exchange one sends anti-arm authentication message to the malicious SMB server hosted by the attacker. And there can be multiple anti-armor indications in an ICD connection. So, the attacker doesn't need to send a second printback request to trigger a second anti-armor indication. The attacker can directly relay first anti-arm authentication to the Decom iSystemActivator interface on their exchange two and use create remote instance to active the remote MSC-20 application project. And then relay the second anti-arm authentication to the Decom iD dispatch interface and find their SQL shell command and invoke it to SQL commands remotely. Here's the demo. There's no calculator process on exchange one. And there is no calculator process on exchange two. First, start attacking exchange two. The attacker can trigger a sending connection from exchange one to the attacker with printback. Now, the calculator has been executed on exchange two. Next, let's start attacking exchange one. The attacker can trigger an SMB connection from exchange two to attacker. And calculator has been executed on exchange one. Actually, this is a vulnerability exists in Windows Decom not in the exchange server. But we can use it to attack exchange servers. This vulnerability has been fixed and assigned CVE-2021-26414. But after installing the patch, you need to manually to set require integrity activation authentication level to one in the registry to enable the protection for Decom. This protection will force enable RPCC OS level PKT integrity. After Q4-2021, this protection will be enabled by default on Windows. In conclusion, if you have compromised a normal domain account, a domain user or a machine account, and if there is more than one exchange server in the active directory, you can execute any commands remotely on this exchange server. RCE is only the beginning for web teams. In this patch, I will introduce a new method to help you perform natural moments and privilege and escalation to domain admin after RCE on exchange server. When exchange server was originally installed, it configures and grants itself extensive active directory permissions. These permissions provide necessary access that exchange server may ever need. There are some privileged escalation methods with these permissions, such as abusing RedDSL on a domain object, and abusing DSLame's group. By this attack passes had been fixed in 2019. There are also some natural moment methods, such as abusing false-change password writes on the main users to false-change users' passwords. But attackers cannot recover the victim user's original passwords because they don't know the plant-type passwords of the victims. Attackers could also abuse the RedDSL writes on the main users and set SPN on the main users and perform their copyrights gene attack. That sometimes is hard to brute-force passwords, because there is a complex password policy. I think that there are no easy-to-use natural moment methods and no privileged escalation methods after exchange server RCE. So, let's introduce a new one. Let's introduce the exploitive parameters firstly. Suppose the attacker already colonized the exchange server he had taken fully controlled the exchange server machine counter to exchange one dollar. He can download the empty hash of the exchange one dollar and do anything as exchange one dollar. The exchange one dollar is a member of exchange trust-based subsystem, and exchange trust-based subsystem is a member of exchange-based permission. Exchange-based permission can add a member to group policy create owners and exchange trust-based systems. So, the attacker can add users to these three high-privileged groups. The members of exchange-windows permission group can create new organizational units in Active Directory. And the members of group policy create owners group can create new group policy objects in Active Directory. The members of exchange-windows permission group has right distinguished name, right name, right name, and delete object writes on domain orders and domain computers. With this right, exchange-windows permission group can move domain orders or domain computers to other containers. Next, let's design a new lateral moment method. First, the attacker can add himself to exchange trust-based subsystem group and group policy create owners group. Then he will get the same permissions as these two high-privileged groups. Then the attacker can create an evo.io and an evo.gpu. Next, he can create a gpu link from the evo.io to the evo.gpu. This allows the process in the evo.gpu to take an effort on evo.io. And the attacker can add user immediate task to the evo.gpu which is to execute attacker's commands. Here is purple calculator. Then the attacker can move the victim user to the evo.io and just wait for the group policy to refresh. When the group policy is refreshed, the victim will purple calculator. The waiting time will be longer than the gpu refresh time because gpu group policy engine need to think all your information of the victim with the active directory firstly. After the attack, the attacker can move the victim to his original orio and remove the evo.io and the evo.gpu. I didn't find a writing tool that can manipulate gpu remotely so I create a new one called sharp.gpu. You can find it in my github. We can use sharp.gpu to create all your gpu.gpu links in the active directory.  Here's a demo I will show how the attacker moves naturally to the victim and pops calculator as their victim user. The computer on the left side is the victim. The computer on the right side is the attacker. Now the attacker is a member of domain users. The attacker can add himself to high privileged groups if he has compromised exchange $1. Now the attacker has been added to these two high privileged groups. And then the attacker can create an evo.io and an evo.gpu and link the evo.gpu to the evo.io. And add a malicious user immediate tasks to the evo.gpu. Next move the victim to the evo.io and just wait for the group policy to refresh or wait for the victim to log in again. When the victim logs in successfully the group policy will be refreshed and the calculator is executed. After the attack, the attacker can move the victim to his original.io and remove their evo.io and evo.gpu. You may ask, can we escalate our privileges to domain domains? Can we move their domain domains to the evo.io? The answer is we can't because of the domain SD holder. A domain SD holder provides a permission template for the protected accounts and groups. All domain domains have the domain account attributes set to one, which means they are protected by a protected by a domain SD holder. For a new domain domain is created in the acute directory, the exchange does have permissions to move it to the evo.io. But about 60 minutes later, the permission will be removed because of the domain SD holder. So we can't apply malicious group policies to domain domains. Unfortunately, the computer projects in domain controllers group are not protected by a domain SD holder. So, the attacker can create a new orio or new gpu and create a gpu.link as before. Next, add a malicious computer immediate text to the evo.computer gpu, then move the domain controller to the evo.computer orio and just wait for the group policy to refresh on the domain controller. When group policy is refreshed, a calculator will be executed on domain controller with the system accounts. Now, the attacker can fully control the domain controller and the entire active directory. If you are worried about that moving the domain controller to a new orio will affect the functionality of it, you can apply original orio default domain controller policy to evo.computer orio. After the attack, the attacker can move the domain controller to its original orio and remove the evo orio and evo.gpu. Here's the demo. I will show how the attacker moves naturally to the domain controller. I will post calculators with the system accounts. The computer on the left side is the domain controller. Now, there is no calculator process on the domain controller. Next, we run a route loop to check where the calculator is executed. The computer on the right side is the attacker. Now, the attacker is a member of domain users. Attacker can add himself to high-prevaged groups if he has compromised exchange $1. Now, the attacker has been added to these two high-prevaged groups. Next, the attacker can create an evo.computer orio and an evo.computer.gpu. I will link the evo.computer.gpu to the evo.computer.orio. Next, add a malicious computer immediate task to the evo.computer.gpu and move the domain controller to the evo.computer.orio. I just wait for the group policy to refresh on the domain controller. About 30 minutes later, the calculator is executed with a system account. After the attack, the attacker can move the domain controller to its original orio and remove their evo.computer orio and evo.computer.gpu. Here is the mitigation. You can switch your external server to Active Directory's deleted permissions model. This model effectively limits our exchange rise in Active Directory. Attackers cannot use the models we talked about to perform lateral movement and privilege escalation. Conclusion and takeaways. The ratings in this talk are disclosed to two new exchange server vulnerabilities. The first one can be styled in Active Directory mailbox takeover. Attackers can read mails or download attachments, send emails, etc. as any exchange user. The second one can lead to remote code execution on exchange servers. I also introduced a new method to help your lateral movement and help you escalate your privilege to domain means after exchange RCE. For routines, you'll need to patch all your vulnerable exchange servers and their window service, your exchange servers around here. And it's possible switch your exchange server to Active Directory's delete permissions model to prevent attackers from escalating privileges. This tracked anti-army usage as much as possible to prevent some anti-army related attacks is also useful. Thanks to all these security researchers and their amazing work, their work inspired me a lot. And also thanks to MSRC for their hard work in fixing these vulnerable abilities. Okay, thanks for your listening.


Hey beauties, I'm Bianca Renee, and you're watching Bianca Renee Today, and today I am very excited to try a full week experiment of using aloe vera. This aloe vera plant's supposed to be like the heelol, fixol, especially for your skin, it works for your hair, it has a bunch of natural, I mean, it does get more natural than just taking the actual plant. So I'm going to be trying this on my face for a full week to get rid of all of my acne scars and to see what it really does for my skin. So I'm going to be doing a mask, hoping to do morning and night every day for seven days, and then I'm going to show you my ending results. So I got this huge aloe vera leaf from Whole Foods, it was $1.99, and I'm going to be taking the juices straight out of the plant. But first let me give you a close up of my day one skin. So I have some scars right here, luckily like my actual active acne has gone down. I've got a couple blemishes right here. This is what we're working with, some on my neck, you notice everywhere. So take a good look, because hopefully all this will be gone in seven days. So now let's go ahead and head to the kitchen where I'm going to cut this up and show you exactly how I apply it to my skin. So grab your knife if you're old enough to safely do so.   We don't need any of that. And then we're going to get the actual aloe vera straight from the plant. This is how it looks inside, just full of nutrients. So now I'm going to cut off a little chunk right here. As you'll see from the video, my chunks get smaller and smaller because I realized how much comes out of just one little piece, but this was good for my first time. So you are going to cut off those spiky little parts on the side, exposing the gel from all angles. And it looks like this. Pretty cool, huh?  All right, so I have my two pieces. There's a couple of different ways to do this. You could scrape out the gel, but I'm just going to use the pieces straight from the plant. Starting off on a clean face. Just going to rub it into my skin. Whoo! Nice and cool. Nice little cooling sensation. Oh yeah, this is fun.  I'm going to put this literally everywhere. It smells, I don't know, like a plant. Now I'm going to scrape into the jelly and push that into my skin. You really do get a lot just from one piece. I didn't even really need to use both sides of this. Ugh. People make this look so easy on YouTube. So now I've let this mask sit on my face for about 20 minutes. And as you could see, it kind of sits as like a very shiny film. And I'm going to rinse it off with a wet washed cloth. And there you go, day one. To make sure that your aloe vera stays fresh, it is really important to wrap it up in saran wrap and also keep it in the fridge. This could last you at least a full week. It is now day two and I'm going to try something different. This time I'm actually going to scrape the aloe vera out of the plant. So I'll cut it the same exact way, but I use the spoon to just scrape out all of the aloe vera. And place it in a cup. And then I just use my spoon to mix it up and get rid of the large chunks. Now that I have just the aloe vera, I'm going to press it into my skin, really letting it moisturize and soak into my pores. If you have seen these large aloe vera leaves in stores, please leave a comment and say where you live and where you're able to find the plants so you could help someone else watching. And that completes day two. Good morning. It's now day three, grabbing my aloe vera out of the fridge and we're gonna do it all over again. I did learn that I did not have to use as much aloe, so I cut much smaller pieces by day three. Here's how my skin is looking. Quick little update, after three days of aloe vera, I used it every morning and at night. And I even did some nights where I let it soak in overnight, but didn't really notice a huge difference when I did and when I did not. But now that it's nice and cold from the fridge, I'm going to smooth this all over my pores and skin once again. Today's day four, things were getting better until this guy showed up in the sky. So, small little blemishes, but let's at least see if it'll get rid of all the scars. Not to be discouraged, it's only day four, but I do not think that my little breakout happened because of the aloe vera. I think it has happened because I have acne from skin. So I'm not expecting it to just cure my acne, but let's see what this does.  This is going to open the pores and really just let everything soak in. Now it's day five and guess what? We're going to do the same thing all over again. Every morning, oh Lord, look at my hair. Obviously I just do this first thing in the morning before I do anything to my hair. So excuse all the crazy hair. But just keep masking, just keep masking. What do we do? We mask, mask, whoa, whoa, whoa. Okay, you guys saw this song. And it's now day six. Come on, skin, I'm rooting for you. So I got another little piece using my nail to get more of that gel to have it come out because a little goes a long way. I just really want this to work. Now I am using a hot towel once again. This was my new favorite thing to do. Think of it just like as we deep condition to open up the pores in our hair. It does the same thing for our skin. And now day seven, this is how much aloe vera I had left for the last day. Getting down to the end. But I did notice that when I cut it, it had a little bit of a darker, almost pink color to it. So I wasn't sure if I should use it anymore. I mean, granted, I probably could make it last one more day, but I had a whole other aloe vera leaf to use. So I thought I might as well get the nice, clear, good stuff. But I will say that when cut correctly, one aloe vera leaf can last you a full week even when you use it every morning and night. So on day seven, this is how my skin is looking on the last day of my aloe vera mask challenge. I do think that everything looks a little bit lighter. Obviously, the skin is not perfect. Still have some blemishes, but we'll see how much this can change overnight. All right, so here we are at the end of seven days of aloe vera masks. My last day was yesterday. So here is the final look on my skin. So as you can see, skin still not perfect. Still have some scarring. This guy really just messed up everything. But I did actually like it. Although it did not get the outstanding results I was hoping for, I can't just sit here and title this video, aloe vera is canceled just because it didn't work for me. Because I got way too many testimonies from you guys that wrote me on Instagram or Snapchat saying that use aloe vera all the time and it does amazing things for your skin. And you have to try things for yourself to see how it works. And that's what I did. So I do think that my skin felt very moisturized. I think that it did start to fade my scars. Now a lot of the other YouTube videos that I watched about aloe vera, a lot of those girls either put witch hazel on their skin after maybe apples had a vinegar. They had different types of moisturizers. So all the different things that we put on our face play a factor. So I was trying not to really use too many other products during this aloe vera challenge to see how well the aloe vera would work on its own. But this coming week, I'm gonna take this challenge to the next level. I'm gonna continue to use aloe vera. But I think what I wanna do is go back to my Macari toner. And I think I wanna start using the Genador even tone retinol complex serum. So I'm gonna now mix the natural of natural aloe vera with some different skincare products that I own. I'm gonna see how everybody works together. But overall, I'm still very glad that I tried this challenge. As you can see, I tried aloe vera with rubbing it on my skin. I tried taking it out. I haven't done the whole like mix it up in a blender and add essential oils yet. But like I said, I wanted to try the aloe vera just on its own before I started making different concoctions. So I might experiment. Let me know what you guys want me to try with the aloe vera next. I probably will do an aloe vera hair mask. Let me know in the comments. Let's make it happen. If you enjoyed this weekly experiment, want me to try other DIY things, make sure you give me a thumbs up and subscribe. I post two new videos every week once on Friday and once on Sunday. So I hope to see you guys next time. Thanks for watching Beyond Grinne today.


All right guys, welcome to the big announcement that we're doing. So as I was saying, there's not many certainties in life. I know of two certainties in life, okay? One is death. And then you know what, the next one, you know it's coming. Death and taxes, man. That's the one thing we can't avoid. If you avoid taxes, you're dead. So to me, they're all inclusive.  So being a trader for the past, my God, how long now? Like almost 20 years, man. I've been trading for a long time. On top of that, I've been working. And so the one thing that I've always been confused about is the tax codes and all this stuff. So I mean, every year I pull my hair, I don't know what to deduct. I don't know how I'm going to do it. There's basically one guy on the internet that does this and he charges a ton of money. And then even at my level, so I had card once for a tax, like an expert tax for stocks. You know what they told me? They base it upon the number of trades you do.  And so I'm like, dude, my taxes will cost me more than my profits, right? And so for the longest time, I didn't know what to do. And I believe everything happens for a reason, guys. Everything happens for a reason. We started at MIC, met a bunch of great people.  And he goes, yeah, I've been doing this for a long time. And I'm also a trader. He's a kickass, profitable, consistent trader. You know, and we've known each other for a long time, like back and forth, but we really never really talked and met in person until recently. And that's how it came upon. So let me introduce you to Brian, Brian Riviera here. Wow, what's going on, man? Thanks for having me. How you doing, brother?   And you know, a lot of my clients were public filers. So, you know, the Disney's, the Verizon stuff like that. And so I would always watch, you know, their stock price before earnings because we had access to confidential information, but I could never trade because of compliance requirements. So finally, I think one day I saw a stock, I think it ran like 100%. And I was like, dude, I'm in the wrong field. Like I need to figure out how I can get around this compliance piece, but also keep my CPA, my tax skills intact. And so I started my own firm where I focused on small businesses, individual taxes, things like that here in Florida. And at the same time, I would just trade. You know, I like to call myself a full-time trader and then with a business, but actually I'm a part-time trader with a full-time business because the way my strategy works, I'm in and out by about 10, 10, 30. So I mean, that's the thing. People make, I mean, we make money. And when we make money, it's like, oh crap, I want to keep the money. So that's the problem.  So this is why I talked to Brian. I'm like, dude, what's the best way for us as a normal person to keep the money that we've actually made? And they ducked everything that we're liable. We're supposed to be ducks. So we came upon, so now Brian and MIC has teamed up. So Brian's the CPA. Tell us quickly your background. Like, where'd you work at the big houses? Yeah, so I worked at the big four, a big four firm by the name of Price Waterhouse Coopers. So I was there for about seven years and made it to the level of manager before I decided to kind of move on and do other things. Yeah, so Brian's registered CPA. He's all legit. On the site somewhere, Brian, they can look you up if they need to find your licenses and all that. Yeah, they can validate all that information. Yep, so we can look, all the information is public now. We have a site that you can look everything up. So that's the one thing. We need a CPA. So I mean, I'm scared to death of taxes, guys, seriously. Between me and you, I'm like, dude, I really don't know. I have my tax guy. But my tax guy does not. He's a CPA too. He's good at everything else. But there are no tax guys that know trading. That is, that was what I was missing. I'm missing, so this is how I used to do taxes, guys. I used to do these taxes myself and then send it to my CPA. And then I taught my CPA how to handle deduction, how to handle locate fees.  He did not know what a short was. He's trying to get me to do a wash bill. And I'm like, dude, brother, I made 100,000 trades this year.  I'm like, no, dude, that was just the total number of sales I have. That doesn't mean I have a billion dollars in my account. So these CPAs are looking at me like, wow, dude, you made a hundred million dollars this year? I'm like, no, dude, I scalp. I'm going in and out. So I am spending every year educating my own tax guy how to do it. And so that was the frustration. So there is, in my opinion, I don't know any traders, our CPAs. And so when I ran into Brian, I'm like, dude, we have to do something to help everybody because we're getting screwed here on taxes. I'm hearing guys paying, wash, sell, rules. And I'm like, dude, man, you're losing money. You still have to pay taxes. That's global. So let me switch over to Brian, and he has a bunch of slides that you can walk me through everything. So Brian, the floor is yours now. All right, I'm going to request control real quick. All right, so I'm excited to officially partner with my investing club. I remember when we first met, we had just a nonchalant dinner. Like Bao said, we talked about some of the things that I do, taxes, things like that, and really trying to figure out a tailored solution that would benefit all traders was the hard part because like Bao said, a lot of guys charge based on form, based on number of trades, based on a lot of other things. So I had to think long and hard about how we can tailor this as like a one size all fit solution. And so we came up with some numbers. Me and Alex, a hat tip to Alex, the guy is very young, but he's sharp. And when he puts his mind to something, he's killing it. So big shout out to Alex because, you know, Bao gave us the vision and then we just went ahead and ran with it. So the MIC tax plan, I'm going to give you five reasons why you need this. All right, so the first reason is, you're going to save a ton of money. So what I'm finding across a lot of our clients is that, you know, no offense to the local tax firms, but a lot of guys don't understand trading. For example, if you tell somebody, hey, I shorted a stock, they probably don't even know what that means. And so there's a lot of costs incurred for traders that just to perform their day to day job. So a few of the trading expenses that you may run into, I'm going to talk about the top ones, but I'm going to frame this though. If you don't qualify as a trader in securities, then you are in investor territory. So this is under the presumption that you qualify as a trader in securities. And so if you don't know, you can reach out to our firm and we'll do a consultation and we'll assess your trading activity to see if you do qualify as a trader. So let's just say, for example, you are part of my investing club and you decided, hey, you know what? I'm going to sign up for an annual membership. Well, for tax purposes, that is a section 162 business expense, which is fully tax deductible. So a lot of guys don't even know that if you're a part of an educational service and you qualify as a trader in business, you can deduct that. So Brian, let me stop you there. This is just a true story. I had no clue that all this chat stuff that I subscribed to are tax deductible, I swear. So I've been actually, so this is the first time I actually heard about it because I thought chat room was a chat room, but I guess it counts as education. So I've been spending thousands of dollars because what I do is I subscribe to a bunch of other ones before information, right? So I mean, I'm in other services too. And I'm like, holy cow, dude. So you're telling me I can deduct MIC, I can deduct the other services? Exactly. All of that stuff is 100% tax-inductible.  I want the MIC tax plan as well. Well, I'm a CPA, our firm, our trained tax preparers, and we'll make sure that any consultation fees, any tax preparation fees, anything that you contract with us, we'll make sure that's 100% tax deductible. Let's just say, hey, there's a meetup in Dallas, right? So a lot of guys are flying to Dallas, they're getting hotels, they're doing all this stuff. Well, all that stuff, trader meetups, conferences, all that stuff can be ran through your trading business as an expense. And there are other things also, a lot of traders like a lot of bells and whistles, they're using a lot of these scanning softwares, they're using option flow algos, a lot of other stuff. All that stuff needs to be documented as a business expense. So across our firm on average, we're typically seeing most traders are deducting between about, I'd say between four and 10 grand worth of business expense.  And if you multiply that times 252 days, but that's the number of trading days in the year, that can, it adds up in it. That's an opportunity cost that she would lose if you are preparing your taxes on your own or if you're going to a firm that doesn't specialize in this. So let me tell you a true story that I fought with every single year. So stock locate fees. I mean, my fees are like that, dude. They're like six figures, right? And so I go to my tax preparer, she's a CPA and stuff, but she doesn't do this. I'm literally, I'm not joking. I'm literally arguing with her that this is a fee. And then she's just looking it up online. She goes, that's interest.  And the problem is they won't sign off on it because they're too scared because they've never seen a six speaker fee like this.  It was horrible because it was last minute stuff. And so, and then stuff like computers, right? You can deduct computers. Yeah, so if you got these elaborate trading station, you got a billion monitors, you've got these high speed networks and computers, all that stuff can be tax deductible. And you can either use what we call bonus depreciation where you can expense 100% in the first year. And if it's over a certain threshold, then we carry that forward. So that's awesome. So guys that are paper trading, which are not trading at all, they can still deduct it, right? And they're working on the job that deducted against their salary. Is that how it works? Well, so if your paper trading and your trading activity doesn't qualify as a trader in securities, then there is gonna be tough to write off a lot of these upfront purchases.  I wanna incorporate, I wanna start a trading entity in the future. We can count this as incorporation costs and where we can deduct a portion of that in that first year. And then we would amortize the rest of that over 180 months. Cool, cool. Okay. All right, so number two, minimizing tax liability. So there's a natural trajectory that traders go through where, you know, they're just, they're learning, they're soaking up a lot of different strategies and things. And then it all clicks and they just, they crush the market. They have amazing years. And a harsh reality hits that, holy cow dude, I owe a ton in taxes that I didn't prepare for. So most of you that have W2 jobs are used to your employer withholding that on a monthly basis or on a paycheck basis. And so you don't necessarily have to be disciplined enough to save money to pay your taxes.  So my advice is why spend more money in taxes than you need to. So there's a lot of things that you can do to make sure that you maximize the tax code to your advantage, things like eliminating wash sales. So there's something called Section 475, Mark to Market Accounting. And what that does is it recharacterizes you from capital gains territory to ordinary income and ordinary loss territory, which I'll touch on that a little bit later. And then we also do, we have a couple of different pass-through strategies that we use through different types of trading entities that'll help unlock things like benefit plan contributions, health insurance. You got employees, you can pay them as contractors.  There's a lot of different strategies you can do to run a lot of costs through your trading entity. All right, so everyone talks about the good side of trading, but no one really touches on the bad side. So I come from the theology that you either, if you don't really lose either one or you learn something. And I think in the situation that, you know, you have, you experience losses, you need to make sure that you use these to the best of your advantage, right? So, especially this tax year, in 2018, the IRS is actually predicting that, no, there'll be a record number of capital loss deduction claims per se, mainly driven by the crypto market just because it was extremely volatile, but there are gonna be a lot of guys carrying capital losses. So if you work with the MIC tax plan, we'll make sure that one, your documentation is solid that you qualify as a trader in securities, and we'll also make sure that you elect a timely and correct Section 475 Mark to Market election. So one of the things about this election is you can botch this and you can really destroy your return. So there's different tax court cases where a trader tried to claim Section 475, but didn't actually do it correctly. So they tried to claim like an 800 grand ordinary loss or the IRS came in, audited their return and basically said, you know what? You can't actually deduct this. So your new loss is now 3,000 and you can carry 797,000 to the next year. So you gotta make sure you do this stuff right. So I'll give you a quick example. Let's just say trader A lost 30 grand in 2018 and he didn't elect a Mark to Market election. Trader A can only deduct $3,000 against other sources of income, such as a W-2 job. A lot of traders have businesses, things like that. You can deduct three grand against that. The 27,000 will carry forward to future years and you can write that off against profitable years. Now let's just say trader B lost 30 grand, the same 30 grand as trader A, but he had a timely and correct Mark to Market election. Well, he gets full business or ordinary loss treatment and that can be deducted in full against other sources of income. So one, you protect against gains and now you're protecting against losses. All right, reason number four, you have access to a CPA firm. So I've got the big firm experiences. I have employees that have the big firm experience for entity solution services. We have an off council legal attorney that makes sure that all of your incorporation documents, all of your operating agreements, anything that we need to do to get you set up in your trading business is off to a good start. So typically if you wanna talk to an expert who is well versed in trader taxation issues, it's gonna cost you between roughly 150 to $250 an hour, depending on their pedigree and their experience. And so with our MIT tax plan, you'll see after this presentation we'll have a private Slack workspace where you can kind of view how it's gonna be laid out. But you basically have access to our firm 24 hours a day, seven days a week.  Our process is completely virtual. You can reach out to us via the private Slack channel or shoot us an email. And we can talk about anything from individual taxes, your trader taxes, or if you have additional businesses or real estate investments, things like that.  So it's the same way, like Val mentioned earlier that I understand the markets. I trade a lot of options, I trade small cap. So I understand shop, I understand, I can talk about it all day. Trading is definitely a passion of mine. And that's why I go to all these meetups. That's why I continue to serve traders in a tax capacity while also maintaining my own business. Just over the years, we found that when we're onboarding new clients, we look at their prior year returns and there's so many different things that I feel like a lot of these CPAs and tax firms are not educated. And so we have to kind of play cleanup. So if we could set you up for success, starting day one going forward, you'll save yourself a lot of headache. Nobody wants to carry a capital loss for the next five years when they can recognize it immediately. So just like you need a trading strategy, also need a tax strategy. You need to protect against when you're eating well, when the gains are coming, but you also need to protect in the event that you don't have a good year. So focus on going with the firm that treats trading as their business. So to wrap things up, if you have further questions, feel free to shoot us an email at info at tradertaxcpa.com. You can also reach us at our website at tradertaxcpa.com. I'm very active on my direct messages. And so if you shoot me a message, I usually respond within 24 hours. And then if you're interested in signing up with an MIC tax plan, I believe Bao's gonna show you exactly how to do that. I'm gonna take over control. Yeah, well, one more second. Oh. And so the other thing too is, so I really understand the value that's being provided in these tax plans. And so we used aggressive pricing. And so I was going back and forth and I was like, I really don't like discounts. I really don't feel like that is something that is, it's just one of those things where I was struggling with them. The more I thought about it, I was like, you know what? Anybody who's serious about this and who wants to adopt it early, we're gonna give them 10% off if you sign up before February 1st. After that, I really don't know. And for the guys that are already registered in my investing club, we're actually gonna throw in a $25 voucher to use in the actual store so you can purchase some of my investing club swag. So we'll show it then. We actually have a T-shirt that has the tax thing with MIC. So that's pretty cool. So anybody that's in MIC, that signs up with this will get the 10% off, the early bird and the free T-shirt. So the reason why, you'll see, I wanna show you this slide of the tiers that we offer. The reason why Brian is hesitant upon giving any more discount is because he's already heavily discounting this package for us. So let me show you this. So this is how we get into it. So let me do this out here. So if you go to the myinvestingclub.com, there's a shop, chat room, there's tax planning. We did this quickly. This is gonna be revamped, but we kind of just did this quickly. We knew that taxes, and you begin the start of the year, you wanna get a jump on it, man. The worst thing is we need to the last minute to figure out your receipts and all this stuff. So the earlier you do the tax planning, the better. So here are the tiers that Brian offers. He walks you through this. When you have time, go here and check out the video. This is him. Go for Brian. Yeah, so tier one. So this is perfect for the guy who, let's just say, you know, you're like, you know what, I've always handled my taxes, and I might have a question here or there, but let me just balance it off somebody else. So instead of nickel and diamond you in consultations for every 30 minutes, you just pay one flat fee and you can ask us questions for the entire year, whether it's, it doesn't have to be limited to trading, but if you do have questions, this is perfect. And then we're also gonna, you know, be doing different educational content where we're going to be doing like an onboarding webinar for, you know, newer traders for guys who are like, you know what, what are my tax requirements? If I trade futures versus if I trade, you know, regular stock, is there any tax implication? Well, yeah, there is. If you trade futures, they have a blended rate, which is 60% long-term, 40% short-term. So if you decide to go to an advanced strategy of using an entity or something like that, you wanna make sure you're doing things correct. The other value that we're providing is that you have access to our firm 24 hours a day, seven days a week. We just ask that you give us ample lag time to answer your questions. So tier number two. Wait, wait, hold on. Let me talk about tier one. Tier one in my, you guys, tier one in my opinion is a no-brainer, man. I've consulted with CPAs. We charge me literally like $250 an hour. I have lawyers that charge me $500 an hour. This is, so Brian, you're saying, so basically we're trying to do for you guys, for taxes, what MIC does for day trading. So Brian is now sitting in the subscription service where if you sign up, this is like, basically if you use one hour of his consultation, dude, that's pretty much what they charge you per hour, but now you have it for an entire year, right? So how does this work, Brian? There's a new chat room or what? How are you guys doing this for the... Yeah, so if you already have the Slack channel, if you pull it up, you can probably see the different workspaces. And literally, if you're already a part of My Investing Club, it's easy because it's already included in a separate workspace. But if you're not a part of My Investing Club, you still get access to our private Slack workspace. So there it goes right there. So here's my, so here's the Slack. This is the My Investing Club. Here's the main. So you have different channels. We used to have a tax channel, but then we decided like, you know what, man, we're just creating, Brian, I wanted Brian, so this is that favor for me actually, dude, because I have a lot of tax questions and I'm pretty sure you have a lot of tax questions and you don't know who the heck to turn to. CPA is gonna charge you hundreds of dollars per hour and these CPAs don't know trading. That's the problem. Who do you ask about a trading specific question? You know how hard it was for me to finally do it? I've been trading for so long, I actually had to do it on my own and it's horrible, dude, it's horrible. Now I have finally found Brian and he's offering you for an entire year, you can go. So now we have a new Slack called MIC Tax Planning. So now it's basically like an MIC, but for taxing. So this is not just doing taxes for trading guys. If you have other businesses, if you have a job, he can help you with that. He can help you with all sorts of tax planning. He's a certified CPA, it's not just stocks, that's the beauty. He does every type of taxation, but he also knows he's an expert on stocks and that's the cool niche about it. So everybody has a job, can use them, everybody has a business, can use them. And that's pretty cheap, man.  I already got my money back. But anyways, okay, so that's the tier one and people that signed tier one, so he gained 10% off and then you sign up and then you, now you have access to him. He'll walk you through and how you do it, but basically now it's an MIC for check. So, I mean, this is gonna, don't wait because by the time the tax season comes, you're gonna be slammed, man. So this is why we started right now. Can I ask a question? Who's this? I'm sorry. I don't know, I can't speak, so can I ask a question? Oh yeah, Taha Zen, okay, how are you doing? I don't live in the States and I trade with trade zero and I'm thinking about joining MIC really soon, but I don't know, I've never been profitable before, so I don't know if there's any tax because at trade zero they say that I don't have to deal with the tax in the U.S. So do I take the profits purely without being anything? So when you signed up for, which broker did you say you were at? Trade zero. So you're gonna, are you a U.S. citizen? No, I've never been there. So you're not gonna have any U.S. tax reporting requirements but you are gonna need to check with your local jurisdiction. So if you're like in the U.K. or in Canada or something like that, yeah, please check with me. I'm actually then Danish, but I live in Lebanon and I don't think they'll ask for tax here. They don't check because we have privacy in the bank. Yeah, you can shoot me a PM after this and I'll double check, but we typically only focus on U.S. residents and so for international guys, typically your brokers will require you to, if it's a U.S. based broker, they'll require you to fill out some additional documentation and then they'll confirm if there's a tax treaty or not with that specific country. And if there is, it's typically you're paying tax on dividends and long-term holdings and things like that. Trade zero is an overseas international company. So I don't think it has a, but now the problem is, trade zero actually opened the USA one. So I don't know how that works, but trade zero was originally overseas international. So I don't think it touches USA. That's why they're open.  And then if the value of your account is over $10,000, you might have some F-bar and FinCEN reporting requirements just to disclose any foreign holdings.  And it's very, to me, you should get it. You should sign up for this because I mean overseas stuff is very dangerous, guys. I'm telling you right now, if you don't do it right, they think you're hiding money, man. So you have to be very careful and not get audited. So I would advise if anybody trading sure zero trade, any of those overseas stuff, man, sure trader, whatever, it's risky to tell them, what do you think, Brian? You know, it is. And I would just say that, from a tax reporting requirement, you need to make sure that if you do have foreign holdings that, and if it does exceed 10,000, you are gonna need to disclose that. You don't want the IRS to come after you. You wanna just make sure you're an open book. All right, so that's tier one, man. In my opinion, that's a no-brainer, guys. It will help you with, does that help you with the filings or anything? Or that's just basically an open resource to ask questions? Q and A, that's it. Ask unlimited questions. If you have filing questions, we can assist, but there is no preparation service in tier one. Okay. Go for tier two. So tier two, so everything in tier one, you're gonna get access to plus. So let's just say you trade through a pass through entity, like an S corporation or a general partnership. Maybe you form the partnership with your wife. So what we'll do is we'll actually prepare your entity return plus up to three K ones.  In addition, we'll also prepare your individual tax return and your schedule D plus all the other state return requirements. And so this only includes one class of security. So if you're a guy that trades, you know, stock options, well, not stocking options, but like futures, Forex and crypto, then we would have to, there'll be some additional billing for the different classes of securities. But if you're just one class of securities, your business return and your individual return is included in all of this.  So a lot of day traders don't realize that once you are profitable, that you do have a estimated tax reporting requirement and IRS requires you to pay that quarterly. Well, see the problem with traders though is that your income fluctuates month over month. So maybe we're in January, maybe you're up, you know, 10 grand, 20 grand and in February you lose it. So why would you want to pay, if I was a trader, I would say, why would I want to pay estimated taxes? If I don't even know, I'm going to make it green to the rest of the year. So what we do is we prepare your vouchers and then we typically recommend to start attempting to pay in Q3 and Q4 with Q4 being the balance of your year. So Q4 was actually due about a week ago. Cool. So that's, so basically that's the normal. And then the tier three would be the... So tier three, this is the, I call this the platinum package because we get, we take you through our entity solution service which we typically charge about 999 bucks. So that's the, our attorney will do all the incorporation documents, your operating agreement and they will handle all the tax planning pieces. So that's going to be, you know, your mark to market elections, your federal tax IDs. Also, if you are, let's just say, we're changing your classification from an LLC tax as a sole prop to maybe an LLC tax as an S corporation. We'll do all that stuff. In addition, you get unlimited consultations with us. So what that means is, it's not just limited to a private chat but you can actually get on our calendar. There will be no additional charge for each consultation. I have a lot of guys asking this, should I form an LLC of corporation? So what tier are those? So they would, so how would that start? So if they want to sign up for a tax plan that includes an LLC, they're going to want to start with tier three after they have an active LLC. Each year after that, you're going to just focus on tier two. So tier three, the additional benefit is unlimited tax planning in the entity solution. All right, so this is how I see it. So a lot of times they don't know they need an LLC. So they would need tax information. That's tier one. So they would start with tier one and then ask you if they need a tier LLC, right? Yep. And then I guess this is what we could do for them. I guess if they start with a tier one, they want to upgrade to tier three because now you recommend that they save money through an LLC. I guess that 219 will be credited to the tier three. Exactly. Okay, so that's awesome. See how that works guys? So you start with tier one, you figure out what you need. If you know you need three right away, you go three or two. So a lot of times like taxes are new thing for us, right?  Maybe it may not, it's very specific. So in my opinion, no brainer would be, yeah. I think everybody should be tier one at least, man. Knowing just to know that, I mean, what's 200 bucks versus an audit, right? And the thing is to know what you deduct. So if you start with tier one, I'm sure Brian will show you the deduction that covers all this. And remember, this is all tax deductible as well. And that's the icing on the cake. So the thing is, it's like, yeah, you might have to, you sign up for one of these tax plans, but don't forget all of this is tax deductible. For example, like for tier one, I mean, some of us may have lost more than that today. Like I know I spent about 150 bucks in locate fees today on InBot.  Yep, yep, I've already blown through that. What's that? I've already blown through that. And I've seriously, man, I wish you were around when we started, this is how I used to do it back then. I would Google day trading tax and it show up some weird guy and they have a program that they run you through your stuff and it's all wrong. So I'm glad that we finally do this, man, Brian. I mean, this is, I think I want to stress the Brian. He's an expert on this, just like I'm an expert kind of, not really expert, but on stock trading. So these questions that we get, like sometimes I get these really silly questions, which I think are silly, but they're not silly at all guys. Because if you don't know training, you don't know what a shortness, right? You don't know what a locate is. And that's the frustration that I get when I talk to a CPA.  So if you want to learn about stock option trading and all that, he's also your man. So you can also talk about trading, not just about the taxes. Cool. And so lastly, the last thing I'm going to add too is like, let's just say you're looking at this and you're like, you know what, I don't really know how I fit into this mold. We also offer all a cart services. And so what happens is, if you go to our website, TraderTaxCPA.com we'll have a list of all of our standard fees for different tax forms. So let's just say you're an individual, you're not even a trader yet, but you need your tax return prepared. We also offer that and we're also offering a discount for that. Great. So that's the last thing I want to talk about. Yeah. Cause right now these are all for tax specific, but a lot of guys just, you know, they want to learn to trade stocks and they have a job. So this is, you'll do their job preparation, you'll do maybe their side business preparation, things like that, right? All part of this. Yeah, exactly, exactly. Yep. All right. So let's do this. Take 15 minutes and then basically ask, listen, I'm going to take a panel and see who wants to ask a question. So raise your hand on this Zoom. I'm going to allow first Kevin's Vasquez to talk. Hey Kevin, can you hear me? Okay. Hey Kevin, you want to ask a question? Anybody wants to ask a question? Raise your hand. I will get you to talk. Okay. Next person is Sergio Ramirez. Sergio? Hello? Hey Sergio. Hey, what's up? Hey, can you show that discount code again? Cause I'm about to sign up right now. Great. Let me, let's figure this out here. Here we go. Uncle Sam. Okay, Uncle Sam. All right. Yeah, that was it. Thank you. Yeah, and somebody else asked me about the Olacart discount service. So if you go to our website and you can use the discount code MIC10. Okay. Any more questions Sergio? No. All right. Now let me see the next question would be from Kevin. Kevin, you around? All right, can you guys hear me just fine? Yep. All right, perfect. So I had a question. I'm a Parisian trader. Right now I'm trading under PDT. So like I have less than $2,000 in my account. My goal for this year for 2019 is to reach the 25,000. Hopefully fingers crossed, you know, and not be under the PDT. Where would I fall under that tax bracket? Do I consider my, is that considering myself a day trader if I'm still under PDT? Yeah, so one of the requirements that we look at for assessing a trader insecurities is, do they have a material account size? So there are other criteria that we'll look at such as frequency of trades. How many hours do you spend in the market? Do you have business expenses that are reasonable? So we'll look at the big picture, but typically one of the requirements is to make sure that your account is over the pattern day trader rule. Okay, okay. So that's going to be case by case? Brian, is that what you're saying? It is going to be case by case because there's guys who have small accounts, right? But like you said earlier, your gross proceeds were in the billions, right? So if your gross proceeds are in the, you know, most guys are in the $100 million range under 1099 Bs. And so we're going to have to, you know, really look at your activity maybe for the first quarter just to see if we think you can get there. Yep, so it's case by case guys.  So it's based upon, I guess, trading volume as well. Is that what you're saying? Yeah, yeah. Okay, great. I hope that's your question, Kevin. I'm going to take another question from Brad Taylor. Where were we at, Brad Taylor? Hi, Brad. We can do it. Hey guys, okay. Hey, Brian, so here's the thing. I'm a new full-time trader. I'm effective this year. And I've been to your website a couple of times because I need to set up a consultant time.  I was just curious, is that something I still can go on? Your website, sign up. And then does that get put towards my tier three because I'm definitely going to be a tier three candidate or is that something where I should use a Slack and just set it up separately with you? So if you sign up on our website and decide that you want to go into one of the tax plans, we'll definitely credit that to your account. No upsell, no nothing like that. Beautiful. I man, appreciate it. Looking forward to talking to you soon. You too, man, thanks. All right, next question is coming from, let me see. RB. Yeah, I just had a question about the carrying over losses from my previous years. You're saying what would you have to do to write that off? So you're a little bit low, but I think what you said is that you're carrying a capital loss and what do you need to do to write that off? Right, my account in previous years has just been carrying it over, but I heard you say that you can actually take that all at one time. So this is the thing. So if you are already carrying a capital loss, that's an unused tax benefit that can only be used if you have capital income. So basically meaning if you are carrying 300 grand of capital losses and you make 300,000 in 2019, your tax liability is actually gonna be zero because you soaked up that capital loss. But you can only soak that up with capital gains. So I always caution guys from jumping from capital loss territory to 475 territory because you wanna use that unused tax benefit because that's a benefit to you, right? Right. Awesome, thank you. Yeah, no problem. Awesome, next person is, anybody else has a question, raise. Leo. Hey, Vau. Can you hear me? Who's talking right now, I'm sorry? Leo? It's a Leo, yeah. Hey, buddy. Hey, Brian and Vau, how you doing, guys? There's pretty fast question. If I am under the PDT rule, as I guess, most of the traders, beginner traders, we paying our taxes towards our regular income, right? And we combine it. Let me, so your question was, for your trading income, do you combine that income against your other income? Yes, so basically, if we are not professional traders, we have less than 25K in account, how we do. I guess I was asking, is it ordinary income, or is this treated specially? No, so if you're treated as an investor for tax purposes, the way you report it is, every single trade needs to be documented on form 89.49 to include wash sales, and then your form 89.49 will then feed what's called a Schedule D. Your Schedule D then flows through your personal return.  So Leo, this sounds complicated, but that's what the perfect thing for the tier one is. Yeah, I got it, I got it. Thank you. I have something else too. I don't think this was mentioned before. How do you get that your trades from your broker into your forms? Because I used to do it manually, and it literally took me a month. That's a great question. So what we typically recommend is, if you are, if you're not, either if you're section 475 or not, we typically ask that you export a CSV file or a trade history file that really just documents your buying sales or your shorts and buys. And then what we do from there is, we have a guy that does the trader accounting. Well then, if you're in wash sale territory, we'll calculate your wash sales. If you're not in wash sale territory, then we'll draft the form 47.97.  So that's awesome. So you do it for me. I don't have to do it for a month anymore. Yep. Sorry, Brian, you have to do the work. But okay, so that's good guys because you get these forms and Brian will walk you through how to get it into the right format. Because I use to sit there and do it forever, man. So this is good. So Brian actually has a guy, and you have a software, do you have a software business or is it? Yeah, we do have a software that does it. And so a lot of times if there's a guy who like I think Bal mentioned earlier, they charge by form. And so that's actually how we do it outside of the MIC tax plan we charge by form. And so a lot of times it gets a little pricey. So we typically recommend using a software like a trade log or there's a couple of other ones where you can upload your trades there and then you just send us your Excel file. And then what we do is we review it and then we draft your returns from there. Awesome, awesome. All right, so next question coming from MD, MD Monique Islam. Hey Bal, Monique. Hey guy. Hey. Good, how are you? So my question is, so I'm in MIC and my question is more my account is, I have several accounts but both all of them are about PDD. And I also have full-time jobs. So where does that, where would I fall in this case? And if I have an loss from monthly, would that be like in the 49 or scheduled D or is it different way that I have to hold? So just to make sure I understand, you said you have a full-time job but you also have multiple brokerage accounts over PDT? Yeah. Yeah, so what happens is right now, I'm gonna go on a limb and say that you do qualify for trader status, but did you elect mark to market accounting? I did not last year. So if you didn't elect it for 2018, you're gonna be Form 89, 49, Schedule D. However, your business expenses can actually be reported on a Schedule C. But typically when guys have W-2 jobs or other businesses, I typically recommend that they trade within an entity just because it looks better to the IRS. If you're classifying yourself as a professional trader, then you need to have a professional business and that's in the form of an LLC or some other pass-through type entity. So in this case, this year, the loss won't be able to look like can be and subtracted from my regular job income, right? You'll be able to do $3,000. Yeah, yeah. And plus your trading business expenses. All right. Great. Hope that answered your question. Let me see. The next person is Timothy Wavante. Hey, Timothy, you're here. Timothy, well, oh, hey, Tim. Yeah, how are you doing, guys? Back in 2017 is when I started trading and I bought a new computer system. I signed up for a relatively expensive mentorship and I went to a couple of trading summits and I turned all my expense list in to my CPA in 2018. And she said I could not use any of it towards my taxes because I'm a single investor. And the only way I could is if I was investing for other people. So is she wrong in saying that? I'm from Minnesota. I don't know if it's a Minnesota thing or what, but is she wrong in telling you that? Did she assess your trader status qualification? Pardon? Did she assess your trader status qualification? So did you tell her like, hey, I'm a full-time day trader but I also have another source of income. Did she actually assess your ability to qualify? I am a full-time trader. I have no other form of income other than that. And I did tell her that. So I'm gonna go out on a limb. Yeah, I don't know all the facts and circumstances, but I'm gonna go out on a limb to say that you missed out on some business deductions. Serious one, yeah, because it was several thousand dollars. And I also have an LLC set up. I used to own a few rental properties. Is that something that I can continue to use as deductions for trading? Or do I have to somehow set it up differently? You need to make sure that you keep all of your businesses separate, especially if the nature of what they're doing are different. So if you have real estate portfolio, keep all of those or bunch them into, I don't know if you have your real estate inside of LLCs or if they're in your personal name, but keep that separate of your trading activity. I had it all in my LLC, but I've sold off all my properties now. So I have none, but I kept the LLC. I guess just in case I was gonna buy some more properties, but is that, because you had talked about starting an LLC, can I use the one that I have? And so there's no other business income or expense that's running through it than potentially, but yeah, let's take that one offline. Let me ask you a quick question, Brian. So let's say he bought a computer in 2017. Now he never deducted it. Can he somehow deduct it now? So what he's gonna have to do is we're gonna have to amend his 2017 tax return to include missed business expenses. Oh, so that's possible. Okay, that's good. How about as far as like materials? Like I bought a mentorship program that cost me like 6,500 bucks.  And then there was a monthly fee of like $179.89 that I paid for the 12 months period too. Can I still account for that when I am in my taxes from 2017? If anything, if any business expense was ordinary and necessary to conduct your trading business, it's 100% tax deductible. Okay. All right. Great. That's all I got. All right, thanks, Tim. Okay, next question, RB again? I don't know who's raising him. Is this RB? You hear me, RB? Yeah, I didn't click it. Oh, yeah, sorry about that. No problem, man. Yeah, look. Anybody else? Okay, okay.  Dennis, where's Dennis here? Dennis, allow. Okay. Dennis, Dennis Kedgotho. You hear me? Hello. Hey, Dennis. Hey, can you hear me? Yep. Okay, so now I'm older from Kenya. Yeah, what state do you live in? I live in Africa, Kenya. Oh, you're currently living in Africa, Kenya. Yeah. So does the Tux thing still apply to me? You're not a US resident, right? Yeah, I'm not a US resident. So if you have a US based broker, they'll give you some additional documentation to fill out. And what they'll do is they'll check to see if there's a tax treaty with your local jurisdiction. And if there is, then essentially they'll issue your tax filing at the end of the year and you would report it in your local jurisdiction. So there is no US income tax requirement for you. Oh, okay, okay, thank you. Great, thank you, Dennis. Anybody else have questions? Anybody else? I see Alex's hand up five times with her. Okay, I see, is your hand up Sergio? Let me see. Is your hand up Sergio? Yeah, hello, yeah, I had a question. I forgot to ask this earlier. So I have a W-2 job and I'm also trading, but I haven't made any money in trading. I'm actually unprofitable yet. Which kind of, you say I have to report every trade that I've made? Exactly. Oh, okay, yeah, because I'm using a Shirt Trader. And for that, I haven't seen anything like where you can download the trades. I had to do it manually. Does a Shirt Trader use like, I can't remember what software, was it like proper reports or something like that? Yeah, yeah, no, they use the regular, what's it called, DAF Trader. Okay. I think when you go into your account online, there is a trade history type report that you can run. It'll show you like your commissions, fees, all that stuff. If you export that, we could use that. But let me ask you this, is your Shirt Trader account over 10,000? No, no. And if it, was it at any point over 10,000? No. Okay. So potentially you may not have to, well you won't have to file FBAR or FinCEN, but you still have to report your trades. Okay, and which kind of form is that? I just have to. It can be form 89, 49. 89, 49. Yep. Okay, all right, thank you. No problem. All right, we're gonna take another five minutes and then Brian has to go. But any more questions guys, let me see. If you guys have a question, MD again, let me see. Okay, MD. Yes, so I didn't get an answer to the question, why do I fall in, like which tier is appropriate for me? I have W2 and I have two accounts that are about PDD. Can you repeat that? I'm sorry. Yeah, so I just wanted to, you know, if I have W2, so I have full-time job and I didn't have two or three accounts that are about PDD, so I paid as a day trader also, so which tier do I fall or just makes sense for me? So the one that makes the most sense for you would be tier two. You don't have a, do you have a day trading entity? I don't know, I don't. Okay, so then if you're a full-time trader with a part-time job, you're gonna need to get an entity or want to get to entity in the future, especially if you plan on, you know, going in that direction as a full-time trader. So I would actually recommend you do tier three this year and then next year you do tier two, so we will continue to do your tax preparation work. Yeah, but I have a full-time job but part-time trading right now. As long as your activity qualifies as a trader in securities, you should be good to go. And then I have a full-time trader, let's take a look at what is that, and if you want to do that. I think you start with tier two and then we'll see, but he's asking because he's a full-time, has a full-time job and he's a part-time trader, it was reversed. He's a- Sorry, say that one more time. He has a full-time job and he's a part-time trader with multiple accounts. Yeah, as long as he qualifies as a trader in securities, you know, we can, if you want us to just do your tax prep, tier two is for you. If you also are thinking about maybe opening up an entity to try out a couple of different tax strategies, then tier three is for you. Yep, so start with tier two and then Brian can recommend you without you even need an LLC. All right guys, a couple more questions. Anybody else? Okay, I got one, Chico General. Give me Chico. Here you go. Hello? Hey, Chico. Can you hear it? Hey, you can hear you, buddy. So it's my first time doing this taxes. I heard that I have to use the form 849 and I traded the whole 2018. Do I have to manually enter all of my trades or can I just print out all of my trades and flip it with this form or how is that? So if you look at the IRS guidance, day traders, so how many brokerage accounts do you have actually? This one, I just started trading in 2017. All right, so if you have one brokerage account, the only thing you need to do is you need to validate that they calculated your wash sales correctly. I didn't hear you say you elected mark to market. So you're gonna want to double check that they calculated your wash sales correctly because a lot of times brokers do mess that up. And then from there, each of your trades will be reported on 8,949. And then sometimes I think if you have one account, they may, they'll send you a 1099B, but I don't recall, depending on the broker, if they give you a summary of that. A summary, I don't have to check that out. Thank you very much. Yeah, if you wanna just shoot me an email, I'll take a quick look at it. All right, thanks guys. One last thing before Brian leaves. That's a good point, Brian. A lot of times, which is pretty much the time, every single time my 1099 is always wrong. Wait, who's talking? I'm sorry.  So I was just like waiting. Oh, who's this? I'm talking, I'm sorry. My name is Bofan. I just had a question, like one last question regarding tax. Okay, no problem, man. Yeah, so I trade part of my capital is in the C corporation.  So a lot of times, a lot of guys are attracted to C corp type entities because of the flat tax rate. The only problem is pulling the profits out of the C corp.  So like, let's just say your flat tax rate is 21%, but then you wanna distribute some of the profits to yourself. Well, now you're gonna also pay another 15% if it's classified as dividend. Is there anything wrong with using the C corp as like a personal holding corporation? No, it's actually great. A lot of guys use a C corp management company with a pass-through entity.  They pay themselves a management fee. They know that, you know, their fee is gonna be 100,000 each year. So they'll run the 100,000 through their C corp management company because that income is very much predictable. Yeah, that's what I was thinking. Thank you. Cause like starting this year, the C corp tax rate is only 21%, right? It's only 21% at the C corp level. So again, if you distribute any of that money to yourself or in the form of a W2, now you're paying double taxation. Well, not if you pay yourself a salary first, right? So you split the money between keeping it in the C corp and paying yourself like a minimal salary. Yeah, so the top flat tax rate is gonna be 21%. But if you pay yourself a base salary, you're also subject to federal income tax plus payroll tax, which ends up being, I think 15.3%. Okay, got it. And now you're right back to the top tax bracket for 2018, which is 37%. Yeah, cool. Thank you. All right, Brian. Thank you, man. Sorry, can't get everybody's questions, but if you have any questions, what should they do, Brian? First of all, they're the tiers. If they're an MIC, they can definitely shoot me a direct message or they can reach out to me on Twitter or at TraderTaxCPA or they can shoot us an email at info at TraderTaxCPA.com. Great, so yeah, Brian's a member of MIC. You can always ping him over at the MIC chat room. Otherwise, hey, thanks, man. We may hold another one next month, but here's all the information. You have any more questions. You can always hit me up as well. Bal or Alex or any of the guys at MIC, they should be able to reroute. Thanks, Brian, man. I appreciate you coming and helping everybody on this. Hey, no problem. Thanks for having me. All right, have a good weekend, guys. Thanks for attending. Thanks, guys. We'll see you online.