Youtube online news: News on Youtube Oct 28 2017

Welcome to My First View Kitchen Friends!

First we are going to boil a fish

Heat some water in a kadai

Add 4 to 5 Pieces of Fish. Make sure the fish should have less bones

We have not added any salt in the boiling fish

Fish should be cooked well but not over cooked

Allow it to cook for 3 to 4 Minutes

The fish is completely cooked now

Please look at the flesh. It is perfectly cooked

Let's change the fish to a plate

Now we are going remove the center bones of the fish

Now we are going remove the center bones & skin of the fish

Allow it to cool for sometime

Now remove the skin first

Check and remove if any small bones in the fish

We have selected boneless fish to reduce work

Remove the center bone now

Change the cleaned fish into a bowl

Mash the boiled & peeled potatoes in the bowl

Don't forget to wash your hands before start cooking

Add Finely Chopped Onion - 1

Add 2 Nos. of Finely Chopped Green chilies

Add 1 Teaspoon of Garam Masala

Add 1/2 Tablespoon of Kashmiri Chili Powder

Add 1 Teaspoon of Jeera Powder

Add little Mixed Herbs(Rosermary, Oregano & Thyme)

Add 1/4 Teaspoon of Turmeric Powder

Salt to Taste

Breadcrumbs - 1/4 Cup

Egg White -1No.

Mix it well

The dough texture should be like little lumps

The Dough Texture should be like this

Add 1 Hand full of Coriander Leaves

The dough is ready now

Roll the mixture in the size of a golf balls

Please wash your hands before doing this

Beat 1 Egg in a bowl

Apply some Oil in your palm

Apply it thoroughly

Press it a little

Coat it with fresh crumbs

All the cutlets are ready

Freeze the cutlets for 15 Minutes

It's ready after 15 Minutes

Ginger Garlic Paste & Lemon Juice can be added if required(Optional)

Heat some oil in a non stick pan

Put the cutlets in the hot oil and shallow fry it. It should be cooked in a slow flame

Cutlets will not take much time to get cooked since its pre-boiled

Let's take out the cutlets from the pan

Try it home. If you like this FISH CUTLET, Plz do Like, Share with your friends & family.

Please Subscribe Our Channel & Dont forget to Click the Bell Icon

Thank you so much friends!!!

For more infomation >> மொறு மொறு ஃபிஷ் கட்லெட் - Fish Cutlet in Tamil - Simple Fish Recipes - Duration: 10:56.

-------------------------------------------

Simple & Natural Makeup Tutorial step by step For Beginners - Duration: 2:49.

Subscribe my channel And watch more videos

For more infomation >> Simple & Natural Makeup Tutorial step by step For Beginners - Duration: 2:49.

-------------------------------------------

GBP JPY 30 TO 50 Pips per day Forex Simple Strategy That's Always work In Urdu & Hindi By Tani Forex - Duration: 12:38.

www.TaniForex.com

For more infomation >> GBP JPY 30 TO 50 Pips per day Forex Simple Strategy That's Always work In Urdu & Hindi By Tani Forex - Duration: 12:38.

-------------------------------------------

How To Make A Paper Box ? Origami Paper Box | Simple Origami Box Step by Step - Duration: 4:03.

How To Make A Paper Box ? Origami Paper Box | Simple Origami Box Step by Step

For more infomation >> How To Make A Paper Box ? Origami Paper Box | Simple Origami Box Step by Step - Duration: 4:03.

-------------------------------------------

new stylish Simple Arabic Mehndi Designs For Hands Step by Step by design4hobby - Duration: 9:23.

please subscribe to my channel & like my videos, if you like my designs

For more infomation >> new stylish Simple Arabic Mehndi Designs For Hands Step by Step by design4hobby - Duration: 9:23.

-------------------------------------------

First look at a simple PoC crash - Exploiting FFmpeg ft. Paul Cher - Duration: 12:47.

Paul Cher is a research who together with his colleague Emil found vulnerabilities in

ffmpeg.

He then wrote me an email asking if I would like to make a video with him.

And this lead to the very first LiveOverflow podcast episode which you should listen to,

to get a bit more context for this video.

So Paul will now walk us through some of his exploit process and I will add some comments

here and there to hopefully make it a bit easier to understand.

ok.

Hello everyone.

My name is Paul and today I will be presenting you guys research about FFmpeg security made

by me and my colleague Emil Lerner.

We have already presented it in our talk on PHDays conference which took place in Moscow

earlier this year, and you can watch it in recording, but we did not cover the binary

exploitation part too much, and now we are gonna focus only on binary exploitation and

go as much in-depth as possible.

But first, let's take a quick look what is FFmpeg and how it really works.

FFmpeg is powerful opensource software, to easily record, convert and stream out videos.

Thus, it is used by many platforms and services that provide file storage conversion and editing

functionality.

And this really means that FFmpeg is used almost everywhere starting from your favourite

messenger finishing up with some lovely meme storage.

When you upload a video as a gif or so on some image sharing plattform it's very likely

that the video is handled by ffmpeg.

It's really a very popular and big tool.

Of course such a system would be a good target because it has a very large attack surface.

There are some really cool researches already, for example research presented at blackhat

2016 by Maxim Andreev and Nikolay Ermishkin.

Or research by Gynvael Coldwind and Mateusz Jurczyk from google, who managed to fix thousands

of bugs in ffmpeg and many other researches.

Knowing this, me and my colleague Emil still tried to take this challenge and to find some

new bugs.

First let's take a quick look at the ffmpeg functionality.

Ffmpeg has really cool features and all of them are described in the documentation on

the official website.

Seems like there is a feature that allows you to collect files not only from the local

filesystem but also form the remote systems by using networking protocols.

So as you can see you can provide a link as an option to ffmpeg and it will go for the

remote file, and take it, and process it.

Let's download the sourcecode from the github and see how this process is implemented.

And now I'm going to clone the repo to my ubunut virtual machine.

And this may actually take a while.

So now we have downloaded the ffmpeg sourcecode.

To follow me in my next steps you need to be sure that you have downgraded your FFmpeg

to vulnerable version.

You can do it by resetting FFmpeg to correct version by using exact commit number or by

grepping from the commit log.

As I do right now.

So i'm using git reset hard to pull the head driectly to the exact commit number.

Heh.

Funny little advice.

Look through the git commit log with his name in it to find the latest version before it

was fixed.

Now let's take a quick look at the http protocol implementation.

I'm using vim to do this

So, as you can see, ffmpeg doesn't use libcurl or any other library, and it has a custom

implementation of the HTTP protocol and also many others.

So it is really a good [attack] surface to search for the vulnerabilities.

And this is a very important observation.

Libcurl has been audited and around for a long time.

It's a very very safe library and also used a lot.

But instead of relying on some other library ffmpeg implements it's on HTTP handling.

And sure you will think that HTTP is very simple, but there are weird protocol features

that can break your neck when you actually have to implement it in C.

So, for now I have two versions of ffmpeg compiled, the first one is compiled with addresssanitizer.

We talked about this one in our podcast.

And the second one is the original ffmpeg binary, but it has debug symbols and it is

compiled without code optimization options, so I can easily debug it.

You can do it as well by configuring project with the following options.

I just want to quickly explain the basic idea behind address sanitizer and why it's great

for debugging but also finding heap vulnerabilities.

For example one feature is that asan will automatically fill certain memorz areas with

a recognisable pattern.

And when then some code uses bad memory, for example in a heap overflow case, it will likely

crash because of those values and you can easily recognise that it crashed because it

read data from that memory.

And there are a few more ideas and tricks like that.

So it's very convinient.

So, let's quickly recap on how we actually did the fuzzing.

At some point, we thought that there might be a small chance that nobody has been fuzzing

the network protocols inside FFmpeg before us, and there might be some vulnerabilities.

And yeah, this is exactly the case.

I won't explain too much about the fuzzing process, because we used secret dark magic

related technique called ehm "launching AFL" and the process of fuzzing was already

described in the podcast.

So let's jump directly to the part where we already have a crash.

So, here I got my crashes, I have already simplified them a bit to be more readable

for you.

So Let's take a quick look at them first.

The first one is ascii text basically.

Let's open it with my favorite.

Vim.

Soo… this is HTTP protocol.

it has a lot of really interesting features like "Transfer-Encoding: chunked" for

example which was used here.

Basicly what it does is instead of setting the content-length header and length of data

and then whole bunch of data afterwards, it allows you to send the data to server in little

chunks.

First you send the size of the chunk in hex and the next line is the chunk itself finished

with the CRLF (\r\n).

And there -1 was used as size as you can see, maybe this was causing an issue.

So, let's move on.

So here I wrote a simple echo server.

Basically what it does is, it is binding on the port, listens for everyone.

And it's basically reading the argv filename.

It reads it and basically echoes to the output.

So nothing special.

Let's now launch both binaries with this output and see what happens . Let's launch

the original binary first.

Segmentation fault confirmed.

So he wrote a small server that just responds with this test case that causes a crash and

pointed ffmpeg to load the file from there.

And then it caused a segmentation fault.

But how do you figure out now where and why it happened?

That's why he compiled a second version of ffmpeg with address sanitiser instrumentation

included.

So for a more detailed report we are now launching the address sanitizer binary.

Ho ho.

Let's see.

So the heap buffer overflow in function http_buf_read.

This is nice.

You can see here the output of address sanitizer.

And it recognised a heap buffer overflow.

And it shows you here how the heap looked like and fa means heap redzone.

So that's a bad address.

And because it was also compiled with debug symbols you can easily see the trace of functions.

So let's launch FFmpeg using GDB and take a closer look at what happens and then we

will start auditing the source code.

As you can see the server is already launched.

Let's connect to it using ffmpeg in gdb.

So as you can see the crash is actually caused by memcpy, because it reached the end of the

mapped virtual memory region.

Let's look at the backtrace.

So in this functions it seems that the size equals to -1 integer…

So being able to pass in a negative chunk size is clearly a programming mistake that

apparently leads to an exploitable condition.

These two functions are very interesting, let's look at them.

Once again I will be using vim as my IDE with support of ctags, which will allow me to navigate

through the sourcecode quite quickly.

So keep up.

Just FYI: Ctags is a tool that will sift through your code, indexing methods, classes, variables,

and other identifiers, storing them.

And vim can then use it to quickly jump around the c source code.

So paul now investigates a bit around the line that caused the crash.

So this is the http_buf_read function.

And inside the memcpy the len is actually -1 over here.

So this is actually not exploitable.

But let's look at what caused the corruption of the size parameter.

This was already corrupted in the previous function which called it.

So.

Let's look at it.

This is http_read_stream function.

It's actually in the same file.

Let's scroll up to the top of the function.

Ok.

As you can see here is the piece of code which corresponds for reading the HTTP chunked data.

So there is the line reading.

And there is the strtoll function, which also accepts a negative numbers.

So the chunksize could have been negative.

So str to long long integer is a function that converts a string to an integer.

And integers can be negative and we know that the HTTP chunk size was set to -1.

So this function will return -1.

And a memcpy with -1 is nonsensical.

And later the minimum was taken of these two and of course the negative number was less

than any positive.

So that's probably how our size integer was corrupted, which caused the crash of FFmpeg.

And later there is the http_buf_read function which was called with the negative argument.

So as you can see this is actually not quite exploitable.

Let's jump back to it.

But still if we are able to make this fall through this branch, meaning that buf_end

will be equal to the buf_ptr we will be able to call ffurl_read function, which is different

from the memcpy.

Let's look inside it.

And this is basically calling the retry transfer buffer with the callback url_read.

So. here it is called.

And url_read is basically a function which accepts some parameters and it feeds those

parametrs to the read function and calls it.

And that's it.

Maybe that's it.

Maybe we can translate the -1 to the read function and this issue will be actually exploitable.

If we will be able to make buf_ptr be equal to buf_end we will fall through this check,

into the ffurl_read which will call the ffurl_read, which ... , which will call the transfer_func

callback, which will fill the arguments for the simple read function and call it to receive

the data.

Eh stop.

Oh boy, now I'm completely lost.

I didn't understand that last part.

But that's because we don't know enough yet about the heap and some other structures.

As you know, this video is getting a bit long and it's a lot to process already.

Let's continue this very technical part in the next video and see if we can understand

it then.

For more infomation >> First look at a simple PoC crash - Exploiting FFmpeg ft. Paul Cher - Duration: 12:47.

-------------------------------------------

Our Favorite Animals Songs For Kids | Super Simple Songs - Duration: 20:39.

Let's go to the zoo

And stomp like the elephants do

Let's go to the zoo

And stomp like the elephants do

Jump like kangaroos!

Let's go to the zoo

And jump like the kangaroos do

Let's go to the zoo

And jump like the kangaroos do

Swing like monkeys!

Let's go to the zoo

And swing like the monkeys do

Let's go to the zoo

And swing like the monkeys do

Waddle like penguins!

Let's go to the zoo

And waddle like the penguins do

Let's go to the zoo

And waddle like the penguins do

Slither like snakes

Let's go to the zoo

And slither like the snakes do

Let's go to the zoo

And slither like the snakes do

Swim like polar bears

Let's go to the zoo

And swim like the polar bears do

Let's go to the zoo

And swim like the polar bears do

Let's go to the zoo

And dance like the animals do

Let's go to the zoo

And dance like the animals do

For more infomation >> Our Favorite Animals Songs For Kids | Super Simple Songs - Duration: 20:39.

-------------------------------------------

Voici une astuce simple pour se débarrasser des douleurs du dos, de la hanche, des fesses - Duration: 6:45.

For more infomation >> Voici une astuce simple pour se débarrasser des douleurs du dos, de la hanche, des fesses - Duration: 6:45.

-------------------------------------------

Low Blood Sugar Levels Tricks: A simple trick to lower morning blood sugar - Duration: 6:28.

Low Blood Sugar Levels Tricks: A simple trick to lower morning blood sugar

If you're sort two diabetic, you will be speculative why your glucose is thus high

within the morning.

Every different time you take a look at, your levels appear to be inside range…

But those morning levels, generally they're sky high and it puts you in a very panic,

questioning what on earth you will be doing wrong.

Firstly, stop panicking — morning rises square measure a standard prevalence in diabetics.

However, it's necessary to grasp why it happens and what you'll be able to do concerning it…

The dawn phenomenon.

Logically you'd suppose that your glucose reading ought to be at it's lowest within

the morning.

After all, you've eaten up nothing and done nothing however sleep.

however no matter whether or not you eat, aldohexose production continues anyway…

The reason for this is often your body's cells want fuel for your heart to beat, your

brain to figure and your organs to stay functioning.

after you don't eat, or once you're asleep, the body will break down stores of obtainable

aldohexose (glycogenolysis) or enter a method known as gluconeogenesis — a method that

may use non-carbohydrate stores like amino acids to supply aldohexose.

Various hormones like endocrine, human growth hormone and corticosteroid, are concerned

in raising aldohexose levels.

To wake you up each morning, your body naturally activates these hormones from around three

am ahead, that explains why it's known as the dawn development.

In folks while not polygenic disorder, hypoglycemic agent would ordinarily counteract these hormones

to forestall excessive aldohexose production.

however since the hypoglycemic agent response and hypoglycemic agent sensitivity ar altered

in polygenic disorder, your body might not compensate effectively.

The Somogyi effect.

There is another development referred to as the "Somogyi effect" or "rebound hyperglycaemia."

this can be once your body's aldohexose levels decrease throughout the night (nocturnal

hypoglycemia), that activates your emergency system, causing messages to your hormones

and organs to stimulate aldohexose production.

This can lead to quite dramatic will increase to glucose levels and morning readings.

The Somogyi impact is a lot of common in those that area unit hypoglycemic agent dependent.

How to lower morning levels Gaining tight management over your daily glucose

levels by feeding a healthy diet, physical exercise often, stressing less and obtaining

smart quality sleep, can all facilitate management your morning readings.

But there's one easy trick that will facilitate even more… particularly with the dawn development.

In patients with non-insulin dependent kind two polygenic disorder, researchers managed

to scale back morning aldohexose levels by four to six %. which means if your morning

aldohexose is around one hundred thirty mg/dl, it'd decrease to concerning 122 mg/dl.

What did they do?

Before bed, they gave patients 2 tablespoons of apple acetum mixed with water, at the side

of one ounce of cheese, that is simply one slice of cheese.

Apple acetum contains ethanoic acid, that is what researchers believe causes most of

the impact.

alternative studies have shown that ethanoic acid reduces post meal aldohexose levels

and A1c, at the side of rising hypoglycemic agent sensitivity and therefore the hypoglycemic

agent response.

Give this easy hour trick a strive yourself.

It's straightforward to try and do and you ne'er know…

tomorrow you would possibly awaken with lower morning levels, too.

Editor's note: Dr. archangel monger has additionally printed a protracted list of

herbs and supplements that may facilitate treat hypoglycemic agent resistance and metabolic

syndrome.

however does one grasp the importance of reconciliation hypoglycemic agent to assist preserve your

brain perform and reduce your cancer risk? to find out the way to keep your body

disease-free by dominant your master endocrine,

Sources: 1.

White, et al.

Vinegar activity at time of day Moderates Waking aldohexose Concentrations in Adults

With Well-Controlled kind two polygenic disorder.

polygenic disorder Care.

2007;30(11):2814-2815.

Johnston, et al.

Preliminary proof that regular vinegar activity favourably influences hemoprotein A1c values

in people with kind two DM. polygenic disorder analysis and Clinical apply.

2009;84:e15-e17. 3.

Johnston, et al.

Vinegar Improves endocrine Sensitivity to a High-Carbohydrate Meal in Subjects With

endocrine Resistance or kind two polygenic disorder.

polygenic disorder Care.

2004;27(1).

Mettler, et al.

Additive postprandial blood glucose–attenuating and satiety-enhancing result of cinnamon and

carboxylic acid.

Nutrition analysis.

2009;29:723–727.

For more infomation >> Low Blood Sugar Levels Tricks: A simple trick to lower morning blood sugar - Duration: 6:28.

-------------------------------------------

Easy & Simple Heavy Work Saree Draping | How to Wear Heavy Work Saree Quick Step by Step Sari - Duration: 1:00.

For more infomation >> Easy & Simple Heavy Work Saree Draping | How to Wear Heavy Work Saree Quick Step by Step Sari - Duration: 1:00.

-------------------------------------------

How to give her a G-spot orgasm using this one simple sex tip - Duration: 2:16.

How to give her a G-spot orgasm using this one simple sex tip

When a woman is on top during sex in the Cowgirl position, she generally has a clitoral orgasm. This is because the popular sex move helps stimulate her clitoris.

While this is extremely pleasurable, giving her a G-spot orgasm might actually be more intense. A Reddit user has revealed a super simple trick that can help her have a G-spot orgasm while she's on top.

Dotdotdotbob described how a guy she recently slept with pressed his hand on her pelvic area (underneath the belly button) during sex.

In doing this, he put pressure on her G-spot, which is located about two inches inside the vagina on the front wall. She said: "It felt so good.

Cant believe it took me till my 30s to have someone do that to me.".

One male user replied: "I have tried this trick different times, and it seems to annoy more people than please, but for those in the latter group, it is indeed a game changer.

"I'm endowed but not massive, and I believe it must have something to do with how the respective genital shapes fit.".

If your penis is slightly curved upwards, then this trick would probably be more effective as it is more likely to naturally hit the G-spot.

The G-spot contains a large number of nerve endings which can produce a longer, stronger orgasm. Only 20% of women can have orgasm's from vaginal penetration alone, but this trick could help her reach the big-O.

For more infomation >> How to give her a G-spot orgasm using this one simple sex tip - Duration: 2:16.

-------------------------------------------

Carrot Halwa Recipes - Simple and Delicious Carrot Halwa - Gajar Halwa Recipe - Easy Indian Recipe - Duration: 5:35.

Carrot-3

Sugar

Ghee

Boiled Milk

Kaju

Caradamom

Badam

For more infomation >> Carrot Halwa Recipes - Simple and Delicious Carrot Halwa - Gajar Halwa Recipe - Easy Indian Recipe - Duration: 5:35.

-------------------------------------------

Vunnadi Okate Zindagi Simple Review Ram Pothineni Telugu Movie Rating - Duration: 1:08.

For more infomation >> Vunnadi Okate Zindagi Simple Review Ram Pothineni Telugu Movie Rating - Duration: 1:08.

-------------------------------------------

Tee-Time Episode 7 | Simple is the New Sexy - Duration: 2:20.

Tee-Time.

Hi and welcome

back to Tee-Time.

I'm April.

And I'm Wendy.

And we're coming to you live

from the Black Star

World Headquarters.

Today we're talking about

keeping it simple.

Simple is the new sexy. You just told me, April. Why is that?

Because I think in this day and age

of having more and more and more and consuming more and more

we're just getting to the point where it's just complete overload.

Stuff-itis.

I think it's a disease. And I think (laughs)

more and more people are being sucked into buying stuff because there's so

many clever marketers in the world.

And they prey on things that we think we need to have

which we don't.

You know that's so true. Spending is completely emotional.

It's driven by emotions and we also say to ourselves well I deserve it.

I worked so many hours and I'm so stressed so

therefore I'm going to go out and buy something

I can't afford and become even more stressed with it.

It becomes an anchor.

Debt becomes an anchor then holds you in places so you have to stay on the job

you don't like cause it pays so much

or you have to stay in a particular place

because you can't afford to go anywhere else and so I think of it as an anchor.

And so, how can we help people with this?

Well, have you ever heard of the One Number Solution?

Never.

Never?

It's this innovative financial planning system that we do here at Black Star

that helps people simplify their financial life down to one number.

They only have to focus on one thing and everything else works.

They're paying down their debt. They're saving for the future

and getting whatever they need for a safety net. What do you think about that?

Personally, I've been living the One Number since March

and it has changed all language around money in our household

so it really does make a difference.

And it has simplified your life, has it?

Yes.

That means your financial life is sexy.

Yes. Do you want to putt now?

Let's putt now.

Oh.

I'll see if this helps.

Nope. Didn't make a difference at all, Wendy.

You know what they say.

Progress not perfection.

Until next time. See you later.

Has anyone contacted you about us taking this show professional

because I'm surprised we haven't yet.

NBC. Syndicated.

Nice. Excellent.

For more infomation >> Tee-Time Episode 7 | Simple is the New Sexy - Duration: 2:20.

-------------------------------------------

3 simple life hacks and awesome ideas - Duration: 3:10.

3 simple life hacks

Youtube online news

Thứ Bảy, 28 tháng 10, 2017

News on Youtube Oct 28 2017

Không có nhận xét nào:

Đăng nhận xét