My name's Corey. I'm going to be talking about, the title of the talk for this was Insecure by Law,
but we're going to be talking about hacking heavy trucks and the dongles and whatnot that are associated with each.
I work as a senior security researcher at IOactive, and prior to this I did some auto dongle work
under a company called Digital Bond, doing the progressive dongle research.
Basically, for me, what gets me hot about cars is when we start connecting third-party aftermarket stuff
and expanding the tech surface and making it more interesting,
because cars by themselves are sort of insecure by design, in my opinion, and we're not really going to fix that.
We'll get into that in just a minute.
So, basic overview of what we're going to talk about.
What we're going to talk about is we're going to go through a real quick can primer.
We're going to talk about heavy trucking, because that's important to this particular research,
understanding the context of why this matters.
Because heavy trucking, even though a lot of the technologies are the same,
fundamentally and culturally and its impact on the world is a little bit different.
And then we'll go into the analysis of some of the logging devices that we got,
talk about this cool little event that happened about three weeks ago called the Cybertruck Challenge,
and then we'll go through.
And then we'll go through the summary of what came up.
So, back to sort of what I had jumped in earlier when it comes to car hacking.
If you haven't spent time sitting down in the village out there or looking at different stuff,
sending some CAN bus messages and that kind of thing, I encourage you to do so.
But when we talk about car hacking, in my opinion, it's a little bit interesting and kind of boring at the same time,
because when you're talking about CAN bus and then vehicle messages,
you're really talking about an 8-byte payload maximum and then an arbitration ID.
So, you've got an address and a payload, and there's no authentication.
There's no anything on there.
It's just a basic bus.
So, when you talk about car hacking and you're looking for controlling a vehicle with these types of messages,
with different auto manufacturers, they use different IDs to mean the same thing.
So, for a GM, for example, the ID that shows...
shows you what the RPM is on the bus, that transmits what the current RPM of the engine is,
might be different than another one.
And then it might be a different offset within that payload, too.
So, the address might be 310, and then the RPMs might be the last two bytes.
The first two bytes are some kind of flag setup, for an example.
And when it comes to car hacking, these are the kinds of messages that people are usually talking about
when you're doing reverse engineering of vehicles.
So, when Charlie and Chris were doing stuff,
when other people have gone through and published car hacking things,
mostly the hard problem when it comes to car hacking is figuring out what messages do what.
But, when I look at it, I mean, that's very interesting, and that is a hard problem,
but it's kind of boring because you're not going to ever fix this.
And it's insecure by design, is the term that I'm borrowing from industrial control systems,
which is where I came from before getting into auto.
And the realization that this is a broken protocol,
and we're not going to be able to put, really, security on top of it.
So, when it comes to that, I get interested when we add on a different attack surface.
So, when we're putting a dongle in between this insecure bus and the Internet,
that's when I'm really like, okay, well, we should take this seriously,
because, yes, this is insecure by itself, but it's not until you start connecting it.
Same thing with power plants, which is where I was before.
When we started connecting those, and people want to control
and monitor their plants from their living room on a Saturday,
nobody wants to drive 40 miles out to a substation in the middle of nowhere
to do something when you can use remote connectivity to do it.
So, the advantages are there.
Same thing with auto.
We want to get as much telematics off of an engine as we can,
so we can do things like predictive failure analysis, like really cool shit.
But that also means that we're taking these broken, fundamentally broken things
and then connecting them to the Internet.
And so that's where the attack surface increases,
where it gets pretty interesting, just from my perspective.
So, we're going to depart all that.
Basically, what I said was more on the passenger vehicle side,
and now we're going to talk about trucks,
because trucks, they do use CAN bus underneath them,
but it works quite a bit differently.
So, the United States, for one thing, because that's what I have statistics on,
heavily, heavily depends on the trucking industry.
The idiom in the trucking industry is, if you bought it, a truck brought it.
And if the trucking industry goes down, there are three days,
one day before you can no longer get fuel at gas stations,
three days before you can no longer get food and items off of your grocery store,
department store, Walmart, shelves.
So, this is critical infrastructure to the United States of America.
The trucking industry is significantly important when it comes to just keeping our lives operating.
There are, the other thing to note about the trucking industry,
is there are regulations that prevent drivers from overexerting themselves, driving too long,
and all that is recorded in log books.
So, a driver has to record how long they were driving, when they took a lunch, that kind of a thing.
And so, you're limited to make sure that everybody's safe, right?
There's a good reason that we have those regulations in place.
But the problem is that checking log books is fairly tedious, and people can lie.
And we don't want those truckers lying to us in our log books.
We want to make sure that they're obeying all the rules,
because naturally you're incentivized to move as much product as possible,
maximize your profits, that kind of thing.
Or sometimes you just want to get home earlier than before.
And so, when people are going around our regulation, the natural solution is to add more regulation.
It's like brute force, right?
If brute force isn't working, you're not using enough.
If regulation isn't working, we're just going to add more.
And that's how we're going to solve this problem.
So, that's what they did.
And there are other reasons for it.
Not just solving the log book fraud or misused problem.
But the government mandated these electronic logging devices.
So, there was a law passed that said, by December 2017, all trucks have to have this electronic logging device.
And that's what we're going to use to monitor and make sure that everybody's obeying the regulations
and get some extra gravy on top in terms of what kind of analytics we can do on that data.
And it is 444 pages long.
Which is awesome.
And that's the kind of thing that somebody who's going to manufacture these dongles or use the dongles or what not,
they have to go through, sort through that, and make sure that they're compliant.
So, in looking through the 444 pages, I'm just going to highlight a couple awesome gems for you.
So, I went to the table of contents and I'm like, quality assurance, alright, that's probably where security lives.
And it's right here, the entirety of it.
It says, insert quality assurance.
Section here.
And this is the finalized out, these are the guidelines in those 444 pages.
So, the quality assurance section is non-existent.
And that's where, I mean, that's, security is sort of glorified QA, really.
Making sure that the system does what it's supposed to do and that it doesn't do anything else.
That's what security is all about.
So, to have these sections empty is a little concerning.
But there is some good.
So, this section is in the 444 pages.
If anybody's ever worked in the government or known anybody, putting these documents together can be a process.
But this particular section, I think someone was in charge of writing this particular section and they maybe knew a thing or two.
But under, so this section is under certain circumstances, like if there's an officer at the vehicle and there's Wi-Fi on, but there's not cellular and not Bluetooth.
And it's the, Mars is in the fourth quadrant of the universe.
Then you apply this section and this is the only mention of TLS or an SSL, any kind of secure communications.
So, in this, like this one section, then we're talking about it.
So, but it's in the document, so it's there somewhere.
But then, when it comes to actually figuring out how, whether a device implements this is trouble.
So, let's say you're a developer.
You're a dongle manufacturer and you want to get in on this sweet cheddar that's coming out.
The government's mandating something, so there's going to be guaranteed money there.
So, let's go ahead and even though we're, we make macaroni and cheese for our business, I think we can probably get in on this.
Get some of that awesome, awesome money coming out.
So, you say, 444 pages.
Man, how are we going to make a dongle that meets all the requirements in there?
But it's okay.
You don't have to worry because the only requirement is that you have self-certification.
So, if you say, well, I don't know.
If you self-certify that you meet all the requirements, then you're good.
Then everything's great.
You're awesome.
You're going to start making some money.
You're going to get on the list of all the approved dongles and be good to go.
And the list is maintained by the FMCSA.
It is, they don't make any, obviously the government doesn't make any charge that you actually meet the requirements.
This is the reason for self-certification.
If you've ever been in that government, then you totally understand.
Why they did that?
Because that takes the liability off of you and puts it on the people who make the dongle.
But there are over 70 at the time of this screenshot.
I'm sure it's increased probably lately.
But there's a lot of them.
And so, you can just go and get any of these and that will do your electronic logging for you.
What they end up, what they tend to look like is something like this.
So, this one is available at Walmart.
So, as a sort of consequence to this mandate, you've got guaranteed money there.
So, you've got a bunch of people entering the market with stuff.
And as consequence then, the barrier goes real low in terms of how commoditized the hardware is.
How commoditized the solution is.
And this particular one is available at Walmart.
There are also some that are in, if you go to a truck stop, you can probably walk the shelves in the trucking area.
And you'll find ELDs prepackaged on the shelf.
Ready to pull up.
And then you just plug it in.
And then now you're compliant.
So, it's heavily, heavily commoditized.
There's a lot of players in the space.
And the only requirement is that they're self-certified.
But as we go forward, it is actually still under contention.
There are people who have some altruistic reasons.
But this bill was just put into, I had to just add this slide because it was just added two weeks ago, I think.
A representative from Texas put this bill forward.
To try and kick back the adoption another two years.
So they want to extend it.
They cited cyber security vulnerabilities or cyber security concerns as one of the reasons.
So that's significant.
At least we're being used as a scapegoat.
Even if it's not actually true.
But hey, either way, somebody's going to care about cyber security, hopefully, as we go forward.
Or maybe nothing will change and then it's just going to be two years before they're required to adopt it.
I don't know.
Depending on how cynical you are.
You may fall on one side or another.
But the other reason is there's logistical concerns.
Because there are some, like livestock, get exemptions to the driving rules and that kind of a thing.
So they're trying to make sure that their business is protected by this ELD thing.
And I suspect it's actually less about the cyber security.
So after we saw all this and we get excited.
Like alright, there's a bunch of them.
Let's go shopping.
So we did.
And we picked up.
So as a caveat, this research.
If you are a POC or GTFO person.
Then you can probably GTFO.
Because I'm not dropping a full payload weaponized ODAY or anything right now.
The whole point of this research was a breadth first.
Not depth first.
To try and figure out how to hack a particular dongle and come up with an exploit.
With a Metasploit module.
That's not what the point was.
The point was to get a few of these things.
And see what the general security set up was with these commoditized dongles.
Because especially when there's 70 of them.
I didn't want to get in the position where we got one of them and that happened to be the bad one.
But the rest of them were good.
So we did a breadth first search of the dongles to figure out what's going on.
So we got ELDs from three different manufacturers.
Again these are consumer off the shelf.
You just go pick them up or you order them directly from them.
The suppliers were chosen at random.
So.
But again being a breadth first.
This was more to get a sense of the industry.
And so I'm not trying to pick on any given supplier.
In any of this.
So please as another caveat.
Do not take this to say.
If I have a suppliers name or I'm holding one right here.
That does not mean that these guys are the only bad guys.
But I will give you a particular tip about this one.
Because it's cool.
So going forward.
We got them.
We ordered them.
And we started off great.
So we got some emails to sign up.
Because almost all of these have companion apps or back end stuff.
And so.
It's like here you know address.
And they put the password in a get parameter.
Like that's a small vulnerability.
It's not really a big deal.
People do it all the time.
But that was the first experience with any of these.
So it was sort of like alright.
The bar for the average.
In terms of what I've grown to expect out of hardware stuff.
Is pretty low.
And so far it looks like we're par for the course.
We're starting out.
So we got them.
And then we began to do some hardware analysis.
So that's this one taken apart.
And it's actually just a very simple one board.
With a daughter cellular board.
But it comes down to an ARM processor.
Some spy flash.
And a CAN transceiver.
And that's it.
Basically.
We're talking very simple.
Very minimal.
How cheap can we make this thing.
How fast can we get it out to market.
And then it has a cellular daughter board.
As well.
And you can see if anybody does any hardware hacking.
There's some interesting pads there.
That were fun to play with.
The connector.
Which is not exposed.
You'll see that connector over at the top.
Not exposed here.
But if you take the top of this thing off.
Which is kind of what I was hoping somebody had a pin for.
But that's alright.
And then this is another example of one similar type thing.
You've got your processor.
You've got your spy flash.
And then a bunch of power regulation.
And that kind of a thing.
And usually with some kind of communications chip on top.
That they speak with over.
Over serial line.
In order to do the communications.
And then another one.
Looks like this.
This one is interesting because this one has a screen.
So it's a little bit more complicated.
So there's some other cool stuff.
Playing with it.
This one's also interesting because this one.
Doesn't plug into the truck.
So.
Spoiler alert.
This one's the most secure.
In terms of whether you're affecting the truck or not.
But unfortunately.
You can't legally use this one.
Because legally.
As the document says.
It's required to plug into the truck.
To get information out of the truck.
So.
Unfortunately.
But they're self certified.
So maybe it's fine.
And this is similar.
But underneath.
There's a lot more components in here.
Because we've got a screen and a printer on it.
Which was cool.
So this one.
If you want the full log book out.
Then you go and it prints it.
And then you can hand that to your regulation officer.
This is another one.
Another screen.
The same one.
Ribbon cable that goes out.
And that kind of thing.
And the SIM there for cellular back end communications.
But again.
Plug in.
And then you feed the cable to the unit.
So after doing some hardware analysis.
Pulling flash.
Grabbing.
Seeing if we could get the debug going.
That kind of thing.
Then you jump into the software.
And of course the first thing that you do.
Is the best hacker tool ever.
Strings.
Is the first step that I always do.
Whenever I'm going to look at new firmware or anything.
Because interesting things pop out of there.
So like here we've got.
But you've got full path.
To somebody's directory structure.
For how they were building out the project.
His name is Jenkins.
Which is an awesome name.
So I imagine like they're sitting around.
And the team is like.
God Jenkins.
We need to get this pushed out right away.
And so.
Okay.
Oh okay.
Alright.
Damn it.
You ruined my awesome story.
I was unfamiliar with that.
I was unfamiliar with that.
You foiled it.
Sorry.
Can I choose to disbelieve the truth.
And imagine that.
I'm just kidding.
No I appreciate that.
I didn't know that actually.
Oh okay.
Okay.
Cool.
So this might be some of that same.
No this one was from a different unit.
So this is not the one that was built out of Jenkins.
But what it comes down to is you're seeing.
Like again this was a breadth research.
So it was mostly like.
How are they using like stir copy.
Insecure band functions that we shouldn't be using anymore.
Let's use memory safe versions instead.
That kind of a thing.
So basic software analysis.
Again we weren't trying to get POC.
Or anything like that on there.
So.
You don't have to just take my word for it.
Either.
When it comes to what the security.
Opinion of these devices are.
So like I mentioned.
About three.
Maybe it was four weeks ago now.
Since we've been in Vegas for a week.
They had a cyber security challenge.
Out in Detroit.
Where the Army TARDEC.
Sponsored.
This event.
Where they brought out students from 12 different universities.
12 is the correct number I believe.
Universities and community colleges.
So there was two days of class.
And then two days of hands on.
So we had a couple trucks that were there.
The students actually got to plug in.
And so it was kind of like the car hacking village.
Except in a more controlled environment.
And with a little bit of hands on.
Class learning.
And that kind of a thing as well.
And none of these.
Well I won't say none.
But most of the students had never done any hardware hacking.
Had never had any exposure or anything like that.
To any of this stuff.
And so they got to come in and play with things.
They had a bunch of.
They had like multimeters.
Soldering irons.
Chip readers.
That kind of thing there.
Available for them to use.
And it was a really cool event.
But if you know anything about the trucking industry.
It's an interesting culture.
And they didn't want to talk about this event.
In the public very much.
Which I think is unfortunate.
Because it's really cool.
And they're sort of going forward in terms of cyber security.
Thinking about it.
Trying to encourage people to look at stuff.
And see if it was authorized or not.
But there was this article in the Detroit Free Press about it.
And it was a really cool event.
But the.
So the students tore apart this particular one.
That I'm talking about here.
Extracted the.
So this is in one day actually.
So for only one day.
That they spent down looking at it.
And I'll give a shout out to Grim.
Mitch from Grim was one of the instructors.
Who sort of walked them through.
And encouraged them as they were learning about this.
So shout out to them.
This is what they did.
They extracted the firmware over single wire debug.
Because the debug interface is wide open on this.
As it ships out from the factory.
There's lack of encryption.
In any of the firmware or communications.
They were able to do basic dynamic analysis.
Using GDB.
But ultimately the student opinion.
Of the device security.
Is low to nonexistent.
Unfortunately.
But so the reason that I said.
I was going to tell you something cool about this.
I think this sort of ties into here.
Because this is between.
I think it's around 150 bucks for this thing.
But there are other like tool kits.
To help you do.
To get into truck hacking.
Or interfaces to communicate on the bus of the truck.
And some of those go for thousands of dollars.
But if you just buy one of these.
Then you've got bluetooth access.
To the truck bus.
For pretty cheap.
Really.
When I'm working on it.
I prefer a beagle bone with a canvas cape.
And controlling stuff that way.
But this is really a great alternative.
Because it's open.
You can flash your own firmware to it.
It's really straightforward to get your own thing on there.
So if you buy one of these.
It can become your truck hacking interface.
Instead of buying some expensive thing otherwise.
Or if you don't want to mess with wires.
And getting connectors and stuff like that.
If you're doing a beagle bone.
Then this is a great compact package.
For all of that.
So I'm not sure that I would recommend it.
As an ELD.
Conclusions.
Security overview.
Again.
The bar is fairly low.
And everything was basically par for the course.
Devices were shipping with debug enabled.
The firmware was easily accessible.
You can just grab it straight off the chip.
There's lots of use of banned functions.
Within the firmware.
General insecure coding practices.
That kind of a thing.
Which is unfortunately expected at this point.
And I think anybody in hardware hacking.
Or IOT.
Or anybody who does any embedded security.
Sort of.
That's a pretty common thing.
But it's a little bit unfortunate.
When we talk about.
Because there are.
Well I'll talk about it.
But there are companies who.
Were sort of in this business.
Before the ELD mandate came out.
And then like everybody entered the thing.
And then they kind of get lost in the noise.
Even though they're making significant effort.
And spending money on cyber security.
We'll talk about that.
When we get to impact at the end.
But what is the potential impact.
If we've got a vulnerable device here.
We know that it uses insecure coding practices.
And if we can access this.
From the internet.
Or from Bluetooth.
Whether you consider Bluetooth remote attack.
Or physical attack.
Given the short range is up to you.
I think some people are on either side of that.
But if you've got a remotely exploitable device.
And you're plugging it directly into the truck.
That does matter.
And for.
The trucking companies.
Are doing.
Work to try and isolate this threat.
Because one of the things.
That you can do on the buses is.
Oh.
I meant to mention this at the beginning.
But if you've ever done any OEM car hacking.
You know how the IDs are different.
With a GM versus a Ford versus whatever.
In trucking it's all standardized.
So you don't have to do.
Any of the reverse engineering.
There's very little of the reverse engineering.
To figure out what ID does what.
So there's a straight up document that will tell you.
If you want to request torque.
This is the message that you send.
So that makes it easier when.
When crafting payloads.
To potentially exploit it.
And so when you're talking about the.
If you're a heavy truck manufacturer.
You want to probably isolate that if possible.
Not allow a device that's plugged into the diagnostics port.
To be able to send that message.
But the problem is.
That there are.
Things that plug in.
That legitimately need to send that message.
That are interesting.
And this isn't just the trucking industry.
When you talk about emergency response vehicles.
I used to work as a volunteer firefighter.
And we would be.
In the city department with the engines.
And you're going to be sending those.
Request torque messages when you need to use your pump.
And spray your hose.
To fight a fire.
You've got to torque up the engine.
So it's some of that same kind of thing.
As we're getting into more sophisticated trucks.
And we're getting more drive by wire.
Autonomous.
That kind of a thing.
It's going to be more significant.
And we need to make sure that we're isolating these out.
But heavy trucking is critical infrastructure.
So in my opinion.
It's a little bit more significant.
And you approach the problem slightly differently.
Than your average passenger vehicle.
Even though passenger vehicles are also super cool.
Because you're talking about.
Multi thousand pound robots.
That are under control of an attacker.
Which is significant.
Because when we start to get to the physical side.
Where cyber security meets physical.
And you do the cyber physical.
If anybody's got bingo cards.
I can just ramble through them right now.
And we'll make sure that you get your blackout things.
Or whatever.
Because you can win your prize.
But the cyber physical aspect to it.
Is significant and important.
And that's what makes this hacking a little bit different.
Than some of the others.
So.
The impact.
Is potentially significant.
As an example.
If there is a slow down.
In the mountain pass in Denver.
That gets felt by the carriers.
All the way back to the east coast.
So you've got delays all the way.
All the way back across half the United States.
Because of how tight.
Everything is.
And how significant that can be.
So.
Has anybody read the Damon by Daniel Suarez?
Oh.
Man nobody.
That's an awesome book.
You should read that book.
It was written probably like 10 years ago or so.
I think.
But one of the.
It's really great.
Because it starts talking about autonomous cars.
And if they're under control.
And they become part of a fleet.
Then it is a cyber physical.
Sort of where.
That can be controlled in the physical world.
Plus like he's.
Like any good cyber punk.
Like there's also autonomous motorcycles.
And then they put katanas on the motorcycles.
So they drive around.
It's totally awesome.
I recommend that book.
It's great.
There's also a sequel.
But yeah.
As mentioned.
A problem in Denver can affect it.
And then the other thing that I think is interesting.
Is ELDs are in my opinion.
Easier to spoof than a log book.
Maybe it's just because of my own morality.
I like people.
I feel like I'm generally a good guy.
And I don't want to lie to your face.
So if an officer says.
Hey how much did you drive?
I'm going to probably tell him the truth.
But I'll lie to a computer all day long.
Because computers are evil.
And Skynet is going to take us over.
And kill us all.
And Elon Musk and I agree on that point.
Not exactly.
But it's much easier to lie to a computer.
Than it is to a person.
And when you're talking about insurance fraud.
Or fraud related to this.
When I started getting into the progressive.
I was able to piggyback off of a lot of research.
Done by the community.
For the insurance fraud purposes.
They were saying.
We plugged our dongle in.
And oh we only drive to church on Sunday and back.
And we never go over 25 miles an hour.
And that was what they were doing with the insurance dongles.
And so they had identified.
How some of the components have worked.
And I think that same thing sort of applies to this.
If you're talking about trying to actually solve the problem.
With regulation.
I'm not sure that this does it.
Because non-repudiation is a hard problem.
It's a problem that we can solve.
But that's sort of related to security.
And this doesn't have any of that stuff.
So how do you actually solve that problem?
It's difficult.
So in summary.
The flash card I guess for the insecure by law talk.
Is that we've got electronic logging devices.
That replace driver log books.
Mandated by the United States government.
The devices are heavily commoditized.
And fail to follow.
Cyber security best practices in general.
And the impact to the U.S.
Critical infrastructure is real.
We have to care about this massive increase.
In attack surface.
With commoditized hardware.
And like I mentioned before.
It's sort of unfortunate.
Because there are companies who are spending effort.
To make this better.
Telematics companies.
Who have been maybe doing this for a while.
But they sort of get lost in the noise.
I mean there were 70 things.
And you can make pages of different devices.
And if you're just trying to find one.
That's what you're going to.
You're just going to grab the first one you see.
So I really don't ever do this in talks.
But I would like to do a brief exercise.
Where we're going to do a show of hands.
I apologize.
So when we're also thinking about the impact of this.
Where it's three days before.
Let's use Walmart as an example.
Where Walmart shelves are starting to get empty.
I'd like a show of hands.
One or another.
First if you think that Walmart.
Will be the one that the average consumer.
Blames for the problem.
Or even if in the news says.
Like we've got a heavy trucking cyber vulnerability.
We don't have our goods aren't shipping appropriately.
Whether it's just a DOS.
And they're not shipping.
Will the average consumer blame Walmart.
Or the trucking industry insecurity.
So for a show of hands.
On people who think that the average consumer.
Won't make that abstract leap.
From the thing that they see in the face.
And they're not going to.
To the trucking.
Who thinks that Walmart will be blamed.
Instead of the trucks.
Okay and who's on the.
People will blame the trucks instead.
Alright so it very clearly.
Very clearly.
The lot of you think that.
If we have a problem with the infrastructure.
The transportation infrastructure.
That is going to be the end unit.
That is the one who sort of.
Catches the blame for it.
They definitely won't blame this.
You are.
You are right.
I think I agree.
Does anybody think they'll blame this.
If this is what caused it.
Yeah.
They'll blame Russia.
They'll blame whoever they're told to blame.
Probably.
Is what will actually happen.
Which is sort of an unfortunate thing.
And we can rant about that for a long time.
But when it comes to this.
Yeah so that's an interesting.
Yeah that's interesting.
Is they're probably.
Pretty much definitely not going to blame this.
It's going to be the carriers OEMs.
Possibly or more likely.
The end thing that's in somebody's face.
Because the average person doesn't care.
They're going to do what they first see.
And get that problem solved.
And out of their face.
That's on whatever hits the evening news the most.
Yeah that's true.
That's true.
That's what most heavily influences.
If you get enough that says Walmart.
They're going to blame Walmart.
That goes into some kind of detail.
Where it ends up on like.
One of the longer news programs.
Like say 60 minutes or something.
That people watch to a fair extent.
Then they might be able to make that abstract leap.
Knowledgeable understanding.
Yeah I think that's an interesting discussion.
In terms of human psyche.
And how they approach problems.
And what not.
But I don't pretend to be a psychologist in any way.
I work with deterministic things like.
Computers.
Because they're easier.
So yeah.
Thanks for coming very much.
And I appreciate it.