WEBVTT 00:01.070 --> 00:02.170 Hey, everyone. 00:02.250 --> 00:04.870 Welcome to my talk, Pandemic in Plain Text. 00:04.870 --> 00:08.570 My name is Troy, aka waveguide on Twitter. 00:08.870 --> 00:11.590 I'm an RF engineer in the aerospace industry. 00:11.590 --> 00:17.090 I was formerly a security engineer in the access, control, and lock industry for a number of years. 00:17.190 --> 00:20.510 I also host the channel over at hackerwarehouse.tv. 00:20.570 --> 00:30.050 And I just wanted to give a special thanks to IoT Village and to DEF CON Safe Mode for hosting this talk, and to my friend Voxel for this really cool setup and background. 00:30.110 --> 00:33.050 So let's get started, Pandemic in Plain Text. 00:33.890 --> 00:34.650 All right. 00:34.650 --> 00:48.170 The purpose of this talk, and I want to be really clear, is to stop the use of insecure communications at hospitals by shining light on the use of insecure wireless communications that are accidentally leaking your health data and violating your privacy laws. 00:48.710 --> 00:50.530 I'm not here to bash hospitals. 00:50.530 --> 00:53.070 I'm not here to bash the medical industry. 00:53.070 --> 00:58.870 I just want to bring to light that there is this leak happening, and it's been happening for 20 years. 00:59.130 --> 01:06.390 And right now, in the middle of this pandemic, I think it's really important that we pay attention to this and that we fix this problem. 01:06.990 --> 01:11.490 And just to note that none of your health care providers are really doing this intentionally. 01:11.910 --> 01:16.710 This appears to be accidentally that they're leaking your information, and they just don't know it. 01:16.710 --> 01:23.590 And if you don't want to watch the rest of this talk, the TLDR is, hey, your COVID test results are being literally broadcast from mountains. 01:24.430 --> 01:33.970 Yeah, so the story behind this is, if you go back to November or December, a lot of us were looking at Twitter and watching this pandemic come across China. 01:34.190 --> 01:38.470 And we were really asking ourselves these questions, like, is this real? 01:38.470 --> 01:40.190 Is this going to come over here? 01:40.270 --> 01:50.790 Then it kind of came across the ocean, and we got to ask these questions about, you know, do we have enough beds, and PPE, and any cries for help, and are there shortages? 01:51.530 --> 01:56.710 And I just started having all these questions, and I really was looking for data on this stuff. 01:56.710 --> 02:04.510 And like most of the people, it's kind of hard to sift through all the incoming data that we get through the news. 02:04.510 --> 02:06.730 And I just really wanted the hard data. 02:06.750 --> 02:09.930 And, you know, I wanted to know, is it affecting my community? 02:10.010 --> 02:17.010 And if I could see the data, then I would be able to answer these questions. 02:17.010 --> 02:23.430 And I remembered that I think I knew an answer to these questions using RF and wireless. 02:23.430 --> 02:27.750 And that was through something called PogSag, which is pagers. 02:27.990 --> 02:32.970 I remember a couple of years ago, we did a talk on HackerWarehouseTV. 02:32.970 --> 02:40.030 Not really a talk, but we did a show about how to decode pager messages that are freely being broadcast in the air. 02:40.030 --> 02:45.230 And when we did that, we saw a lot of things that were medical-related. 02:45.230 --> 02:55.950 And I thought, well, maybe it's a good time to revisit that and see what we can find and see if any of these questions could be answered with data over the PogSag network. 02:58.540 --> 02:59.220 All right. 02:59.220 --> 03:01.840 Well, just a little legal disclaimer for this talk. 03:01.980 --> 03:05.420 I'm not a lawyer, but I think the following is true. 03:05.880 --> 03:07.980 Possessing a software-defined radio. 03:07.980 --> 03:09.540 Yeah, that's totally legal. 03:09.540 --> 03:13.000 Ham radio operators do that across the globe. 03:13.000 --> 03:17.300 Receiving 900 MHz signals on those SDRs. 03:17.300 --> 03:19.100 Yeah, of course that's legal. 03:19.100 --> 03:22.680 Listening to audio on those signals, just like voice or tones. 03:22.680 --> 03:24.300 Yep, nothing special there. 03:24.320 --> 03:26.580 Decoding the audio of those signals. 03:26.600 --> 03:28.020 Well, that depends. 03:28.020 --> 03:29.240 Are they encrypted? 03:29.280 --> 03:31.820 In this particular case for this talk, no. 03:31.820 --> 03:32.780 Not even a little bit. 03:32.780 --> 03:36.660 This is all plain text tones and we're just decoding them. 03:36.740 --> 03:38.260 That is legal. 03:38.260 --> 03:41.860 Decrypting secure messages or anything that's encrypted. 03:41.860 --> 03:43.780 That is not legal. 03:43.780 --> 03:46.900 And in this particular case, nothing was decrypted. 03:47.640 --> 03:50.980 Distributing or sharing patient information. 03:50.980 --> 03:53.500 Obviously, that is not legal. 03:53.500 --> 04:01.260 Don't distribute any personal information or any sensitive information that you may receive over these plain text broadcasts. 04:01.260 --> 04:10.740 But for the hospitals that are broadcasting the patient information from a mountaintop antenna, apparently that's perfectly legal. 04:10.740 --> 04:11.480 I don't know. 04:11.480 --> 04:13.020 Maybe that's just a HIPAA violation. 04:13.020 --> 04:14.840 Again, I'm not a lawyer. 04:14.840 --> 04:16.380 But let's continue. 04:17.380 --> 04:19.240 Alright, is this a new vulnerability? 04:19.240 --> 04:21.340 The answer, unfortunately, is no. 04:21.340 --> 04:23.560 I'm not, unfortunately, dropping zero days here. 04:23.560 --> 04:25.900 This has been around for quite some time. 04:26.040 --> 04:28.960 I think it was DEFCON 5 this was brought up. 04:28.980 --> 04:43.060 Back in 2016, there was also the Holy Pager artwork, I believe it was in Chicago, where it would intercept all POGSAG pager messages and it would form them randomly to one of three pagers on display. 04:43.200 --> 04:51.280 And then it would print out a continuous roll of receipt paper, making a big pile of personal information that they automatically redacted. 04:51.280 --> 04:53.040 So that was pretty cool. 04:53.200 --> 04:56.320 Then back in 2018, this was brought up again. 04:56.320 --> 04:58.940 It was kind of localized to five or six hospitals. 04:59.000 --> 05:09.780 Did some digging into that case and it seemed that the response was that intercepting or decoding these tones was a sophisticated attack. 05:09.780 --> 05:14.940 And I think you'll see at the end of this talk that that is not the case at all. 05:15.640 --> 05:17.160 Alright, where to begin? 05:17.660 --> 05:19.920 In order to do this, you have to get some gear. 05:19.920 --> 05:26.080 And back in 1997, I would have agreed that it's a sophisticated attack, but not today. 05:26.180 --> 05:28.540 Back then, you'd have to get a scanner. 05:28.660 --> 05:35.160 You'd have to modify it with something from Loft Heavy Industries, like this POGSAG decoder from back in the day. 05:35.160 --> 05:36.700 I think that thing was $60. 05:36.740 --> 05:44.500 Then you would go over to this Doctor Who's radio phone site, which I used to frequent quite often when I was a teenager. 05:44.580 --> 05:48.940 And then you would have to stuff all that back into the scanner. 05:48.940 --> 05:51.360 And then you could decode these tones. 05:51.460 --> 05:55.760 And so yes, back in 1997, that was a sophisticated attack. 05:55.760 --> 06:01.600 However, in 2020, you just have to buy a $20 SDR. 06:01.600 --> 06:05.440 And you can get those from Hacker Warehouse, you can get them off Amazon, off eBay. 06:05.440 --> 06:07.780 It's really just too easy now. 06:07.780 --> 06:15.060 You really just plug in the SDR, download software, and then you tune to the signal. 06:15.060 --> 06:20.760 It's almost as easy as getting in your car and tuning in a frequency on your radio. 06:21.320 --> 06:24.260 You pick one of these frequencies here. 06:24.260 --> 06:26.700 These have been around for 20 years. 06:26.700 --> 06:28.940 The pager networks really haven't changed. 06:29.600 --> 06:33.360 And you tune into them, and you're going to hear some tones. 06:33.360 --> 06:38.240 Now the frequency used for this talk was 929.596. 06:38.840 --> 06:41.500 I localized the signal. 06:41.500 --> 06:45.220 It's coming from Santiago Peak, the antenna farm up there. 06:45.220 --> 06:46.860 And it has a lot of coverage. 06:46.860 --> 06:52.160 I was picking up hospitals from about a 70 mile radius. 06:52.160 --> 07:00.520 So a lot of stuff from Riverside, Pomona, down San Diego area, Irvine, not so much from LA County. 07:00.540 --> 07:07.200 But everything you see there in the circle was definitely within range of this tower. 07:07.460 --> 07:10.560 And the way the towers work is they relay off of one another. 07:10.560 --> 07:15.120 So a lot of times if you're not close to this tower, you'll be close to another tower. 07:15.240 --> 07:17.380 And you can find a signal that way. 07:17.380 --> 07:19.720 These signals are very strong. 07:19.720 --> 07:26.560 They're probably when you plug in the software, and you tune to a station, they are the strongest stations around. 07:26.620 --> 07:32.460 Okay, so as far as the signal goes, it sounds a little something like this. 07:36.340 --> 07:39.100 Now this is provided by M.A.Z.U.R. 07:39.540 --> 07:41.900 They said they got it from Matt Damon. 07:41.900 --> 07:43.220 That's true. 07:43.220 --> 07:47.720 But it sounds like kind of like an old modem tone, right? 07:47.780 --> 07:50.040 So that's what you're listening for. 07:50.040 --> 07:55.260 So when you tune to that 929 frequency, you're going to hear a whole lot of that. 07:55.800 --> 08:04.460 Okay, so the audio tone you just heard basically is a little more advanced than like a DTMF tones on a keypad. 08:04.460 --> 08:13.800 So like whenever you press one on your telephone, you get a combination of this 1209 hertz and this 697 hertz. 08:13.820 --> 08:16.740 And that's how the system knows that's a one. 08:17.140 --> 08:28.280 Similarly, frequency shift keying, whenever you lock onto that 929 megahertz signal, those audio shifts you hear are creating ones and zeros in the bit stream. 08:28.480 --> 08:31.300 And that's kind of in a nutshell how FSK works. 08:31.760 --> 08:35.060 Remember, I'm watering this down for kind of all audiences. 08:35.360 --> 08:42.500 But the point is, the tones will create frequency shift keying, which then creates data. 08:42.500 --> 08:47.760 And a Windows program like PDW will decode that data. 08:47.760 --> 08:50.960 And it'll just put it across your screen like this. 08:50.960 --> 08:54.580 And so this is actually what you just heard decoded. 08:54.580 --> 09:01.200 It's the standard DEF CON, drink all the booze, hack all the things mantra. 09:01.360 --> 09:04.160 So that's how this works. 09:04.460 --> 09:06.160 It's really not encrypted. 09:06.160 --> 09:07.400 It's all plain text. 09:07.400 --> 09:11.260 It's just a little bit more advanced than DTMF tones on a telephone. 09:11.400 --> 09:15.340 And you'll tune into the tones and get the data on your screen. 09:15.340 --> 09:16.600 It's really that simple. 09:18.080 --> 09:25.420 So now that you know how it works and how to decode a dual core song, let's shift back to kind of the hospital research. 09:25.420 --> 09:27.280 So I did a little digging here. 09:27.280 --> 09:32.600 There was this research about use of technology for patient care related communications. 09:32.780 --> 09:36.960 The gist of that paper was that 80% of hospitals still use pagers. 09:37.160 --> 09:43.120 And in that paper, they actually believe that pagers are more secure than cell phones. 09:43.320 --> 09:46.080 And you can check out this link and read more about that. 09:46.080 --> 09:49.620 But the quote that stood out to me was this one. 09:49.620 --> 09:53.880 They send only numeric messages or basic text messages, says Dr. 09:53.880 --> 09:54.780 So-and-so. 09:55.020 --> 09:58.940 This way, no confidential information can get in the wrong hands. 09:58.940 --> 10:00.660 That's could happen with the cell phone. 10:00.900 --> 10:04.180 And I think that is the heart of this problem. 10:04.180 --> 10:14.640 Pagers are actually thought of as a very good tool and a secure tool to use in hospitals when, in fact, they're not. 10:14.640 --> 10:30.680 So if we kind of know that, then it kind of makes sense why all of HIPAA compliance is being put into the network and securing the network within the hospital. 10:30.740 --> 10:35.320 And the pager usage is not really thought of as an open door. 10:35.320 --> 10:38.060 It's thought of more secure than that network. 10:38.120 --> 10:42.240 And what I found was that the pager usage actually isn't. 10:42.240 --> 10:55.280 So if we go back to that quote of they send only numeric messages, basic text messages, and no confidential information can get in the wrong hands, it's actually quite different. 10:55.280 --> 10:57.740 So here we go. 10:59.960 --> 11:03.980 This is a basic pager message from a hospital. 11:03.980 --> 11:10.000 It's leaking your personal information, and it even includes COVID results. 11:10.280 --> 11:13.040 This is one dissected, so I'll walk through this. 11:13.040 --> 11:27.480 You have the pager number, followed by the message time it was sent, the message date, which is a type of POGSAC-related protocol, alpha, which kind of defines the type of flex. 11:27.480 --> 11:28.860 There's different types. 11:29.060 --> 11:32.980 It includes this automated system name, which I'll touch on in a bit . 11:33.020 --> 11:35.100 It has the hospital name. 11:35.220 --> 11:47.640 It then goes into requested, which this is a bed request, last name, first name, age, gender, isolation protocol. 11:47.640 --> 11:49.300 That kind of tells the PPE. 11:49.300 --> 11:51.620 There's droplet, which is like a face mask. 11:51.620 --> 11:53.260 Sometimes it says full PPE. 11:53.260 --> 11:57.040 Sometimes it says face, different things there. 11:57.080 --> 11:58.660 The origin unit. 11:58.660 --> 12:00.340 Sometimes it says doctor's name. 12:00.340 --> 12:01.480 Sometimes it says a unit. 12:01.480 --> 12:06.500 In this case, it was the emergency department or usually that's emergency something. 12:06.500 --> 12:08.600 Sometimes it's a full doctor's name. 12:08.600 --> 12:16.240 And then in the comments right there, it says COVID positive or COVID negative. 12:17.040 --> 12:23.460 So that is a basic pager message that is not supposed to have any of your personal information in it. 12:23.620 --> 12:29.120 Because of COVID, they have gotten quite bloated with personal information. 12:29.120 --> 12:31.240 It didn't used to be this big. 12:31.440 --> 12:36.920 And that is the point of this discussion is this is what a simple text message looks like now. 12:37.220 --> 12:40.460 And it has too much personal information in it. 12:40.460 --> 12:44.200 And it has a lot of privacy violations in it as well. 12:44.960 --> 12:48.540 So once I saw that, I mean, what did I do? 12:49.620 --> 12:53.000 I decided just to let that decoder run. 12:53.000 --> 12:57.400 So I ran it for 52 days, mid-March through August 1st, 2020. 12:58.160 --> 13:02.320 Looking at COVID-related results, they would come across the screen. 13:02.320 --> 13:08.440 It resulted in 52 files, only 28 megabytes worth of data. 13:11.060 --> 13:13.740 And remember what I was looking for in the beginning? 13:13.760 --> 13:16.980 I was trying to figure out, hey, is this pandemic real? 13:16.980 --> 13:18.460 I didn't know anybody that had it. 13:18.460 --> 13:20.260 I didn't know if it was in our hospitals. 13:20.260 --> 13:24.000 So I really just wanted to trust the data and see for myself. 13:24.200 --> 13:28.840 I was really concerned about this whole, do we have enough beds, PPE and shortages? 13:28.840 --> 13:32.380 I wondered if there was data that would support that or give me a number. 13:32.580 --> 13:34.920 I wanted to know if it's affecting my community. 13:34.940 --> 13:41.940 And I wanted to know, is anybody out there doing this right and sending these messages securely? 13:42.060 --> 13:45.080 And so I got answers to all of these really. 13:45.220 --> 13:48.640 This is what a basic pager text message looks like. 13:48.640 --> 13:50.200 And here's some of the information we got. 13:50.240 --> 13:54.040 So hospital bed requests, they include COVID results. 13:54.040 --> 13:56.820 You can see over here, COVID positive, COVID positive. 13:56.920 --> 13:58.880 It came from a couple of different systems. 13:58.880 --> 14:00.920 This one came from an XT system. 14:00.920 --> 14:04.720 This one over here is this RTM system at now. 14:05.760 --> 14:09.600 So you can see here, I've redacted all the information. 14:09.600 --> 14:13.160 So I'm not distributing personal information here. 14:13.160 --> 14:15.280 This is a generic Patricia. 14:15.280 --> 14:17.060 She's an 84-year-old female. 14:17.060 --> 14:19.080 She has COVID positive. 14:19.080 --> 14:22.800 And this one is a 45-year-old male, Lazaro. 14:23.080 --> 14:26.020 He has been diagnosed with COVID-19. 14:26.160 --> 14:28.680 Additional comments they even put in here. 14:28.720 --> 14:33.660 This is what COVID is known as, is acute hypoxic respiratory failure. 14:33.660 --> 14:36.500 You see this pretty readily come across the stream. 14:36.560 --> 14:44.000 You see EMS fire runs, which give you a little more data on things that are happening then and now. 14:44.360 --> 14:55.900 Outside the hospital, this particular instance, someone was brought in because they smoked weed and drank some shots, but they asked them about COVID and they were negative on the COVID questions. 14:55.900 --> 14:57.480 So that comes across the stream. 14:57.480 --> 15:00.940 You get a lot of nurse to doctor communications going on over the pages. 15:00.940 --> 15:02.900 You got ICU admissions. 15:03.320 --> 15:05.900 You can find out details there. 15:05.900 --> 15:09.840 They're broadcasting this person was intubated on three pressers. 15:10.000 --> 15:16.160 They even questions on, they want to discuss options with hydroxychloroquine and ribavirin. 15:17.120 --> 15:19.140 And they have phone numbers there. 15:19.780 --> 15:22.360 There's a lot of questions going back and forth. 15:22.760 --> 15:27.580 And you also see these nurse to doctor communications regarding ventilator data. 15:27.620 --> 15:34.740 So basically everything they talk about on the news is being broadcast through these pager messages in plain text. 15:34.780 --> 15:36.680 There's a lot of this coming across the stream. 15:36.740 --> 15:43.840 Over 52 days, there were 17,286 tones decoded that turned into these types of text messages. 15:44.820 --> 15:52.680 Of those, 1,852 were bed requests with that HIPAA information included that should not have been there. 15:52.680 --> 15:55.720 There were 2,077 diagnoses. 15:55.740 --> 15:59.480 Of those diagnoses, 1,219 were COVID related. 15:59.480 --> 16:04.680 That includes negatives and positives or even questions, COVID questions. 16:04.680 --> 16:06.900 I just put these on here for comparison. 16:06.900 --> 16:12.920 There were only 78 fracture related, surprisingly only 67 cancer related and 300 chest pain. 16:12.920 --> 16:17.940 So you see an uptick in chest pains with COVID. 16:18.040 --> 16:20.660 And so that was one of the filters also in the data. 16:21.020 --> 16:27.840 Average age of patients with the virus was about 72 within that tower. 16:27.940 --> 16:32.620 But like I said, there's towers across the United States everywhere that are broadcasting this. 16:32.740 --> 16:36.780 So it'll vary from place to place. 16:36.900 --> 16:39.160 Also, I did get an answer to that final question. 16:39.160 --> 16:40.920 Is anyone doing it secure? 16:40.920 --> 16:47.060 And I found that a few, I think it was 11% of the messages actually were sent securely. 16:47.860 --> 16:50.760 Obviously, there's a lot of attack vectors with this kind of information. 16:51.020 --> 16:56.560 From embarrassment, identity theft, to billing scams, disrupting supply chains, misrouting patients. 16:56.560 --> 16:58.860 That would be if you were spoofing communications. 16:58.860 --> 17:00.200 We are not doing that here. 17:00.200 --> 17:03.400 We're just receiving these things out of the thin air. 17:03.600 --> 17:08.600 But there's a lot of like drug interaction text messages where it says, hey, should they take this? 17:08.600 --> 17:09.880 Text me yes or no. 17:09.960 --> 17:15.840 And that seems dangerous, especially over unencrypted communications, which leads just to life safety in general. 17:15.840 --> 17:19.880 And that's why this practice of using pages in hospitals just really needs to stop. 17:20.220 --> 17:21.720 So how does this happen? 17:21.720 --> 17:24.960 It appears that no one's doing this intentionally. 17:24.960 --> 17:26.380 It's part of a system. 17:26.840 --> 17:33.600 That XT system is, there's a lot of these different patient management systems that hospitals use. 17:33.600 --> 17:44.200 This one looked like it came from TeleTracking XT, which they talk about IVRs, which are systems that help hospitals manage patients. 17:44.200 --> 17:50.620 And even in here, in the TeleTracking website, they talk about, you know, details are sent to the employee's pager. 17:50.840 --> 17:52.120 Keep in mind, that's not their fault. 17:52.120 --> 17:53.400 This is just their software. 17:53.400 --> 18:01.640 You can implement these pager communication systems properly with encryption, like we saw back here. 18:01.800 --> 18:03.460 See, this one was secure. 18:03.680 --> 18:07.860 But it's really up to the hospital and their service providers. 18:07.860 --> 18:09.460 It may not even be the hospital's fault. 18:09.460 --> 18:17.680 They may contract it out to a telecommunication service provider, and they're just using the wrong type of pager network rather than the secure one. 18:17.980 --> 18:27.380 So also found, though, that these systems are tracking this exact same data, and they're providing it back to the hospital kind of on an enterprise level. 18:27.660 --> 18:34.420 So that the heart of the data is the pager data, and then you can create these dashboards. 18:34.420 --> 18:39.620 And so they're actually doing what I was trying to do, but they're doing it within the hospital. 18:39.620 --> 18:47.360 And you can see it's very valuable information for the hospitals, but it just needs to stay within the hospital, right? 18:48.120 --> 18:49.840 So what answers did I get? 18:49.880 --> 18:50.820 Yes, this is real. 18:50.820 --> 18:51.820 It's happening. 18:51.820 --> 18:54.940 I saw EMS run confirmations, symptoms match. 18:55.740 --> 18:59.800 We can see most bed requests seem like bed levels were okay. 18:59.800 --> 19:05.480 Didn't see a lot of messages where people were worried about that, but that was just my area. 19:05.480 --> 19:07.560 I'm sure that's a problem other places. 19:07.600 --> 19:12.080 I was able to see in my community that the older population was more affected . 19:12.080 --> 19:15.560 And I also was able to answer the question of, is there a lot of security here? 19:15.560 --> 19:16.440 And it was not. 19:16.440 --> 19:23.400 Only 11% of the messages were actually secured and encrypted, and in no way did I try to decrypt them at all. 19:23.760 --> 19:28.040 That would have just been too hard when you have thousands of thousands of them that are not encrypted. 19:28.580 --> 19:29.640 So where do we go from here? 19:29.640 --> 19:31.680 Healthcare providers need to do this stuff. 19:31.680 --> 19:37.500 And I've been in the industry, so these are the questions that some of these roles need to ask. 19:37.500 --> 19:41.360 I won't go through all these, but CIO, you need to allocate budget. 19:41.460 --> 19:43.380 IT needs to ask some questions. 19:43.620 --> 19:46.220 Auditors, start auditing these pager networks, please. 19:47.160 --> 19:49.240 Lawyers, start asking questions. 19:49.640 --> 19:54.240 Reporters, spread this information in this talk, so we can have these conversations about healthcare system. 19:54.420 --> 20:01.780 And patients, you can ask your providers about their pager system security, if you see your doctor wearing one. 20:02.620 --> 20:05.180 Hospitals just need to listen to the security community. 20:05.180 --> 20:08.560 Please don't say this is a sophisticated attack, because it's not at all. 20:08.560 --> 20:09.920 It's super easy. 20:10.020 --> 20:12.740 We just need to upgrade the security in these systems. 20:12.900 --> 20:17.320 And for the healthcare providers, they just need to keep up the good fight. 20:17.320 --> 20:24.220 Let IT deal with this, and keep doing what you're doing, because we're all thankful for everything that you do. 20:24.540 --> 20:24.980 All right. 20:24.980 --> 20:25.360 Thank you. 20:25.360 --> 20:26.860 I think my time is up. 20:26.860 --> 20:28.280 Thanks again, everybody, for listening. 20:28.280 --> 20:31.020 If you want to hit me up on Twitter, you can reach me at waveguide. 20:31.020 --> 20:33.980 That's at W-A-V-E-G-U-Y-D. 20:34.340 --> 20:36.280 Or on the Discord link right here. 20:36.280 --> 20:38.620 I'll be doing Q&A right now. 20:38.660 --> 20:41.460 So talk to you soon, and hopefully see you next year. 20:41.460 --> 20:42.040 Thanks.