start	end	text
3650	7520	Hello, this is Point-of-Sale Terminal Security Uncovered.
7560	13780	My name is Alexey Stanikov, I am a hardware researcher, and I am going to talk about payment hardware security.
14100	20500	When I started this research, I faced the lack of useful information related to these kinds of devices.
21400	26280	All vendors still keep it a secret that there are technologies used in such hardware.
26420	31920	Because of many reasons, Point-of-Sale Terminal Security is still a blind spot.
31920	40020	This talk is a combination of two years of research related to payment devices, which handles your payment card data.
40040	48540	I am going to present general approach to understand the internals of hardware, common weaknesses, and additionally, some of our results.
48760	50380	So, let's start.
53220	59000	As you can see, this presentation is divided into two main parts – hardware and software.
59000	65980	Every topic in this list could be a separate talk, but I tried to highlight the most important things for each of them.
67300	72360	At the first step, we have to understand that a POS system is not equal to POS terminal.
72800	80220	Basically, Point-of-Sale Terminal, or Pinpad, is a part of Point-of-Sale system, or just a standalone device.
80680	87320	Also, Point-of-Sale system may have a register, which in most cases is built on Windows-based PC.
87320	94100	Additional hardware, like a barcode scanners, and can be integrated to ERP systems.
94380	102960	Often, when we see the title like someone hacked the POS, it means hack of register or cashier workstation.
103260	109160	Let's look at typical data flow in such systems, to define entry points for intruder.
109400	112900	This is typical Point-of-Sale interaction scheme.
113000	115680	What can go wrong in this case?
115680	119620	As you can see, Pinpad has two kinds of interactions.
119620	126820	First one is an interaction with terminal management system and payment processor through the Internet.
127240	133040	Second one is an interaction with Point-of-Sale application using local network.
133420	143540	Communication channel between the Pinpad and third-party application or Point-of-Sale application can be configured in two different ways, secure and insecure.
143540	151960	Common attack in this case is indifference between amount shown on Pinpad and amount really charged from your card.
152360	155180	This is about vulnerable configuration.
155400	160000	But I want to pay attention to the most common thing in my talk.
160000	167620	Just keep in mind to keep configuration as secure as possible, if you are maintainer of such systems.
168420	172860	I am sure that you recognized at least two of these terminals.
172860	177740	First two vendors are well-known for United States and European countries.
177900	184820	And as far as I know, PAX is widely used in Russia and Asian countries because it's cheaper than previous two.
185100	190320	If you try to connect to Pinpad via network connection, you will be surprised.
190660	196760	There are no listening ports and one or two outcoming connections to some bank servers.
196780	200520	In this case, you have to look at other physical ports.
200520	205580	The interfaces exposed to intruder are basically attack surface.
205640	219860	They can be divided to general communication interfaces like Ethernet, RS-232, different wireless interfaces and specific payment card interfaces, EMV and NFC.
219860	235400	In some documentation you may find information that some of them are not used, but in real life operating system has drivers and handlers for some specific peripherals like barcode scanners and external receipt printers.
236480	241620	The next important thing is rules how the payment hardware should be built.
241660	248740	I know that regulation is a boring stuff, but it may provide a lot of information about physical security tests and behavior.
248740	253000	Every payment terminal should satisfy these requirements and regulations.
253000	258180	In any other cases, it can be approved to work with payment data.
258380	262980	The first one is Pinintr devices physical security requirements.
262980	271600	It defines protection measures against pin disclosing attacks like tamper detection, response mechanisms and other cases.
271600	281880	For example, if reader permits access to internal areas, it is not possible using this access area to insert pin disclosing bug.
282780	288360	Also sensitive functions or information are only used in protected areas.
289300	291980	The next one is pin transaction security.
291980	293820	They are almost the same.
293820	297040	Both have purpose to prevent pin disclosing.
297040	304160	These requirements also define tamper protection, sensitive data erasing, etc, etc.
304680	308180	And what is the sensitive data is a question.
308560	313220	Every vendor chose their own interpretation and way to erase.
313960	318920	Let's have a look to common security mechanisms and anti-tampering.
318920	325260	According to previous rules and payment system requirements, the following events should be registered,
325260	335070	like a case opening, security circuit damage, power supply anomalies, also temperature anomalies, accelerometer anomalies,
335800	339980	and finally, debugging interfaces connection.
340000	344360	Two or more of them should be interpreted as intrusion.
344360	355460	As a result, the terminal should lock the event, erase encryption keys, delete sensitive information, and finally become brick.
355760	363980	This slide shows you tamper detection list we have extracted from Ingenio-Catalium-2 operating system code.
363980	368400	As you may see, there are a lot of power supply detectors,
368400	374660	JTAG connection detector, and mechanical tamper detectors like meshes or switches.
375180	377780	Let's look at each of them.
378100	383700	When you disassemble Ingenica pinpad, you will see a lot of membrane switches.
383740	388880	Some of them are assigned to real buttons like numeric and navigation buttons.
388880	391180	They are highlighted with green color.
391180	394060	But what are the red membranes?
394100	396540	They are mechanical tamper detectors.
396540	399580	They are pressed by the pinpad body when assembled.
399800	411800	When you start to rotate any screw in order to disassemble, the microcontroller receives a hardware interrupt, wakes up, and do defined actions to protect its data.
411840	417160	Another critical measure is a wire mesh, as shown on this slide.
417160	421900	It has two main purposes, anti-drilling protection and obfuscation.
421900	428640	Case on this slide covers smart card reader and registers drilling when protection circuit is destroyed.
428760	434480	This kind of meshes you also may find on print circuit boards and ribbon cables.
434760	446820	And finally, this is example of tampered devices as a result of some of our attempts.
446820	452840	Some of them became unusable, and some of them asks you for factory password.
452840	457100	The main idea is when device is tampered, it should be passed to service.
457520	466220	Basically, only authorized service may restore the device, and only bank service can restore it and lower the application.
466360	470180	And what consequences anti-tampering bypass may have?
470180	476300	One example related to mobile point-of-sale demonstrated on Black Hat United States.
476300	481780	The researchers realized that this device doesn't have any anti-tampering detectors.
482020	488720	They found points on circuit to connect in order to obtain encrypted magstripe data.
488720	494660	And finally, it allows them to collect sensitive payment information directly from device.
494840	499320	Another cool research made by SR Labs and presented on CCC.
499320	507480	Among their findings were anti-tampering bypass, unlocked and exposed JTAG connection, and software vulnerabilities.
507600	511660	What you may do with such vulnerabilities, we will discuss a bit later.
511920	518260	Anyway, these findings compromised the whole device, and now it's deprecated.
520000	523660	Another two examples related to the relay attacks and scheming.
523660	526600	You can read more using the links below.
526600	531380	And now it's time to talk about debugging maintenance features.
532880	539020	When you disassembled the point-of-sale terminal, you realized that it is a very complex device.
539060	544020	Your imagination and background paint something like what you see on this slide.
544020	549600	Because you know that the iPhone, for example, has a very specific JTAG adapter.
549600	557800	In this case, you can find some forum topics about firmware uploading, tamper clearing, and related stuff.
558100	561020	But this is what you see in reality.
561760	569340	Verifone and PEX use the adapter from simple RS-232 to Ethernet connector with custom wiring.
569340	571840	You can reproduce them yourself.
571900	577440	Injenica used just a usual USB port for firmware uploading and service actions.
577440	585440	These cables are used for factory reset, clear security flags, upload firmware, and sometimes for specific debugging.
585820	593800	But at the moment we still don't have firmware and don't know any information about architecture of microcontroller.
593820	596420	And now we should fill this gap.
596860	600300	Teardown is my favorite step when I work with new hardware.
600300	608840	It delivers a lot of happiness to you, as a favorite thing to all children is to broke new toy and see what do they have inside.
610060	616100	In the case if you already have the firmware, it's good to understand the internals of hardware.
616200	626460	If you properly define the exact CPU or MCU, it helps you to understand the operating system internals, peripherals, and other helpful things.
626460	637160	This is an example of old model made by Verifone. It built using Samsung ARM-based CPU. You may read more about using a link below.
650960	654920	But our region of interest is more modern devices.
654920	663620	This is the internals of modern Verifone 520. Here you can see the branded MCU and non-flash memory.
663640	667580	Definitely this MCU should be relatively popular one.
667580	674020	But in this case it is rebranded. It makes more difficult to understand the firmware internals.
674440	679820	In this case firmware could be dumped from non-flash memory using non-programmer.
679820	684060	Luckily I found one guy in Twitter who solved the same task.
684860	693100	He defined the exact model of MCU by pinout. It was Broadcom Secure MCU BCM5892.
693340	699700	You can find header files with definitions of all peripherals in some Linux kernel sources.
699700	707600	There are some other ways to determine the exact MCU. And I am going to show one of them in next slides.
709720	716680	The next one is Ingenico pinpad. There is basically no difference is it portable or countertop.
716740	724040	They all built using the same hardware and uses the same operating system. I am sure it is well known for all of you.
724880	728140	You saw this photo on the slide with tampering detectors.
728140	733160	In this case pay attention to the microcontroller under the membrane.
733960	738860	It is branded cryptoprocessor. They called it booster in their binaries.
738940	747680	It stores the encryption keys inside and handles the most of critical cryptography tasks like updates, signature checks, etc.
750440	756760	This is other side of print circuit board. And we see another branded microcontroller.
756760	761040	They called it application processor according to its purpose.
761180	765840	Exactly you can find any information about this microcontroller.
766040	772480	As in previous case flash memory in upper left corner stores operating system and application codes.
774400	789170	You can desolder the flash memory in order to obtain operating system and application code for research.
789170	796750	In this case it is good to know the exact MCU to understand work with peripherals and other peculiarities.
797090	802190	One other important thing is flash contents you are going to dump is compressed.
802190	805490	You should solve unpacking task by yourself.
805690	813610	Booster probably is one of Atmel Cortex-M3 MCU series but in unusual package.
813610	819630	I can't do anything in this case without laboratory and tools for decaping.
819630	823490	Application processor looks like general purpose microcontroller.
823490	826630	And I tried to define the exact model.
827890	831130	This is another scenario to define MCU.
831130	835550	At the first step I desoldered this MCU and defined the exact package.
835550	840490	At the next step I made list of all microcontroller candidates for this package.
840870	849510	Then I defined power supply pins by PCB using multimeter and filtered all unfit candidates by pinout.
849670	855310	The next thing you can see in testpad close to the microcontroller.
855490	860910	It may be interface used during production for factory flashing and setting up.
860910	865390	This hypothesis is confirmed by pull-up resistor block.
865770	868310	The next list I made was pinout candidates.
868310	873290	At the moment I had list of microcontrollers only by microchip.
873290	875930	This list is on the slide.
876710	886550	And as a result I defined G-tag pinout and I think the exact model is AT91SAM9G20.
886550	892770	We tried to apply memory and register maps to our banners and it's fit.
892810	896910	But sadly the G-tag is turned off.
896910	901670	The next case of pinpads is Chinese PAX point-of-sale terminals.
901670	905590	They are very similar to Verifone by their internals.
905590	908820	But it is completely different software inside.
909430	914830	When you disassemble one of them you will find the same microcontroller.
914830	924990	When you disassemble one of them you will find the same microcontroller and almost the same non-flash memory as used in all modern Verifones.
925750	934170	Non-flash contents exposes to you encrypted and uncompressed binaries of proprietary operating system and application.
934170	937830	Exactly the file system structure is proprietary.
938790	945130	Now you can buy a couple of them from eBay for example and start your own payment hardware research.
946390	949970	And a few words about tampering reset.
949970	954910	Definitely all terminals have different ways to clear tampering flags.
954910	959170	Some of them, like PAX, uses simple hard-coded passwords.
959170	964570	Verifone models needed to upload dummy encryption keys to clear tamper flags.
964570	970650	And in Jenica, as far as I know, storage security flags and keys in separate hardware controller.
970770	974710	And it can be reset using an external hardware.
975430	982330	Also some forum topics contain the information about maintenance, tampering, clearing, etc, etc.
982870	989610	Here you may see tips from closed Russian forum about hard-coded passwords and special software.
989610	996750	The true way to understand all things related to tampering is reverse engineering.
997270	1001090	What can you do if you can clear tampering flags?
1001290	1008370	For example, when you cleared these flags, you are able to upload the application again and play with the configuration.
1009310	1013490	You may try to write and upload your own firmwares.
1013490	1022450	Tamper clearing may help you to restore after your experiments or use it opened in order to research internal interfaces using logical analyzer.
1022790	1027650	Some of the pinpads are able to turn on some debug capabilities.
1028030	1032750	And in this case, you can run any applications under the debugger.
1033190	1039730	Now when we know some information about the hardware and connections, we should cover another blind spot.
1039730	1041730	Payment card interfaces.
1041730	1047350	EMV is a payment method based upon a technical standard for smart payment cards.
1047350	1055210	EMV originally stood for EuroPay, MasterCard and Visa, the three companies which created the standard.
1055270	1061630	In most cases, the hardware allows you to intercept and modify payment card data isn't cheap.
1061630	1066670	In this case, we used a device called Smart Card Detective with custom firmware.
1066670	1075010	Now it's not supported by original developer, but you can find the PCB and sources to assemble one for you.
1075010	1078570	Here's a link with some information related to this device.
1079350	1086450	In order to understand the EMV packets, you should read a bit about tagline value format.
1086450	1094830	Then you should go to the official site of EMV and you will be surprised by amount of information what you should read.
1094830	1099990	Now you see some information available for download and related to EMV.
1100150	1110250	Every of these documents is very thick because it defines all things started from physical layer and deep description for every tag of EMV.
1110770	1115130	I recommend you to read them briefly at least.
1118300	1122480	Another interesting thing is NFC interface.
1122480	1127900	Frame format is close to the EMV, but the physical layer is near field communication.
1128100	1132900	There are some approaches to start to work with NFC depends on your skills.
1133220	1135730	The most simple of them is Proxmark.
1136060	1145440	Another way is assemble your own sniffer or repeater based on some available stuff like PN532 or TRF-based board.
1145440	1151540	Also you can use Android device with NFC or something else that fits to your skills.
1151540	1157400	Our assembly was PN532 based boards with Raspberry Pi Zero.
1157400	1159900	It was cheap and dirty trick as you see.
1159900	1164580	But the components for it available literally everywhere.
1165200	1167880	And another batch of documentation.
1167880	1170580	Now it is related to the NFC.
1170880	1174540	There are many descriptions of contactless payment transactions.
1174540	1178000	I also recommend read it briefly at least.
1178000	1179580	Why is it important?
1179580	1183620	Every card payment interaction has its own handler.
1184220	1189020	And you are able to fuzz every check and you will be surprised.
1189540	1195620	And now it is time to discuss the software and firmware part of point-of-sale terminals.
1198230	1202690	During our research we faced two different operating systems.
1202690	1211390	Part of them was completely proprietary like Verifone Verix, Sage Antelium used by Ingenico and PaxOS.
1211950	1217310	They all have legacy codebase, proprietary binary format, etc.
1218440	1222130	Another part was Linux-based devices.
1222990	1227370	Android devices in this case are out of our scope.
1228410	1232430	The first thing we have to understand is device boot order.
1232430	1242490	It also has a lot of legacy because almost all of these operating systems developed before traditional secure boot approach became a mainstream.
1242890	1246750	After reset zero-stage boot loader should be started.
1246750	1252570	Usually it is located inside microcontroller in form of mass-corridor memory.
1252570	1266530	It loads the next-step boot loader from flash memory and checks its cryptographic signature using the keys stored in OTP, read-only memory or any secure memory.
1266530	1274370	Every next-step boot loader also should check the cryptographic signature of every loaded piece of code, etc.
1275350	1280310	Every vendor reinvented their own boot order in this case.
1280310	1283010	Sometimes the boot chain is very long.
1283410	1288930	Finally, when operating system loads an application, it also should check its signature.
1289470	1294050	This slide shows you the boot log from the Linux-based Verifone.
1294470	1298930	Before the kernel started, we can see boot loader output.
1298930	1301830	In this case, it is very talkative.
1301830	1303570	It called SBI.
1303710	1306010	Now we know its version.
1306010	1310250	Also, it can load some files from USB stick.
1310250	1312590	And it loaded uboot.
1312590	1317170	And finally, kernel output disclosed the CPU model.
1317590	1322770	Now you see the Verix operating system-based Verifone output.
1322770	1325810	Surprisingly, it started the same boot loader.
1325810	1333030	Again, it can work with USB sticks, but in this case it loads the proprietary operating system kernel.
1333030	1337320	Please look at the operating system kernel output.
1337590	1344890	Here you can see the Broadcom CPU model that was previously rebranded to internal Verifone name.
1345050	1350350	In both cases, this boot loader located at the start of NAND flash.
1352170	1358090	When we dumped the SBI boot loader, we are able to disassemble and research it.
1358090	1365470	Surprisingly, it has a lot of features for factory resetting, maintenance and building command-line interface.
1365470	1375410	But to run this command-line interface, you should exploit the vulnerability related to arbitrary memory write that we found during our research.
1377950	1382730	Another good example is Ingenio Cartelium 2 based pinpads.
1382730	1398210	Its maintenance mode contains a lot of features like boot tracing, firmware upload, operating systems and application updates, application tracing, application debug and also undisclosed command-line interface.
1399920	1404120	Well, how to get into these maintenance modes?
1404120	1407760	The answer we found in official documentation.
1407760	1417220	As you see, to enter this mode, you have to press F2 and F4 during the boot of pinpad and enter the password.
1417220	1424640	The default password in this case discussed many, many times, but no one changes it. Surprisingly.
1425920	1431080	You may think that another terminals have more secure ways to enter this mode.
1433770	1437950	This is Linux based Verifone model from MX series.
1438610	1444630	And surprisingly, it has the same password with different hotkeys to enter the maintenance mode.
1444630	1447350	It called the system mode in this case.
1447470	1452930	At the first time when you enter to this mode, it asks you to change the password.
1453010	1456090	And please look at that official screenshot.
1456450	1462390	We all see that many people changes password to the same except one last digit.
1464690	1471570	Completely different approach we found in IngeniCode telecom operating system based terminals.
1471570	1477830	They uses a special software called LLT, as shown on the pinpad display.
1478190	1480710	What can go wrong in this case?
1480710	1487210	The application establishes the PPP connection over virtual USB serial.
1487210	1494470	When it sends some bytes to pinpad, and pinpad launches the internal FTP server.
1494470	1499490	This FTP server used for updates and configuration.
1499490	1505110	The directory structure is shown in the LLT software interface.
1505210	1507050	And the fun facts.
1507050	1511230	The PPP connection uses constant hard-coded credentials.
1511230	1518410	Custom protocol is clear text and has always the same bytes to open the FTP server.
1518410	1526290	The FTP server also uses constant hard-coded credentials like FTP user or FTP password.
1526350	1530370	You may do these findings without any reverse engineering.
1530370	1539730	Just launch any USB sniffer on this USB bus and you surprisingly see that there is no encryption.
1542540	1548520	And finally, you should pay attention to alternative work modes.
1548520	1554460	In the case of Ingenico it called mockup mode and used for some software demonstration.
1554480	1557790	Some security features are turned off in this mode.
1558180	1564640	For other terminals like PUX you may find special firmwares that don't register tampering
1564640	1570600	and allows you to run any applications without any cryptographic checks.
1570600	1573940	The only one thing you will see in this case.
1573940	1577640	This notification when device turns on.
1580620	1585480	And now it's time to summarize all of our results in this research.
1585480	1591600	Let's start from this well-known Linux-based verifon of MX series.
1592240	1599980	In this case we don't discuss any old verifon MX models because they are deprecated by payment system.
1599980	1603780	Because they were very buggy.
1603780	1610290	At the first look the security measures are enough to make device unhackable.
1610820	1616490	It has all traditional tampering detectors and additionally maintenance password,
1616540	1622320	no declared access to command-line interface, signed updates.
1622320	1628410	And on the Linux level it has well-configured role-based access control.
1628410	1636770	But the reality multiplies these security measures by zero, because no one changes the default password.
1636970	1643210	There is special mode when stdout and stdr logged via serial port exists.
1643410	1653570	Also you may find interesting a lot of shell command injection directly from the user interface and very simple role-based access control bypass.
1653570	1659710	The link to this research when the researcher started the Doom game is below.
1659710	1665230	And again, we found the way to install and run unsigned packages.
1665930	1671030	The next interesting case is Verix operating system-based terminals.
1671150	1674410	I'm sure all of you saw this kind of devices.
1674410	1683910	Please don't be confused by a wide range of modules like countertop, portable devices, devices with Bluetooth or with GSM modules.
1683910	1691390	Every vulnerability you found in one device will work on every other Verix operating system-based device,
1691390	1695150	because they all have the same code base.
1696030	1706570	As the previous devices, Verix-based pinpads have the same measures like maintenance password, command-line interface doesn't exist,
1706570	1713770	updates are signed and encrypted, and they should have well-tested and strong code base.
1714350	1718380	But again, no one changes the maintenance password.
1718690	1724350	During our research we found pre-installed binaries from standard OS package.
1724350	1732390	One of them called VSH like Verix shell and can be run directly from maintenance mode.
1732390	1735490	The result you may see on the screenshot.
1735990	1742410	We found weak cryptography schemes which allows you to run any unsigned code.
1742410	1749570	And finally, decryption keys for updates decryption could be extracted from the device memory.
1749570	1756910	One of the most interesting sort of devices is Teleum operating system-based devices by Ingenico.
1757370	1764810	I also showed that at least one of these devices from the picture is known for you in real life.
1765170	1771350	And again, there is very wide range of devices with the same code base.
1771370	1773830	Let's look at their security.
1774490	1779130	The vendor approach looks like in previous cases, but with some peculiarities.
1779130	1787970	For example, they use specialized software for maintenance and separate cryptoprocessor for cryptographic operations.
1788050	1797850	And other things like tamper detectors, encryption, etc. etc. are standard for any point-of-sale terminals, as we already know.
1799190	1803390	And what we realized during our Ingenico research.
1803550	1807270	Private maintenance software is accessible from the Internet.
1807270	1811410	A lot of protocols are accessible from the LLT mode.
1811410	1813390	Some of them are vulnerable.
1813390	1819370	Another one allows you to run device with some debug capabilities.
1820050	1826190	Update signature doesn't matter if you have remote code execution on the device or debug.
1826550	1830510	Finally, there is a lot of buggy legacy code.
1832680	1836870	The last one kind of pinpads is PAX devices.
1836870	1844210	They are less known for you, but the vendor approaches are less complex than any of previous cases.
1846430	1851170	This is why I'd recommend to start your research from these models.
1851170	1856630	Surprisingly, the maintenance software is accessible from the Internet again.
1856630	1866550	Also, you can find operating system builds with turned-off security features for testing your own applications and to play with operating system kernel.
1867070	1872630	And probably, you may do a lot of findings related to the legacy code base.
1877400	1881040	Why you shouldn't afraid to start paying hardware research?
1881040	1886040	Basically, you don't need to have any banking account to interact with hardware.
1886040	1894220	The only thing you need at start is buy a couple of such pinpads and be ready that some of them goes to the trash bin.
1894220	1898480	The approximate list of our findings is on the slide.
1898480	1901300	There are a lot of untested critical code.
1901620	1910540	We found some buffer overflows and logical flaws in kernel, as well as network state and others.
1910720	1914900	Almost all vulnerabilities are exploitable easily.
1914900	1919660	In secure maintenance and special modes we develop passwords.
1920980	1930360	Also, you may find altered and debug signed operating system builds, as well as maintenance software and software development kits.
1932080	1936440	And what is the impact of such findings, flaws and vulnerabilities?
1936600	1942240	First of all, you have to understand that this hardware works with your payment card data.
1942240	1945940	It means that hardware works with your money directly.
1945960	1949530	The very short list of different attacks is on the slide.
1950280	1953540	I have to say a few words about fake POS.
1953540	1960360	If you were or live in Europe, you saw a lot of terminals in almost every touristic shops.
1961080	1967940	The only one reason why it happens is in different rules for different terminals with different payment systems.
1967940	1977300	When you card swiped or inserted in fake, not licensed and evil pinpad, your money became not yours.
1977480	1984260	It happens because someone bought the POS terminal with not banking application, but evil.
1984260	1991820	You may see on this slide advertisement about selling such firmware on some Russian underground forum.
1991820	1998600	Any other attacks are mostly understandable and you may read more about them in open sources.
1998600	2004940	This is another short list, but in this case it contains vulnerabilities we found by our team.
2005000	2013920	As you may see, there exist such things like hardcoded credentials, insecure clear text and vulnerable protocols.
2013920	2017580	A lot of arbitrary code executions, etc, etc.
2017580	2025160	And one of my favorite is the last one, operating system independent code execution in Verifone Bootloader.
2025160	2033440	Soon we are going to disclose technical details for every CVE from this list, but it would be a bit later.
2035680	2040360	Finally, I want to thank these cool guys for their work and help.
2040360	2043960	It was great to work together on this research.
2043960	2054200	The team members are Timur Inusov, Dmitry Sklyarov, Igor Zaitsev, Vladimir Karanovich, Artem Ivachev and Maxim Kozhevnikov.
2054580	2061700	And that's all for today. If you have any questions, suggestions or topics to discuss, feel free to contact me.
2061700	2064280	Thank you for attention and stay healthy!