[00:00.000 --> 00:05.840]  Now we have Filipe Proteus, who will be going ahead and giving a talk on crushing crumbs
[00:05.840 --> 00:11.300]  of information to eat a whole cake, as attractive as it sounds. A little introduction about
[00:11.300 --> 00:18.940]  Filipe. Filipe works as a security researcher at TensorSecurity and he has graduated in
[00:18.940 --> 00:24.840]  information security and has a master's in systems and computing engineering from a university
[00:24.840 --> 00:31.040]  in Brazil. He has over 10 years of experience in information security and has an emphasis
[00:31.040 --> 00:36.240]  on networking, data visualization, and threat hunting. And he's also presented in a lot
[00:36.240 --> 00:39.940]  of conferences such as Black Hat and DEF CON, so yes, we are seeing him again at DEF CON.
[00:40.060 --> 00:41.660]  So welcome, Filipe.
[00:48.130 --> 00:49.770]  Thank you, thank you very much.
[00:56.750 --> 00:58.310]  Recording in progress.
[01:01.550 --> 01:07.370]  Hopefully everything is set up. Everything is good? Hi, everyone. Nice to have you all
[01:07.370 --> 01:12.990]  here. So let's start with crushing crumbs of information to eat a whole cake. It's a
[01:12.990 --> 01:21.430]  funny name, right? So who am I? Well, thank you for the introduction. My full name is
[01:21.970 --> 01:28.090]  Filipe Expósito, but I'm also known as Proteus. Ten years of experience, father of a girl.
[01:28.090 --> 01:32.490]  I do bug bounty when the above items allow, and I'm also a blue team instructor when the
[01:32.490 --> 01:39.970]  above items allow. And my main job, I'm a security researcher at TNT Security. TNT Security
[01:39.970 --> 01:47.930]  is a company, it's a cloud security company that works with cloud, and we also have a
[01:47.930 --> 01:53.770]  product that does third-party risk management. And as my job as a security researcher in
[01:53.770 --> 01:58.050]  focus on third-party risk management, we all think about supply chain and this kind of
[01:58.050 --> 02:05.050]  stuff. And as a motivation for this talk, thinking about supply chain and this kind
[02:05.050 --> 02:12.350]  of stuff, I just realized that we as a society, we rely not only on each other as people,
[02:12.350 --> 02:17.990]  as persons, but in our governments, because they have data on us. They know how much we
[02:17.990 --> 02:24.610]  make per month, yearly, and this kind of stuff. But also services, like electricity, gas,
[02:24.610 --> 02:30.610]  internet, all this kind of stuff. So that creates a huge supply chain of trust. Well,
[02:30.610 --> 02:36.710]  you'll see it. But also relationships. So, for instance, here we have a... I don't know
[02:36.710 --> 02:43.370]  if you guys know about this, but this is an electrician that works back in Brazil. So
[02:43.370 --> 02:50.050]  an electricity company knows about your name, where you live, how much you spend in energy,
[02:50.050 --> 02:55.650]  and if you're paying day by day. So they have to know all this kind of information
[02:55.650 --> 03:03.590]  to provide you services. By the way, if you're interested in supply chain, TNT has a newsletter
[03:03.590 --> 03:11.050]  called Alice in Supply Chains. So if you like the theme, just go subscribe. So coming back
[03:11.050 --> 03:18.190]  to our theme, that is supply chains. So this happens with a not really close friend of
[03:18.190 --> 03:23.030]  mine, but someone that I know. I don't know if everybody knows, but back in Brazil, marijuana
[03:23.030 --> 03:32.750]  is illegal. So it's illegal. So what happens is this friend of mine, he got caught by the
[03:32.750 --> 03:40.790]  police because someone told to the police that his electricity bill was like over 2,000 reais,
[03:40.790 --> 03:47.030]  like really huge electricity bill. And why he has that electricity bill? Because he's
[03:47.030 --> 03:53.490]  growing marijuana inside of his place. So he has a three-room place, one room for growing
[03:53.490 --> 04:01.350]  the marijuana and stuff with hot air and that kind of stuff, the other room just to make the
[04:01.350 --> 04:08.670]  flowers grow, and he controls all the weather, the humidity, and everything plus electricity,
[04:08.670 --> 04:13.830]  right? So someone tipped the police with his electricity bill, the police went to his home,
[04:13.830 --> 04:20.910]  and arrested him. So the same can occur in a lot of services that we rely on. So this can
[04:20.910 --> 04:28.590]  happen with internet provider, water, and gas, and so on. So I was thinking, how can we exploit
[04:28.590 --> 04:37.930]  those relationships? So we could hack every single company that we rely on any kind of
[04:39.550 --> 04:45.190]  providing services, so hack the planet, but that would be unfeasible, right? Nobody has the time
[04:45.190 --> 04:52.170]  to hack like 10 and 100 companies. Or wait for the company to be hacked, which will happen,
[04:52.170 --> 04:59.110]  and get the leak, but that's kind of boring, we have to sit and wait. So I start to wonder,
[04:59.110 --> 05:07.070]  what's the minimum crumb of information do I need to get, for instance, anyone's electricity bill?
[05:08.570 --> 05:16.270]  And just taking my example, I figured out that with just the CPF, it would be enough for me to
[05:16.270 --> 05:21.610]  get my electricity bill. So if I know the CPF of anyone, I would also be able to get the electricity
[05:21.610 --> 05:27.490]  bill for that people as well. So what is the CPF? CPF is really similar to the social security
[05:27.490 --> 05:33.750]  number in the United States of America. Every single Brazilian has at least one, and here I
[05:33.750 --> 05:41.210]  at least because there are some fraudsters, they're able to get two, three, or perhaps five.
[05:42.810 --> 05:50.150]  And by being unique for each Brazilian, that makes an awesome primary key for all databases.
[05:50.150 --> 05:55.670]  So this is the format of the CPF, it's 11 digits. The first
[05:57.750 --> 06:07.270]  eight digits are unique for you. The tenth digit here, the ninth digit here, it says the orange.
[06:07.270 --> 06:14.170]  So as I live in Rio de Janeiro, my number here is seven. If you live in Sao Paulo, it's six.
[06:14.170 --> 06:19.110]  The same occurs with the social security number, right? You guys have numbers splitted by regions.
[06:19.110 --> 06:26.510]  And the last two digits here are digits to verify if the first ones are right. So there's
[06:26.510 --> 06:33.130]  some sort of calculation that you sum, divide by two, do some math, and you figure out if the
[06:33.130 --> 06:42.410]  number is right or not. So if every single piece of information, you can get a good intel on it.
[06:42.410 --> 06:49.710]  Here we have an example of a bank in Brazil, that if you click on recover my password,
[06:49.710 --> 06:56.010]  and you put the CPF, if the CPF is not valid, or the user don't have an account on that bank,
[06:56.010 --> 07:01.790]  it returns an error. But if that user has an account in that bank, it returns success.
[07:02.250 --> 07:08.130]  So it's enough to me to know if somebody has an account in that bank, I can perhaps phishing him,
[07:08.130 --> 07:15.670]  or send a mission to him, or whatever. And here we have another example in another bank in Brazil,
[07:16.050 --> 07:22.330]  small bank, but if you know email and the CPF, you can figure it out if he has an account or not
[07:22.330 --> 07:30.410]  on that bank as well. So another really good source of information that we have back in Brazil,
[07:30.410 --> 07:37.750]  it's called PIX. And the PIX is a new system that we have like the last three years, I guess,
[07:38.130 --> 07:45.750]  but it's an instant payment system. Basically, you just have to know a key for someone that you want to pay,
[07:45.750 --> 07:51.790]  and you can have four kinds of keys. You can have the cell phone as a key, the CPF as a key,
[07:51.790 --> 07:59.310]  an email address as a key, and a random key that might be shared by a QR code. So these numbers
[07:59.310 --> 08:09.170]  are from July 2022, but we can see here that CPF has more than 100 million keys, cell phones has
[08:09.170 --> 08:17.870]  98 million keys, emails around 70 million keys, and back in Brazil we are only 200 million,
[08:17.870 --> 08:25.250]  214 million, and there are at least 470 million keys in CPF. So it's a really huge database.
[08:25.810 --> 08:37.270]  So what you can get with the CPF? If you do a PIX to pay someone, and in this example here I was
[08:37.270 --> 08:44.830]  getting the cab to go to the airport to come to Vegas, and I asked the guy the CPF, and he gave
[08:44.830 --> 08:53.650]  me the CPF, I paid him here just an example, just one cent, and it gives me the full name of him,
[08:53.650 --> 09:01.250]  here it is blacked out, but not only it gives me the full name, it also gives me the CPF,
[09:01.250 --> 09:07.750]  but I already know the CPF, right? But it gives me the bank account where the money is going to.
[09:08.690 --> 09:15.530]  With this bank account I would be able to go to another bank, try to recover his password,
[09:15.530 --> 09:23.110]  with his CPF, and then it brought me another two pieces of information, another two little
[09:23.110 --> 09:30.730]  breads, brought me the cell phone number and also the email number. But realize that not the full
[09:31.910 --> 09:39.150]  cell phone number and not the full email address, it has stars to hide information from me, right?
[09:39.150 --> 09:46.670]  Well, from the email we can see that the name of this guy was clever, and we can see that
[09:47.540 --> 09:55.930]  his email starts with C, and the other stars part here are the rest of his names,
[09:55.930 --> 10:01.690]  he also starts with D, so we can try to imagine what his email address is.
[10:02.290 --> 10:10.470]  But even if I didn't know that, we can keep searching for information. So I just saved
[10:10.470 --> 10:17.270]  this information on my database, and looking for his phone number, I figured it out. Well,
[10:17.270 --> 10:22.350]  if we have four digits here, back in Brazil all the cell phones start with nine, then have
[10:23.730 --> 10:29.070]  another nine digits there, but the last four numbers we already know, right? So it only
[10:29.770 --> 10:35.350]  gives us a thousand possibilities to try. Would it be hard to try or brute force a thousand
[10:35.350 --> 10:40.750]  possibilities however you want? Yeah, it would be, at least boring. But we can go to another
[10:41.650 --> 10:47.210]  cell phone provider and try to figure it out if he has an account on that cell phone provider,
[10:47.210 --> 10:54.290]  and it turns out that he has. And by checking on his CPF again as an input source,
[10:54.830 --> 10:59.930]  and trying to recover his password for that cell phone provider, it got me,
[10:59.930 --> 11:06.430]  how do you want to get your password? It's by SMS or email? Well, let's check out the SMS
[11:06.430 --> 11:14.350]  possibility, right? So it masks the four numbers in the middle, but I already knew the last
[11:14.930 --> 11:21.270]  four numbers, so I already know these two, they gave me the first two, now I only have
[11:21.930 --> 11:29.550]  99 possibilities to brute force, right? But there is a catch on this. There is also another
[11:29.550 --> 11:37.650]  website that tells you from which cell phone operator that number is. So if I go to that site
[11:37.650 --> 11:45.710]  and try to brute force like 91116497, it's just a cell phone from the cloud, he would say no,
[11:45.710 --> 11:50.690]  it's not, this cell phone doesn't exist. But if I try another number, and it's from
[11:50.690 --> 12:00.790]  the cloud, it's the cell phone operator, and by doing this, I can reduce these 99 possibilities
[12:00.790 --> 12:08.930]  to at least 25. And now it's feasible to call 25 numbers to figure out if it's his number, right?
[12:08.930 --> 12:18.790]  Things are getting easier. And by the email, if we check the email here,
[12:19.330 --> 12:27.070]  we can see that, well, we already know the CD and a lot of stars at ho, a lot of stars.com,
[12:27.070 --> 12:35.810]  but when we check on the cell phone providers, we already know the TLD, now it's hotmail.com,
[12:35.810 --> 12:43.270]  but not only this, it gives me the last letter here, the R, but not only the R is important
[12:43.270 --> 12:49.450]  here in the TLD, the matching number of stars is also important, because now I know that
[12:50.150 --> 12:57.710]  those stars, each star represents at least a letter, or a number. So I'm reducing the space
[12:57.710 --> 13:03.710]  to brute force for this kind of information. And we can look for leaks on emails that match
[13:03.710 --> 13:09.730]  that pattern, and it would be easier to find more information about him, right?
[13:09.730 --> 13:18.090]  So coming back to the electricity bill, I check in another endpoint on the same website, so
[13:18.910 --> 13:24.990]  if I can try to recover his client code, client code is basically how the company calls you,
[13:24.990 --> 13:33.130]  right? And to recover his client code, the first time that I put the CPF and click on proceed,
[13:33.130 --> 13:41.150]  it gives me five options of address, where he lives. All right, okay, so what I did was just
[13:41.150 --> 13:46.190]  refresh the page, and by refreshing the page, every time that I refresh the page, it gives
[13:46.190 --> 13:52.950]  five different, five new positions, but just one repeats. So trivial to figure out where he lives,
[13:52.950 --> 13:58.690]  right? Well, we can put this on the Google Maps and find out where he lives. Actually,
[13:58.690 --> 14:07.130]  not the true place here, I just put some mark on the map, but it's in this region where he lives,
[14:07.130 --> 14:13.950]  right? So yeah, now we have the CPF, we have the cell phone, we have the email address,
[14:13.950 --> 14:21.890]  or partial email address, and we also know where he lives. We can use all the kind of
[14:21.890 --> 14:27.270]  social information that we have. So here, I don't know if it happens the same here, but
[14:27.270 --> 14:35.730]  when you do your taxes, and the money sometimes has money to give you back, and we have a website
[14:35.730 --> 14:43.690]  for this. So if you put your CPF and your birth date, and fill in this gap here, it will return,
[14:43.690 --> 14:49.610]  okay, you have money to receive from the government, and which bank and agents we are
[14:49.610 --> 15:01.510]  going to put this. So I did this, through a leak, I found the birth date of this guy, and went to
[15:02.000 --> 15:09.490]  this website, and figured out that the agents that he receives was a predestined agent, it's a
[15:09.490 --> 15:16.250]  Brazilian bank, where the bank lives, and by looking at the Google Street Maps, I figured
[15:16.250 --> 15:22.350]  out it's a prime bank. And by being a prime bank, that means that he makes at least 10,000
[15:22.350 --> 15:30.890]  reais monthly. So now I also have some kind of idea how much money he makes, right. And fun
[15:30.890 --> 15:39.470]  thing is, it works not only websites. Back in Brazil, we have SMS bots, WhatsApp bots, so
[15:40.550 --> 15:45.590]  we can interact with those bots, and just provide some piece of information that you have, and we
[15:46.150 --> 15:52.530]  reply you with some information that you need. So I asked him, I asked this bot to get an
[15:52.530 --> 16:00.950]  energy, it's a gas company, to cook, not fuel, and I asked him, all right, can I give a second
[16:02.930 --> 16:09.190]  paper to pay, about his bill, and all right, give me your CPF, I already knew the CPF,
[16:09.190 --> 16:17.930]  and then he returns with a payment code, with the value of his account, of gas. So now I know
[16:17.930 --> 16:26.870]  that he, or not his wife, do not cook outside, because the value of the gas is not that much,
[16:26.870 --> 16:34.910]  it's enough for people to have hot water, and cook at home. So with those little pieces of
[16:34.910 --> 16:41.310]  information, you can start grabbing a much more bigger picture from your target, right?
[16:41.710 --> 16:49.570]  And sometimes, we have to look further, and this is another bank, back in Brazil, and if you provide
[16:49.570 --> 16:56.630]  the CPF, the website just does nothing, but if you look at the F12, and the network tools,
[16:56.630 --> 17:03.350]  and the return, we're going to be, not only the CPF, and if he is registered in the site,
[17:03.350 --> 17:10.570]  but also the full name of the people who is registered. And also there are some side effects,
[17:10.570 --> 17:15.670]  sometimes, yeah, some services, when you try to recover the email, you're going to send an email
[17:15.670 --> 17:22.410]  to your target, letting him know that he's being targeted by someone, and there's some kind of
[17:22.410 --> 17:29.470]  examples, but the main problem that I want to solve here, is if I only know just one piece of
[17:29.470 --> 17:35.230]  information about that target, how do I pivot and find other piece of information to get the
[17:35.230 --> 17:42.150]  whole cake, or to get the whole picture? So, when I start this, I start to catalog all those
[17:42.150 --> 17:50.150]  information, so the name of the website, the URL, if the URL has a capture or not, which kind of
[17:50.150 --> 17:56.350]  input I have to provide on this website, and which kind of returns to me.
[17:56.350 --> 18:04.950]  So, I decided to use YAML files because they're easy to write and to read, and one smart thing
[18:04.950 --> 18:12.290]  that I put here, it's input. Sometimes websites need end inputs, like you need to know the CPF,
[18:12.290 --> 18:16.950]  the birthdate, and the year, but sometimes you only need, like PIX, you only need to know one
[18:16.950 --> 18:23.950]  information of those. And so, those websites that only need one information, it's the OR thing,
[18:23.950 --> 18:31.250]  but you can mix both. So, this is the kind of end-to-end relationship between the input data.
[18:31.830 --> 18:36.370]  And this is what this website returns, right? It returns the full name, the bank,
[18:36.370 --> 18:42.610]  the banking agents, and the taxes result, if it has money to come back.
[18:43.410 --> 18:51.710]  So, with this information, I graphed this, I put this in a graph, and created a software that I'm
[18:51.710 --> 18:58.410]  calling Browse, it's like Brazilian open source information, but this kind of trick can be used
[18:58.410 --> 19:04.950]  by anyone in any place, right? Just try to recover a button, design the YAML for yourself,
[19:04.950 --> 19:16.720]  and use this tool to figure it out. So, here we have a show of the help here in the tools. So,
[19:16.720 --> 19:24.200]  you put a path on which data source you have, the "-sf", show you fields that you have as input.
[19:24.920 --> 19:30.860]  And what I know, what I know is basically, if I only know the CPF of someone, I put the here CPF,
[19:30.860 --> 19:37.140]  but if I know CPF in birthdates, I put CPF in birthdate, and we'll transverse the graph,
[19:37.140 --> 19:43.920]  figuring out which kind of information I have enough for OR, and get this field, or if I have
[19:43.920 --> 19:50.080]  to have more information about this target to get those information, right? And I also put an
[19:50.080 --> 20:00.380]  option to export to Neo4j, because, well, it's better to see graphics, right? And just by loading
[20:00.380 --> 20:07.660]  Brazilian data sources that is available right now on the GitHub, actually it's not publicized yet,
[20:07.660 --> 20:14.660]  I have to come back to Brazil and put my USB-C token to make the project public, but I will do
[20:14.660 --> 20:22.740]  on Monday. But here, I will turn available to everybody 17 sources of information, but I have
[20:22.740 --> 20:28.780]  at least 40 in my private database. And by just looking for which fields you have to figure out
[20:28.780 --> 20:35.020]  for inputs, now here we have the CPF cell phone, UF is state, father name, birthdate, full name,
[20:35.840 --> 20:43.880]  SNH is the driver license, mother name. I parse all those information and put it in a graph,
[20:43.880 --> 20:49.860]  so this is the Neo4j graph for this, for all those sources that I have.
[20:51.680 --> 20:59.320]  But I have a little damn time, so I record it, just because I don't want to play with the gods
[20:59.320 --> 21:07.060]  of the demo, right? Well, this is my fourth time speaking in Vega, so I won't try my luck.
[21:14.180 --> 21:25.460]  So, basically, you can run the script, you have the DS as a path for data source,
[21:25.460 --> 21:30.380]  SSF to show all the fields that we have, the graph, this first graph here, it's like,
[21:30.380 --> 21:38.020]  will pop up in image, and I created a smaller version for this demo, just to show up
[21:38.020 --> 21:48.390]  the capabilities of this project, right? So, this is all the Brazil data source that I have,
[21:48.390 --> 21:57.930]  now it's only 13 public, and I have changed for temporary, and with just five sources,
[21:57.930 --> 22:07.450]  so that's what's going to happen with this demo, right? So, let's take a look at those data sources
[22:07.450 --> 22:20.990]  that we are using in this demo. So, it's cell phone operator, PIX, company energy,
[22:20.990 --> 22:32.990]  recover number client, and another one that I... So, let's figure it out, which fields do we have
[22:32.990 --> 22:39.630]  to have inputs to make this work? So, from these five sources, the input fields are CPF, cell phone,
[22:39.630 --> 23:00.870]  email, year, CNPJ, and birthday. So, we can graph it, that's called PNG, we'll just split a PNG,
[23:04.070 --> 23:10.850]  right? And it shows the relationship between the input nodes and the return nodes,
[23:10.850 --> 23:16.950]  it's like really small, but you can zoom in and get this information, so,
[23:16.950 --> 23:25.090]  zoom out, and just checking this relationship here from two fields are the PIX, so, if I have
[23:25.090 --> 23:32.610]  the CPF, I have to go to the PIX to figure it out which bank it has, to get the election
[23:32.610 --> 23:42.630]  biometry, if the guy has biometry collected to vote, I know which fields I have to have,
[23:42.630 --> 23:50.150]  and this kind of stuff, right? But the most important here is with which information can I
[23:50.150 --> 23:59.250]  can get the rest, right? So, this is the option that I call what I know, and if I only know
[23:59.250 --> 24:05.350]  about the CPF of this person, of this target, these are the information that I can get back,
[24:05.350 --> 24:10.490]  the full name, full address, partial CPF, election status, bank account, election biometry collected,
[24:10.490 --> 24:18.930]  and his energy company client number. But if I only know the birth date,
[24:18.930 --> 24:24.510]  the only thing that I can reach is the bank agents and the full name of his, right?
[24:24.850 --> 24:40.720]  And if I know the CPF and the birth date, I can reach much more information, right?
[24:46.080 --> 25:13.290]  So, this was the first one. Here's the second one, showing the Neo4j option, so you have to
[25:13.290 --> 25:23.290]  pass a config for the Neo4j, and it will put on the Neo4j, and then you can carry as much
[25:23.290 --> 25:29.970]  information that you want. On the Neo4j, I choose map this relationship between AND and OR,
[25:29.970 --> 25:38.070]  just to get easier to make carries about those nodes. So, with the CPF, only the CPF,
[25:38.070 --> 25:45.170]  I can get the election, the election status, the full address, and this kind of stuff. And
[25:45.170 --> 25:54.810]  I also can get the partial CPF, and makes easier to carry information using the Neo4j stuff, right?
[25:57.050 --> 26:01.550]  So, with the cell phone, I can figure it out, the operator of the cell phone,
[26:01.550 --> 26:05.130]  or with the cell phone, I also can figure it out the bank accounts, because the peaks,
[26:05.130 --> 26:21.030]  that source, and things go on like this, right? So, as a future work,
[26:21.030 --> 26:27.170]  one thing that I felt that I have to improve on this project is to uniform the input fields.
[26:27.230 --> 26:33.550]  As you see, I made the code in English, but there are some fields that make more sense in Portuguese.
[26:34.470 --> 26:38.630]  But I have to figure out a way to uniform those input and output fields
[26:38.630 --> 26:45.710]  to avoid confusions. Also, I add some regex on this, add more sources, so you all are
[26:47.170 --> 26:51.410]  invited to contribute with this project. You can just create the sources, United States,
[26:51.410 --> 26:58.010]  sources of your country, whatever, and submit your mail files there. One thing that I also
[26:58.010 --> 27:03.830]  figured out that's kind of important is to add some context on those filters. For instance,
[27:03.830 --> 27:09.190]  if I know the CPF, it's from the state of Sao Paulo, I just want to look at the sources from
[27:09.190 --> 27:14.470]  the state of Sao Paulo. So, the electricity company back in Rio is not interested enough
[27:14.470 --> 27:19.390]  for this, right? And also add some browse information. So, if you remember the first
[27:19.390 --> 27:24.390]  email that I showed you guys has some XPath, because I already started playing with some
[27:24.950 --> 27:30.090]  browsing automation, but it's not done, so it's a future work in progress.
[27:31.790 --> 27:37.750]  And for conclusion, user interface and user experience must be taken account for security.
[27:37.750 --> 27:44.890]  So, basically this problem is because security teams do not interact with user experience,
[27:44.890 --> 27:51.630]  user interface, and there isn't some sort of norm or regulation on this. So, maybe we have to
[27:51.630 --> 27:58.370]  figure out a way to recall the passwords and get information from users without showing that much
[27:58.370 --> 28:04.130]  of information. So, until there is some kind of regulation or norm or best practice guide,
[28:04.130 --> 28:09.610]  anything like this, we still have room to exploit this kind of fragility, right?
[28:09.790 --> 28:15.830]  And the same can be applicable to several countries and different contexts. So, go for it,
[28:15.830 --> 28:21.670]  download the code, create your own sources, start to catalog. Like these 40 sources that I have,
[28:21.670 --> 28:29.290]  I took like... it's not my day-to-day job, but I do it for the last two years, cataloging,
[28:29.290 --> 28:32.930]  oh, just hit another website, figured it out, okay, this is the information that I need,
[28:32.930 --> 28:41.050]  this is from the output, save it on the EML, and then let it there. So, that's it, guys.
[28:41.150 --> 28:44.810]  That's all, folks. Well, thanks. If you have any questions,
[28:53.310 --> 28:59.250]  so, the code and data sources will be available at GitHub. And a special thanks for Corvolino,
[28:59.330 --> 29:05.210]  a guy who helped me to test, Borghini, Sierra, and Motoro, who also helped me with the tool,
[29:05.210 --> 29:07.050]  right? Thank you very much, guys.