Skip to content
OATmeal on the Universal Cereal Bus: Exploiting Android phones over USB
Summary
Recently, there has been some attention around the topic of physical attacks on smartphones, where an attacker with the ability to connect USB devices to a locked phone attempts to gain access to the data stored on the device. This blogpost describes how such an attack could have been performed against Android devices (tested with a Pixel 2).
- Published
- Collected
Related coverage
research ·
projectzero.google
Exploiting NVMAP to escape the Chrome sandbox - CVE-2014-5332
A Google Project Zero post exploiting a bug in NVIDIA's NVMAP driver (CVE-2014-5332) to escape the Chrome for Android sandbox.
blog ·
projectzero.google
MTE As Implemented, Part 1: Implementation Testing
Part 1 of the MTE As Implemented series, testing real-world implementations of Arm Memory Tagging Extension to establish a correctness baseline for later mitigation analysis.
blog ·
projectzero.google
Summary: MTE As Implemented
The closing summary of the MTE As Implemented series, assessing how Arm Memory Tagging Extension behaves in real deployments and its practical effect on memory corruption exploitation.
blog ·
projectzero.google
Zooming in on Zero-click Exploits
.post-body{ul.lst-kix_ef7dug197aaw-4{list-style-type:none}ul.lst-kix_ef7dug197aaw-3{list-style-type:none}.lst-kix_ef7dug197aaw-0>li:before{content:"- "}ul.lst-kix_ef7dug197aaw-2{list-style-type:none}ul.lst-kix_ef7dug197aaw-1{list-style-type:none}.lst-kix_ef7dug197aaw-1>li:before{content:"- "}ul.lst-kix_ef7dug197aaw-8{list-style-type:none}ul.lst-kix_ef7dug197aaw-7{list-style-type:none}ul.lst-kix_ef7dug197aaw-6{list-style-type:none}ul.lst-kix_ef7dug197aaw-5{list-style-type:none}ul.lst-kix_ef7dug197aaw-0{list-style-type:none}.lst-kix_ef7dug197aaw-7>li:before{content:"- "}.lst-kix_ef7dug197aaw-6>li:before{content:"- "}.lst-kix_ef7dug197aaw-8>li:before{content:"- "}.lst-kix_ef7dug197aaw-5>li:before{content:"- "}.lst-kix_ef7dug197aaw-3>li:before{content:"- "}.lst-kix_ef7dug197aaw-2>li:before{content:"- "}.lst-kix_ef7dug197aaw-4>li:before{content:"- "}ol{margin:0;padding:0}table td,table th{padding:0}.c7{background-color:#ffffff;color:#222222;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c18{background-color:#ffffff;padding-top:0pt;padding-bottom:0pt;line-height:1.2222222222222223;orphans:2;widows:2;text-align:left}.c10{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:16pt;font-family:"Arial";font-style:normal}.c13{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c2{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c14{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:13.5pt;font-family:"Arial";font-style:normal}.c0{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c3{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c15{color:#000000;font-weight:700;text-decoration:none;vertical-align:baseline;font-size:13.5pt;font-family:"Arial";font-style:normal}.c1{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c17{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c9{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c16{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c6{font-weight:400;font-family:"Courier New"}.c8{color:inherit;text-decoration:inherit}.c4{border:1px solid black;margin:5px}.c21{font-size:13.5pt;font-weight:700}.c11{background-color:#ffffff;color:#222222}.c20{background-color:#ffffff}.c19{margin-left:36pt}.c12{height:11pt}.c5{text-indent:36pt}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Natalie Silvanovich, Project Zero
blog ·
projectzero.google
This shouldn't have happened: A vulnerability postmortem
/* cyrillic */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOEDuSfQZQ.woff2) format('woff2'); unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116; } /* hebrew */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOECOSfQZQ.woff2) format('woff2'); unicode-range: U+0307-0308, U+0590-05FF, U+200C-2010, U+20AA, U+25CC, U+FB1D-FB4F; } /* vietnamese */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOEBeSfQZQ.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB; } /* latin-ext */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOEBOSfQZQ.woff2) format('woff2'); unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF; } /* latin */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOECuSf.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } /* latin */ @font-face { font-family: 'Consolas'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/l/font?kit=X7nm4bA-A_-9jbjWaza9xMk&skey=3d1eb1871fcc58a1&v=v20) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } @import url('https://themes.googleusercontent.com/fonts/css?kit=t66UaDGGO9uRFa9A_n0Ge4kPz49mG1-u2NJpkhDAP5E'); .post-body{.lst-kix_q4elz23jmthh-5>li{counter-increment:lst-ctn-kix_q4elz23jmthh-5}ol.lst-kix_q4elz23jmthh-6.start{counter-reset:lst-ctn-kix_q4elz23jmthh-6 0}ul.lst-kix_wy7koemfbmv1-3{list-style-type:none}ul.lst-kix_wy7koemfbmv1-2{list-style-type:none}ul.lst-kix_wy7koemfbmv1-5{list-style-type:none}.lst-kix_2hgb22nra90i-8>li:before{content:"\0025a0 "}ul.lst-kix_wy7koemfbmv1-4{list-style-type:none}ul.lst-kix_wy7koemfbmv1-1{list-style-type:none}.lst-kix_2hgb22nra90i-7>li:before{content:"\0025cb "}ul.lst-kix_wy7koemfbmv1-0{list-style-type:none}ol.lst-kix_q4elz23jmthh-0.start{counter-reset:lst-ctn-kix_q4elz23jmthh-0 0}.lst-kix_2hgb22nra90i-4>li:before{content:"\0025cb "}.lst-kix_2hgb22nra90i-6>li:before{content:"\0025cf "}.lst-kix_2hgb22nra90i-5>li:before{content:"\0025a0 "}ul.lst-kix_z8xtsan2wa5s-5{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-6{list-style-type:none}.lst-kix_q4elz23jmthh-7>li{counter-increment:lst-ctn-kix_q4elz23jmthh-7}ul.lst-kix_z8xtsan2wa5s-7{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-8{list-style-type:none}.lst-kix_2hgb22nra90i-0>li:before{content:"\0025cf "}.lst-kix_2hgb22nra90i-2>li:before{content:"\0025a0 "}.lst-kix_2hgb22nra90i-3>li:before{content:"\0025cf "}ul.lst-kix_z8xtsan2wa5s-0{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-1{list-style-type:none}ul.lst-kix_wy7koemfbmv1-7{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-2{list-style-type:none}ul.lst-kix_wy7koemfbmv1-6{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-3{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-4{list-style-type:none}.lst-kix_2hgb22nra90i-1>li:before{content:"\0025cb "}ul.lst-kix_wy7koemfbmv1-8{list-style-type:none}.lst-kix_q4elz23jmthh-5>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-5,lower-roman) ". "}.lst-kix_q4elz23jmthh-6>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-6,decimal) ". "}.lst-kix_q4elz23jmthh-4>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-4,lower-latin) ". "}.lst-kix_q4elz23jmthh-8>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-8,lower-roman) ". "}.lst-kix_oetzaqvyxxoa-0>li:before{content:"\0025cf "}.lst-kix_oetzaqvyxxoa-1>li:before{content:"\0025cb "}.lst-kix_oetzaqvyxxoa-2>li:before{content:"\0025a0 "}.lst-kix_oetzaqvyxxoa-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-7>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-7,lower-latin) ". "}.lst-kix_q4elz23jmthh-0>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-0,decimal) ". "}.lst-kix_q4elz23jmthh-1>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-1,lower-latin) ". "}.lst-kix_q4elz23jmthh-2>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-2,lower-roman) ". "}.lst-kix_q4elz23jmthh-3>li{counter-increment:lst-ctn-kix_q4elz23jmthh-3}.lst-kix_q4elz23jmthh-3>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-3,decimal) ". "}ul.lst-kix_ohd9cwgi2ci1-5{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-4{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-7{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-6{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-8{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-2{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-3{list-style-type:none}.lst-kix_oetzaqvyxxoa-6>li:before{content:"\0025cf "}.lst-kix_oetzaqvyxxoa-7>li:before{content:"\0025cb "}ul.lst-kix_ugjdqlaeq7aq-0{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-1{list-style-type:none}ol.lst-kix_q4elz23jmthh-5.start{counter-reset:lst-ctn-kix_q4elz23jmthh-5 0}ul.lst-kix_ugjdqlaeq7aq-6{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-7{list-style-type:none}.lst-kix_oetzaqvyxxoa-4>li:before{content:"\0025cb "}.lst-kix_oetzaqvyxxoa-5>li:before{content:"\0025a0 "}.lst-kix_oetzaqvyxxoa-8>li:before{content:"\0025a0 "}ul.lst-kix_ugjdqlaeq7aq-4{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-5{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-8{list-style-type:none}.lst-kix_x7i5vtjupm2f-2>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-6>li:before{content:"\0025cf "}ul.lst-kix_2fd9br43vo52-4{list-style-type:none}ul.lst-kix_2fd9br43vo52-3{list-style-type:none}.lst-kix_ohd9cwgi2ci1-3>li:before{content:"\0025cf "}ul.lst-kix_2fd9br43vo52-6{list-style-type:none}ul.lst-kix_2fd9br43vo52-5{list-style-type:none}ul.lst-kix_2fd9br43vo52-8{list-style-type:none}.lst-kix_fvn7czyjg1wz-2>li:before{content:"\0025a0 "}ul.lst-kix_2fd9br43vo52-7{list-style-type:none}.lst-kix_x7i5vtjupm2f-4>li:before{content:"\0025cb "}.lst-kix_2fd9br43vo52-3>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-4>li:before{content:"\0025cb "}ul.lst-kix_2fd9br43vo52-0{list-style-type:none}.lst-kix_2fd9br43vo52-5>li:before{content:"\0025a0 "}ul.lst-kix_2fd9br43vo52-2{list-style-type:none}ul.lst-kix_2fd9br43vo52-1{list-style-type:none}.lst-kix_4idwybng3hbx-2>li:before{content:"\0025a0 "}.lst-kix_2fd9br43vo52-7>li:before{content:"\0025cb "}.lst-kix_fvn7czyjg1wz-8>li:before{content:"\0025a0 "}.lst-kix_ohd9cwgi2ci1-1>li:before{content:"\0025cb "}.lst-kix_4idwybng3hbx-0>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-6>li:before{content:"\0025cf "}.lst-kix_x7i5vtjupm2f-0>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-8>li:before{content:"\0025a0 "}ul.lst-kix_fvn7czyjg1wz-2{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-1{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-0{list-style-type:none}.lst-kix_wy7koemfbmv1-4>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-6>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-7.start{counter-reset:lst-ctn-kix_q4elz23jmthh-7 0}.lst-kix_wy7koemfbmv1-0>li:before{content:"\0025cf "}.lst-kix_wy7koemfbmv1-2>li:before{content:"\0025a0 "}.lst-kix_ugjdqlaeq7aq-0>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-5>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-7>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-1>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-2>li:before{content:"\0025a0 "}ul.lst-kix_2hgb22nra90i-0{list-style-type:none}ul.lst-kix_2hgb22nra90i-1{list-style-type:none}ul.lst-kix_2hgb22nra90i-2{list-style-type:none}ul.lst-kix_2hgb22nra90i-3{list-style-type:none}.lst-kix_fvn7czyjg1wz-0>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-4>li:before{content:"\0025cb "}ul.lst-kix_2hgb22nra90i-4{list-style-type:none}ul.lst-kix_2hgb22nra90i-5{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-8{list-style-type:none}ul.lst-kix_2hgb22nra90i-6{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-7{list-style-type:none}ul.lst-kix_2hgb22nra90i-7{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-6{list-style-type:none}ul.lst-kix_2hgb22nra90i-8{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-5{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-4{list-style-type:none}.lst-kix_x7i5vtjupm2f-8>li:before{content:"\0025a0 "}ul.lst-kix_fvn7czyjg1wz-3{list-style-type:none}ul.lst-kix_81cegzboe9ky-8{list-style-type:none}ul.lst-kix_81cegzboe9ky-5{list-style-type:none}ul.lst-kix_81cegzboe9ky-4{list-style-type:none}ul.lst-kix_81cegzboe9ky-7{list-style-type:none}ul.lst-kix_81cegzboe9ky-6{list-style-type:none}ol.lst-kix_q4elz23jmthh-8.start{counter-reset:lst-ctn-kix_q4elz23jmthh-8 0}ul.lst-kix_oetzaqvyxxoa-2{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-3{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-0{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-1{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-6{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-7{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-4{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-5{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-8{list-style-type:none}ul.lst-kix_4idwybng3hbx-5{list-style-type:none}ul.lst-kix_4idwybng3hbx-4{list-style-type:none}.lst-kix_81cegzboe9ky-2>li:before{content:"\0025a0 "}.lst-kix_81cegzboe9ky-4>li:before{content:"\0025cb "}ul.lst-kix_4idwybng3hbx-7{list-style-type:none}ul.lst-kix_4idwybng3hbx-6{list-style-type:none}.lst-kix_wy7koemfbmv1-6>li:before{content:"\0025cf "}ul.lst-kix_4idwybng3hbx-8{list-style-type:none}.lst-kix_2gk0zovl15u8-4>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-0>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-6>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-8>li:before{content:"\0025a0 "}.lst-kix_wy7koemfbmv1-8>li:before{content:"\0025a0 "}ul.lst-kix_4idwybng3hbx-1{list-style-type:none}ul.lst-kix_4idwybng3hbx-0{list-style-type:none}ul.lst-kix_4idwybng3hbx-3{list-style-type:none}.lst-kix_2gk0zovl15u8-6>li:before{content:"\0025cf "}ul.lst-kix_4idwybng3hbx-2{list-style-type:none}.lst-kix_prwgb47nvxz6-8>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-8>li:before{content:"\0025a0 "}ul.lst-kix_81cegzboe9ky-1{list-style-type:none}ul.lst-kix_81cegzboe9ky-0{list-style-type:none}ul.lst-kix_81cegzboe9ky-3{list-style-type:none}ul.lst-kix_81cegzboe9ky-2{list-style-type:none}.lst-kix_z8xtsan2wa5s-3>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-2>li:before{content:"\0025a0 "}.lst-kix_z8xtsan2wa5s-4>li:before{content:"\0025cb "}.lst-kix_prwgb47nvxz6-0>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-1>li:before{content:"\0025cb "}.lst-kix_z8xtsan2wa5s-5>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-1>li:before{content:"\0025cb "}ol.lst-kix_q4elz23jmthh-4{list-style-type:none}ol.lst-kix_q4elz23jmthh-3{list-style-type:none}ol.lst-kix_q4elz23jmthh-3.start{counter-reset:lst-ctn-kix_q4elz23jmthh-3 0}ol.lst-kix_q4elz23jmthh-6{list-style-type:none}ol.lst-kix_q4elz23jmthh-5{list-style-type:none}ol.lst-kix_q4elz23jmthh-0{list-style-type:none}ol.lst-kix_q4elz23jmthh-2{list-style-type:none}ol.lst-kix_q4elz23jmthh-1{list-style-type:none}.lst-kix_prwgb47nvxz6-6>li:before{content:"\0025cf "}.lst-kix_prwgb47nvxz6-5>li:before{content:"\0025a0 "}.lst-kix_z8xtsan2wa5s-7>li:before{content:"\0025cb "}.lst-kix_prwgb47nvxz6-3>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-6>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-8>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-2>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-4>li:before{content:"\0025cb "}.lst-kix_2gk0zovl15u8-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-6>li{counter-increment:lst-ctn-kix_q4elz23jmthh-6}.lst-kix_2gk0zovl15u8-2>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-1>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-8>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-6>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-7>li:before{content:"\0025cb "}.lst-kix_q4elz23jmthh-4>li{counter-increment:lst-ctn-kix_q4elz23jmthh-4}ol.lst-kix_q4elz23jmthh-8{list-style-type:none}ol.lst-kix_q4elz23jmthh-7{list-style-type:none}.lst-kix_z8xtsan2wa5s-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-2>li:before{content:"\0025a0 "}.lst-kix_cw1yal3teuur-3>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-4.start{counter-reset:lst-ctn-kix_q4elz23jmthh-4 0}.lst-kix_cw1yal3teuur-1>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-4>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-5>li:before{content:"\0025a0 "}.lst-kix_4idwybng3hbx-6>li:before{content:"\0025cf "}.lst-kix_4idwybng3hbx-5>li:before{content:"\0025a0 "}.lst-kix_4idwybng3hbx-7>li:before{content:"\0025cb "}.lst-kix_q4elz23jmthh-0>li{counter-increment:lst-ctn-kix_q4elz23jmthh-0}.lst-kix_4idwybng3hbx-3>li:before{content:"\0025cf "}.lst-kix_4idwybng3hbx-4>li:before{content:"\0025cb "}.lst-kix_4idwybng3hbx-8>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-5>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-7>li:before{content:"\0025cb "}.lst-kix_x7i5vtjupm2f-3>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-4>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-2>li:before{content:"\0025a0 "}.lst-kix_fvn7czyjg1wz-3>li:before{content:"\0025cf "}ul.lst-kix_x7i5vtjupm2f-8{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-1{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-4{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-0{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-5{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-3{list-style-type:none}.lst-kix_2fd9br43vo52-4>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-6{list-style-type:none}.lst-kix_fvn7czyjg1wz-5>li:before{content:"\0025a0 "}ul.lst-kix_ohd9cwgi2ci1-2{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-7{list-style-type:none}.lst-kix_ohd9cwgi2ci1-2>li:before{content:"\0025a0 "}ul.lst-kix_x7i5vtjupm2f-0{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-1{list-style-type:none}ul.lst-kix_prwgb47nvxz6-8{list-style-type:none}.lst-kix_4idwybng3hbx-1>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-2{list-style-type:none}.lst-kix_x7i5vtjupm2f-1>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-3{list-style-type:none}.lst-kix_ohd9cwgi2ci1-0>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-6>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-7>li:before{content:"\0025cb "}.lst-kix_wy7koemfbmv1-5>li:before{content:"\0025a0 "}ul.lst-kix_prwgb47nvxz6-2{list-style-type:none}ul.lst-kix_prwgb47nvxz6-3{list-style-type:none}ul.lst-kix_prwgb47nvxz6-0{list-style-type:none}ul.lst-kix_prwgb47nvxz6-1{list-style-type:none}ul.lst-kix_prwgb47nvxz6-6{list-style-type:none}ul.lst-kix_prwgb47nvxz6-7{list-style-type:none}ul.lst-kix_prwgb47nvxz6-4{list-style-type:none}ul.lst-kix_prwgb47nvxz6-5{list-style-type:none}.lst-kix_wy7koemfbmv1-3>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-7>li:before{content:"\0025cb "}.lst-kix_wy7koemfbmv1-1>li:before{content:"\0025cb "}.lst-kix_ohd9cwgi2ci1-6>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-1>li:before{content:"\0025cb "}.lst-kix_2fd9br43vo52-0>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-1>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-5>li:before{content:"\0025a0 "}.lst-kix_ugjdqlaeq7aq-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-1>li{counter-increment:lst-ctn-kix_q4elz23jmthh-1}.lst-kix_ohd9cwgi2ci1-8>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-1.start{counter-reset:lst-ctn-kix_q4elz23jmthh-1 0}.lst-kix_q4elz23jmthh-8>li{counter-increment:lst-ctn-kix_q4elz23jmthh-8}.lst-kix_q4elz23jmthh-2>li{counter-increment:lst-ctn-kix_q4elz23jmthh-2}.lst-kix_81cegzboe9ky-3>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-1>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-5>li:before{content:"\0025a0 "}.lst-kix_2fd9br43vo52-8>li:before{content:"\0025a0 "}.lst-kix_wy7koemfbmv1-7>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-7>li:before{content:"\0025cb "}.lst-kix_2gk0zovl15u8-5>li:before{content:"\0025a0 "}ul.lst-kix_2gk0zovl15u8-0{list-style-type:none}ul.lst-kix_2gk0zovl15u8-2{list-style-type:none}.lst-kix_2gk0zovl15u8-7>li:before{content:"\0025cb "}ul.lst-kix_2gk0zovl15u8-1{list-style-type:none}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ul.lst-kix_2gk0zovl15u8-4{list-style-type:none}ul.lst-kix_2gk0zovl15u8-3{list-style-type:none}ul.lst-kix_cw1yal3teuur-5{list-style-type:none}.lst-kix_prwgb47nvxz6-7>li:before{content:"\0025cb "}ul.lst-kix_2gk0zovl15u8-6{list-style-type:none}ul.lst-kix_cw1yal3teuur-4{list-style-type:none}ul.lst-kix_2gk0zovl15u8-5{list-style-type:none}ul.lst-kix_cw1yal3teuur-7{list-style-type:none}ul.lst-kix_2gk0zovl15u8-8{list-style-type:none}ul.lst-kix_cw1yal3teuur-6{list-style-type:none}ul.lst-kix_2gk0zovl15u8-7{list-style-type:none}ul.lst-kix_cw1yal3teuur-8{list-style-type:none}ul.lst-kix_cw1yal3teuur-1{list-style-type:none}ol.lst-kix_q4elz23jmthh-2.start{counter-reset:lst-ctn-kix_q4elz23jmthh-2 0}ul.lst-kix_cw1yal3teuur-0{list-style-type:none}ul.lst-kix_cw1yal3teuur-3{list-style-type:none}ul.lst-kix_cw1yal3teuur-2{list-style-type:none}ol{margin:0;padding:0}table td,table th{padding:0}.c15{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c6{color:#000000;font-weight:700;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:italic}.c2{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c31{background-color:#ffffff;padding-top:0pt;padding-bottom:0pt;line-height:1.3;text-align:left;height:11pt}.c13{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c19{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#009900;font-weight:400}.c34{background-color:#ffffff;padding-top:0pt;padding-bottom:0pt;line-height:1.3;text-align:left}.c12{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#993333;font-weight:400}.c1{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#212529;font-weight:400}.c45{color:#333333;text-decoration:none;vertical-align:baseline;font-size:30pt;font-family:"Amatic SC"}.c7{font-size:8pt;font-family:Consolas,"Courier New";color:#333333;font-weight:400}.c4{margin-left:36pt;border-spacing:0;border-collapse:collapse;margin-right:auto}.c14{border-spacing:0;border-collapse:collapse;margin-right:auto}.c26{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c11{color:#000000;font-weight:400;font-size:11pt;font-family:"Arial"}.c3{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c10{font-size:8pt;font-family:Consolas,"Courier New";color:#0000ff;font-weight:400}.c40{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:center}.c24{color:#000000;font-weight:700;font-size:11pt;font-family:"Arial"}.c0{font-size:9pt;font-family:Consolas,"Courier New";color:#333333;font-weight:400}.c18{font-size:8pt;font-family:Consolas,"Courier New";color:#008080;font-weight:400}.c5{font-size:9pt;font-family:Consolas,"Courier New";color:#0000ff;font-weight:400}.c30{color:#000000;font-weight:400;font-size:10pt;font-family:"Arial"}.c42{background-color:#ffffff;font-size:8pt;color:#b1b100}.c47{font-weight:400;font-size:8pt;font-family:"Arial"}.c28{background-color:#ffffff;font-size:8pt;color:#000066}.c38{background-color:#ffffff;font-size:8pt;color:#ff0000}.c23{background-color:#ffffff;font-size:8pt;color:#339933}.c8{text-decoration:none;vertical-align:baseline;font-style:normal}.c50{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c46{text-decoration:none;vertical-align:baseline;font-style:italic}.c51{background-color:#ffffff;font-size:8pt;color:#0000dd}.c9{color:inherit;text-decoration:inherit}.c27{margin-left:36pt;padding-left:0pt}.c17{padding:0;margin:0}.c22{font-size:9pt;color:#008000}.c21{font-weight:400;font-family:Consolas,"Courier New"}.c33{orphans:2;widows:2}.c44{width:33%;height:1px}.c35{font-weight:400;font-style:italic}.c48{font-size:8pt;color:#8b0000}.c29{height:0pt}.c39{font-size:11pt}.c32{font-weight:700}.c41{font-size:10pt}.c20{vertical-align:super}.c49{height:11pt}.c36{color:#000000}.c16{page-break-after:avoid}.c37{font-size:5pt}.c43{margin-left:36pt}.c25{font-size:9pt}.title{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#000000;font-size:10pt;padding-bottom:0pt;font-family:"Arial";line-height:1.0;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Tavis Ormandy, Project Zero
blog ·
projectzero.google
Using Kerberos for Authentication Relay Attacks
.post-body{ol.lst-kix_d25vxsk234hv-6{list-style-type:none}.lst-kix_wkcrlfh2qk3l-7>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-7}.lst-kix_i2wckd3yhfhe-0>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-0}ol.lst-kix_i2wckd3yhfhe-5.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-5 0}ol.lst-kix_d25vxsk234hv-5{list-style-type:none}ol.lst-kix_d25vxsk234hv-4{list-style-type:none}ol.lst-kix_jp16emg17n48-2.start{counter-reset:lst-ctn-kix_jp16emg17n48-2 0}ol.lst-kix_d25vxsk234hv-3{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-8{list-style-type:none}ol.lst-kix_d25vxsk234hv-2{list-style-type:none}ol.lst-kix_d25vxsk234hv-3.start{counter-reset:lst-ctn-kix_d25vxsk234hv-3 0}ol.lst-kix_d25vxsk234hv-1{list-style-type:none}ol.lst-kix_d25vxsk234hv-0{list-style-type:none}.lst-kix_d25vxsk234hv-4>li{counter-increment:lst-ctn-kix_d25vxsk234hv-4}.lst-kix_jp16emg17n48-8>li{counter-increment:lst-ctn-kix_jp16emg17n48-8}ul.lst-kix_fmj6vk2ylkib-0{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-1{list-style-type:none}ol.lst-kix_d25vxsk234hv-6.start{counter-reset:lst-ctn-kix_d25vxsk234hv-6 0}ol.lst-kix_i2wckd3yhfhe-4{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-8{list-style-type:none}.lst-kix_wkcrlfh2qk3l-8>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-8}ol.lst-kix_i2wckd3yhfhe-5{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-6{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-6{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-7{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-7{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-0{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-4{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-1{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-5{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-2{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-2{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-3{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-3{list-style-type:none}.lst-kix_2yktnm17nyl7-2>li:before{content:"\0025a0 "}.lst-kix_2yktnm17nyl7-3>li:before{content:"\0025cf "}ul.lst-kix_2yktnm17nyl7-8{list-style-type:none}ul.lst-kix_2yktnm17nyl7-7{list-style-type:none}ul.lst-kix_2yktnm17nyl7-6{list-style-type:none}.lst-kix_d25vxsk234hv-2>li{counter-increment:lst-ctn-kix_d25vxsk234hv-2}.lst-kix_2yktnm17nyl7-1>li:before{content:"\0025cb "}.lst-kix_d25vxsk234hv-5>li{counter-increment:lst-ctn-kix_d25vxsk234hv-5}.lst-kix_jp16emg17n48-7>li{counter-increment:lst-ctn-kix_jp16emg17n48-7}ol.lst-kix_jp16emg17n48-8.start{counter-reset:lst-ctn-kix_jp16emg17n48-8 0}ol.lst-kix_d25vxsk234hv-0.start{counter-reset:lst-ctn-kix_d25vxsk234hv-0 0}.lst-kix_2yktnm17nyl7-0>li:before{content:"\0025cf "}.lst-kix_jp16emg17n48-4>li:before{content:"(" counter(lst-ctn-kix_jp16emg17n48-4,lower-latin) ") "}ol.lst-kix_wkcrlfh2qk3l-6.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-6 0}.lst-kix_jp16emg17n48-3>li:before{content:"(" counter(lst-ctn-kix_jp16emg17n48-3,decimal) ") "}.lst-kix_jp16emg17n48-5>li:before{content:"(" counter(lst-ctn-kix_jp16emg17n48-5,lower-roman) ") "}ul.lst-kix_2yktnm17nyl7-1{list-style-type:none}.lst-kix_jp16emg17n48-0>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-0,decimal) ") "}ul.lst-kix_2yktnm17nyl7-0{list-style-type:none}.lst-kix_jp16emg17n48-1>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-1,lower-latin) ") "}ul.lst-kix_2yktnm17nyl7-5{list-style-type:none}.lst-kix_jp16emg17n48-2>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-2,lower-roman) ") "}.lst-kix_wkcrlfh2qk3l-6>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-6}ul.lst-kix_2yktnm17nyl7-4{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-0.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-0 0}ol.lst-kix_jp16emg17n48-5.start{counter-reset:lst-ctn-kix_jp16emg17n48-5 0}ul.lst-kix_2yktnm17nyl7-3{list-style-type:none}ol.lst-kix_d25vxsk234hv-8{list-style-type:none}ul.lst-kix_2yktnm17nyl7-2{list-style-type:none}ol.lst-kix_d25vxsk234hv-7{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-3.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-3 0}.lst-kix_jp16emg17n48-0>li{counter-increment:lst-ctn-kix_jp16emg17n48-0}.lst-kix_jp16emg17n48-7>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-7,lower-latin) ". "}ol.lst-kix_i2wckd3yhfhe-3.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-3 0}.lst-kix_jp16emg17n48-6>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-6,decimal) ". "}ol.lst-kix_i2wckd3yhfhe-7.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-7 0}.lst-kix_jp16emg17n48-6>li{counter-increment:lst-ctn-kix_jp16emg17n48-6}.lst-kix_wkcrlfh2qk3l-5>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-5}ol.lst-kix_jp16emg17n48-4.start{counter-reset:lst-ctn-kix_jp16emg17n48-4 0}.lst-kix_jp16emg17n48-8>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-8,lower-roman) ". "}ol.lst-kix_jp16emg17n48-3.start{counter-reset:lst-ctn-kix_jp16emg17n48-3 0}ol.lst-kix_wkcrlfh2qk3l-4.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-4 0}.lst-kix_wkcrlfh2qk3l-2>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-2}ol.lst-kix_i2wckd3yhfhe-2.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-2 0}.lst-kix_d25vxsk234hv-0>li{counter-increment:lst-ctn-kix_d25vxsk234hv-0}ol.lst-kix_d25vxsk234hv-5.start{counter-reset:lst-ctn-kix_d25vxsk234hv-5 0}ol.lst-kix_jp16emg17n48-8{list-style-type:none}.lst-kix_d25vxsk234hv-6>li{counter-increment:lst-ctn-kix_d25vxsk234hv-6}ol.lst-kix_jp16emg17n48-7{list-style-type:none}.lst-kix_i2wckd3yhfhe-1>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-1}ol.lst-kix_i2wckd3yhfhe-8.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-8 0}.lst-kix_i2wckd3yhfhe-4>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-4}ol.lst-kix_jp16emg17n48-4{list-style-type:none}ol.lst-kix_jp16emg17n48-3{list-style-type:none}ol.lst-kix_jp16emg17n48-6{list-style-type:none}ol.lst-kix_jp16emg17n48-5{list-style-type:none}ol.lst-kix_jp16emg17n48-0{list-style-type:none}ol.lst-kix_jp16emg17n48-2{list-style-type:none}.lst-kix_d25vxsk234hv-3>li{counter-increment:lst-ctn-kix_d25vxsk234hv-3}.lst-kix_i2wckd3yhfhe-7>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-7}ol.lst-kix_jp16emg17n48-1{list-style-type:none}.lst-kix_fmj6vk2ylkib-1>li:before{content:"\0025cb "}.lst-kix_wkcrlfh2qk3l-1>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-1}.lst-kix_fmj6vk2ylkib-0>li:before{content:"\0025cf "}.lst-kix_fmj6vk2ylkib-2>li:before{content:"\0025a0 "}.lst-kix_fmj6vk2ylkib-3>li:before{content:"\0025cf "}ol.lst-kix_wkcrlfh2qk3l-8.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-8 0}.lst-kix_i2wckd3yhfhe-1>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-1,lower-latin) ") "}.lst-kix_jp16emg17n48-2>li{counter-increment:lst-ctn-kix_jp16emg17n48-2}.lst-kix_i2wckd3yhfhe-2>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-2,lower-roman) ") "}.lst-kix_i2wckd3yhfhe-6>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-6}.lst-kix_i2wckd3yhfhe-4>li:before{content:"(" counter(lst-ctn-kix_i2wckd3yhfhe-4,lower-latin) ") "}.lst-kix_wkcrlfh2qk3l-7>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-7,lower-latin) ". "}.lst-kix_wkcrlfh2qk3l-8>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-8,lower-roman) ". "}.lst-kix_i2wckd3yhfhe-3>li:before{content:"(" counter(lst-ctn-kix_i2wckd3yhfhe-3,decimal) ") "}.lst-kix_i2wckd3yhfhe-5>li:before{content:"(" counter(lst-ctn-kix_i2wckd3yhfhe-5,lower-roman) ") "}.lst-kix_jp16emg17n48-3>li{counter-increment:lst-ctn-kix_jp16emg17n48-3}.lst-kix_i2wckd3yhfhe-5>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-5}ol.lst-kix_jp16emg17n48-6.start{counter-reset:lst-ctn-kix_jp16emg17n48-6 0}.lst-kix_i2wckd3yhfhe-8>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-8,lower-roman) ". "}.lst-kix_d25vxsk234hv-8>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-8,lower-roman) ". "}ol.lst-kix_wkcrlfh2qk3l-5.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-5 0}ol.lst-kix_i2wckd3yhfhe-1.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-1 0}.lst-kix_i2wckd3yhfhe-7>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-7,lower-latin) ". "}.lst-kix_i2wckd3yhfhe-6>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-6,decimal) ". "}.lst-kix_jp16emg17n48-1>li{counter-increment:lst-ctn-kix_jp16emg17n48-1}.lst-kix_d25vxsk234hv-4>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-4,lower-latin) ". "}.lst-kix_wkcrlfh2qk3l-0>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-0,decimal) ". "}.lst-kix_d25vxsk234hv-8>li{counter-increment:lst-ctn-kix_d25vxsk234hv-8}.lst-kix_jp16emg17n48-4>li{counter-increment:lst-ctn-kix_jp16emg17n48-4}.lst-kix_d25vxsk234hv-3>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-3,decimal) ". "}.lst-kix_d25vxsk234hv-5>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-5,lower-roman) ". "}ol.lst-kix_i2wckd3yhfhe-6.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-6 0}.lst-kix_wkcrlfh2qk3l-1>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-1,lower-latin) ". "}ol.lst-kix_wkcrlfh2qk3l-2.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-2 0}.lst-kix_d25vxsk234hv-7>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-7,lower-latin) ". "}ol.lst-kix_d25vxsk234hv-4.start{counter-reset:lst-ctn-kix_d25vxsk234hv-4 0}.lst-kix_d25vxsk234hv-6>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-6,decimal) ". "}.lst-kix_wkcrlfh2qk3l-6>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-6,decimal) ". "}.lst-kix_fmj6vk2ylkib-8>li:before{content:"\0025a0 "}.lst-kix_fmj6vk2ylkib-7>li:before{content:"\0025cb "}.lst-kix_wkcrlfh2qk3l-5>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-5,lower-roman) ". "}.lst-kix_wkcrlfh2qk3l-0>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-0}.lst-kix_i2wckd3yhfhe-0>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-0,decimal) ") "}.lst-kix_fmj6vk2ylkib-5>li:before{content:"\0025a0 "}.lst-kix_d25vxsk234hv-0>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-0,decimal) ". "}.lst-kix_wkcrlfh2qk3l-3>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-3,decimal) ". "}.lst-kix_wkcrlfh2qk3l-4>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-4,lower-latin) ". "}ol.lst-kix_d25vxsk234hv-7.start{counter-reset:lst-ctn-kix_d25vxsk234hv-7 0}.lst-kix_wkcrlfh2qk3l-3>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-3}.lst-kix_fmj6vk2ylkib-4>li:before{content:"\0025cb "}.lst-kix_fmj6vk2ylkib-6>li:before{content:"\0025cf "}.lst-kix_d25vxsk234hv-1>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-1,lower-latin) ". "}.lst-kix_d25vxsk234hv-2>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-2,lower-roman) ". "}.lst-kix_wkcrlfh2qk3l-2>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-2,lower-roman) ". "}.lst-kix_wkcrlfh2qk3l-4>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-4}.lst-kix_d25vxsk234hv-1>li{counter-increment:lst-ctn-kix_d25vxsk234hv-1}ol.lst-kix_d25vxsk234hv-8.start{counter-reset:lst-ctn-kix_d25vxsk234hv-8 0}ol.lst-kix_d25vxsk234hv-1.start{counter-reset:lst-ctn-kix_d25vxsk234hv-1 0}.lst-kix_d25vxsk234hv-7>li{counter-increment:lst-ctn-kix_d25vxsk234hv-7}.lst-kix_i2wckd3yhfhe-3>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-3}.lst-kix_jp16emg17n48-5>li{counter-increment:lst-ctn-kix_jp16emg17n48-5}ol.lst-kix_jp16emg17n48-7.start{counter-reset:lst-ctn-kix_jp16emg17n48-7 0}ol.lst-kix_wkcrlfh2qk3l-4{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-0.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-0 0}ol.lst-kix_wkcrlfh2qk3l-3{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-2{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-1{list-style-type:none}.lst-kix_i2wckd3yhfhe-8>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-8}ol.lst-kix_wkcrlfh2qk3l-0{list-style-type:none}ol.lst-kix_jp16emg17n48-1.start{counter-reset:lst-ctn-kix_jp16emg17n48-1 0}ol.lst-kix_i2wckd3yhfhe-4.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-4 0}ol.lst-kix_wkcrlfh2qk3l-8{list-style-type:none}.lst-kix_i2wckd3yhfhe-2>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-2}ol.lst-kix_wkcrlfh2qk3l-7{list-style-type:none}.lst-kix_2yktnm17nyl7-4>li:before{content:"\0025cb "}ol.lst-kix_wkcrlfh2qk3l-6{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-5{list-style-type:none}ol.lst-kix_d25vxsk234hv-2.start{counter-reset:lst-ctn-kix_d25vxsk234hv-2 0}.lst-kix_2yktnm17nyl7-5>li:before{content:"\0025a0 "}.lst-kix_2yktnm17nyl7-6>li:before{content:"\0025cf "}.lst-kix_2yktnm17nyl7-7>li:before{content:"\0025cb "}ol.lst-kix_wkcrlfh2qk3l-7.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-7 0}.lst-kix_2yktnm17nyl7-8>li:before{content:"\0025a0 "}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ol.lst-kix_wkcrlfh2qk3l-1.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-1 0}ol.lst-kix_jp16emg17n48-0.start{counter-reset:lst-ctn-kix_jp16emg17n48-0 0}ol{margin:0;padding:0}table td,table th{padding:0}.c29{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:49.5pt;border-top-color:#000000;border-bottom-style:solid}.c10{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:66.8pt;border-top-color:#000000;border-bottom-style:solid}.c11{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c22{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:87pt;border-top-color:#000000;border-bottom-style:solid}.c30{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:81pt;border-top-color:#000000;border-bottom-style:solid}.c15{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:164.2pt;border-top-color:#000000;border-bottom-style:solid}.c3{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c26{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c31{color:#434343;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:14pt;font-family:"Arial";font-style:normal}.c32{padding-top:16pt;padding-bottom:4pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c0{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c39{-webkit-text-decoration-skip:none;color:#000000;text-decoration:line-through;vertical-align:baseline;text-decoration-skip-ink:none;font-style:normal}.c38{color:#000000;text-decoration:none;vertical-align:super;font-style:normal}.c21{border-spacing:0;border-collapse:collapse;margin-right:auto}.c7{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:left}.c6{color:#000000;text-decoration:none;vertical-align:baseline;font-style:normal}.c8{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c1{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c25{font-weight:400;font-size:11pt;font-family:"Arial"}.c37{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c19{font-weight:400;font-size:16pt;font-family:"Arial"}.c2{font-size:10pt;font-family:"Courier New";font-weight:400}.c12{font-weight:400;font-size:11pt;font-family:"Courier New"}.c40{font-weight:400;font-size:10pt;font-family:"Arial"}.c14{color:#000000;text-decoration:none;vertical-align:baseline}.c42{font-family:"Courier New";font-weight:400}.c16{border:1px solid black;margin:5px}.c18{margin-left:36pt;padding-left:0pt}.c5{color:inherit;text-decoration:inherit}.c24{padding:0;margin:0}.c28{background-color:#ffff00}.c33{background-color:#cccccc}.c9{height:11pt}.c17{color:#696969}.c34{color:#000080}.c4{font-style:italic}.c13{color:#0000ff}.c35{color:#8a2be2}.c36{color:#a31515}.c23{color:#a82d00}.c20{height:0pt}.c41{vertical-align:super}.c27{color:#8b0000}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}}