Youtube daily Nov 28 2018

(dramatic music)

(audience clapping)

- Hi, my name is Phill, as they have mentioned.

Thank you for the introduction.

I'm here today to talk to you about the recent

terrorist incident that has so terribly affected

the Imperial Empire.

And provide a little bit of information

about my insights of the Google Home

that was used in their destruction

of our orbital battle station.

I've been working for the Empire willingly

for the last seven years.

Well, I mean willingly join or die,

willingly for the last seven years as an analyst.

Also started a blog, This Week In Forensics,

where I read everything that I can find

about the digital forensics community

and also my personal research blog, ThinkDFIR.

But we're here to talk about the recent destruction

of the DS-1 Orbital Battle Station.

Since the destruction, we've indentified

the Rebel Base and we sent our top forensic,

well our available forensicators were sent,

to examine, to provide investigative support.

The investigators gave us a number of,

well they gave us one question,

they just wanna know everything.

And that wasn't really helpful to me,

so I wrote down a series of questions

that I would like to have written down,

I mean I guess provided.

But I would like to determine

so that I can assist their investigation.

So the first thing I wanna know

is what access point was it connected to?

Were these device connected to each other?

Because of course, just because the home

and the phone were in the same location,

does not necessarily mean that they were used

to interact.

What accounts were they linked to?

What has the device heard?

Which is probably our most important part.

And then the Bluetooth devices

and any location information that can be found.

So I was provided with a Google Home Mini

and an Android device to investigate.

And so I thought where should I start,

and I'm gonna start with the phone.

So the phone examination's gonna be the easiest part

because there's a lot of research about that

and I know what I'm doing.

So I started by looking at the Google Home app.

This app is basically the Chromecast app

that's been renamed.

It's now relating to Google Homes.

So that's why the app ID is the chromecast.app,

and it's mainly used for the device interaction.

You're gonna be able to control the settings, setup

the Google Home devices.

And there's actually no web interface that you can use

to interact with the devices as well.

So the first thing I wanna do is provide an extraction,

well obtain an extraction, so that I can examine

this app data.

The phone that I had to examine was a Nexus five

and is running the Home app version,

well a previous version.

So of course I'm gonna run an ADB backup first

and see what there was.

Unfortunately, not much.

The Google Home app didn't really backup very much

using the native ADB process.

As a result I was left with only obtaining a physical.

This was very helpful, there was a lot of data,

and so then I can direct my investigation after that

directly to the data folder that had everything

that I was looking for.

I also tested the iOS section.

I had a test iOS device, just for interest.

An iOS is a little bit easier.

Everything you're gonna get comes out

of a regular backup and it's all in Synchro Light

and paylists and very simple to analyze.

So this is a bit hard to read,

but we've got a few screens from examining

the physical device itself.

Just looking at the account drawer,

I can say that there is one user account,

and from there I can also query the actual Google Home

that I'm on the network with.

And I can say that there is one account

named Rebels Yavin, rebelsonyavin@gmail.com

with a photo.

That's really useful.

It means I know that there's only one account

that I need to look for and only one account

I need to download.

It will also indicate every other app

that is used to interact with this device.

Every other email address, sorry.

If I take my own phone and connect it up

to the network, I can obtain a little bit

of information but not as much as I need.

I'll be able to tell the user name and the picture,

but I won't be able to get the email address.

And I can also get the device name.

Moving on we can look at the target device again

and we can see all of the devices that that user account

has at it's disposal.

In this instance, it was just the one,

which was called Rebel Base.

The device address is something that's quite important.

You can have a look if you click in through

the device menu and you can see that the device address

is in this instance Lucas Valley Road in California.

Important thing to note about this is

whilst you can very easily see it,

and you can very easily read it in the XML file,

it's set by the user not by GPS,

because the Google Home device was not found in California.

This information also shows up in all

of the Cloud activity under current location

in my activity, so it's very easy to get at.

It's very easy to interpret.

The Home Graph is the most important file

that you can find in the app data.

So, it's basically gonna be called Home Graph

and then a base 64 string of the user's account email,

and there will be one for each user on the device

that has interacted with the Google Home,

so much as they've got a Google Home

linked to their account.

Now unfortunately, this is encoded

in Google's protobuf encoding,

and I haven't been able to figure out

a good way of interpreting it

and decoding it properly, so we're kind of

left with just reading the strings.

Thankfully, a lot of the ones that we need

pop up quite easily.

So the first thing we wanna look at is our Gmail address,

that's fine.

We already know that.

We've got what looks like an ID

and we'll talk about it more as it's very important.

It's the Cloud device ID.

And we've also got another ID about the Google account.

And this account ID is setup to every single user on Gmail.

It's easier to decode if you've got Google+ set up,

but that's not necessarily always the case.

But, that's gonna be useful for later as well.

So, just to summarize what we found on the phone,

we've got our email, we've got our account ID.

We've also got the oAuth Token,

which is gonna be great when we need

to download Cloud data.

A device location, a Cloud device ID

and the Wifi password.

So that's answered a few questions already.

Now we're gonna look at the Google Home.

This is an actual product by the way.

If you would like to support all of those

that were lost in the recent destruction,

please go to the link below.

So there's two things that we can do

to examine the Google Home.

There's querying it while it's live

or we can examine the internals.

It depends on your use case, I'm gonna go all out

because this is for a terrorist incident.

So I need to make sure that I'm getting

as much information as possible.

But in some instances if you do not want

to destroy the device, examining the internals

is going to not be the right way to work.

So first you want to do is you wanna find

the Home itself on the network.

You can easily query the device on the Home app

or you can use something like Fing,

which is a network scanner.

The caveat is that it will scan the network,

send that information up and provide you

with IPs, names, MAC addresses and device types.

That might not be suitable to your situation.

So in that case then you can always use an Nmap

to scan your network and see what you will find.

The Nmap command down at the bottom

will show you all the Google Home devices

and if you get rid of the 10001,

which is the highlighted port,

then that will show you the Chromecast devices as well,

'cause they're both built off the same thing.

You can query them the same way.

So, we wanna find as much information we can

from the live device and there's two methods

of doing so.

I know I said that Google only let us know

that there was one, and that's the one

they only want us to use, which is the Home app.

But unfortunately, that won't give us all

of the information that we would like to find.

So, I built a script called Homespeak,

which I'll be releasing shortly.

It was based off some work by a GitHub user

named Rithvikvibhu who found that you could send

GET and POST requests to the Google Home device

as long as you're on it's network,

and you will receive JSON data back.

There are kind of two methods of doing this,

it depends on the situation.

If you're at the scene, you can jump on the network,

you can send the queries once you've got the IP

but, if you you've opened the exhibit bag

and there's your Goggle Home, you might not

be able to do that.

In that instance, the great thing

about Home devices is when you plug them in,

they shoot up their own network

and you can connect to that.

If you try to query that with the Home app,

you will not actually be able to get any data.

It will be thinking that you're trying

to set up a brand new device.

I don't wanna set up a brand new device,

I want to find all the information

on the current one.

So you can send a couple of requests

that are really gonna get you as much information

as you need.

There's a lot of information in there

that's not really relevant.

But the main stuff that I found

was the Cloud device ID, which we found earlier,

and the Bluetooth devices.

That Cloud device ID, I just wanna point out,

is set up as soon as you initially set up that device.

If you restart the device it'll be fine,

but if you reset the device manually,

you'll get a brand new Cloud device ID.

So we want to put that all together.

We've got our Cloud device ID from the Home Graph

as well as our account and our Gmail address,

and on the other side we've got our Cloud device ID.

Which is great, because now we can put them both together

they match, and we can use that to download the Cloud data.

Well, use that to confirm that this is the account

that we need to download, because the last thing

you wanna do is find a Home device and a phone

and download the wrong person's account.

There can be legislative issues if you do that

and so we just have to make sure first.

The other thing I wanted to bring up

was Bluetooth devices.

Just a useful piece of information,

if you go and query the device with the Home app,

you will find all the connected Bluetooth devices

as well as the date that they connected initially.

This doesn't matter if you're on the suspect device

or in this case the investigator's device.

That will work just fine and it'll give you

that information.

But unfortunately, it doesn't give you much more.

With Homespeak you're able to send the query

and get a bit more information,

which I'll just make a bit bigger.

So we've got the bond date, the date

that it was initially connected.

As well as the last connect date.

It's called last connect date but it means last interaction,

so if you connect or disconnect, depending

on the connected flag, it will log the date.

Which is great for determining when maybe

the rebels were last at that base at that date.

We've also got the MAC address as well as the device name,

which is just a bit more to really confirm

what we found on the Home app itself.

But that might not be good enough.

We might want to go a bit further.

We might want to pull the device apart.

So this is the inside of the Google Home Mini.

They're fairly easy to pull apart

and the Google Home devices aren't much harder.

Inside we'll find a 256 meg Toshiba chip.

There's not a lot of space for any data

on there realistically, compared to the Echo devices

that have I think four gig of data.

We're just looking at 256 megs.

So, I got one of my fellow convicts,

uh Imperial Officers to help read the data back for me.

He was able to use just regular chip off methodology,

in this case a Rework station,

to remove the chip, clean it up

and read it with something like the Dataman.

An associate, Scott Lalass, was able to help

by sending some of the chips to Dataman

and they built a profile.

Which means that everyone with a Dataman

is able to read the Nan chip pretty easily.

So, after we've read the data, this is what we can see.

Don't worry if you're sitting at the back,

I can't read this either.

Most of it is garbage.

Unfortunately there isn't a really good file system

that we can parse out and so we're kind of just left

with looking at strings.

It's unfortunate, if anyone is able to help

figure out what the file system is, that would be great.

But unfortunately, I wasn't able to figure it out.

Thankfully, strings comes up

with a lot of great information.

So from here, we're just gonna look

for the Bluetooth devices that we found previously,

and I can see there's actually another Bluetooth device

that I didn't know about.

And it's called Luke's iPod touch.

We've got a MAC address there, we haven't got dates,

which is not great, and I don't actually know

if this is the deleted file or this is an allocated file

with a log that just hasn't been cleared out yet.

But hey, that just means that I know

that there was another device that we didn't see

that we weren't able to examine,

and maybe the terrorists took it with them.

This can also be really, really useful

if someone says, "I was never there,

"I didn't know anything about that person."

You've now got another record to look at.

We can also find the Google account ID,

which can also be very useful as we've found it before.

If you're able to take that to Google,

they might be able to reverse that for you

and tell you what the account was,

give you the information.

I wasn't able to ask Google that question,

but they might be able to help.

This can be really useful if all you've got

is the Google Home and you need to find out

who's account do I need?

There's also the Cloud device ID on there,

but obviously you've got the device, so.

We wanna put it all together.

We've now got the Cloud device ID

and the account information on the left.

We've got the NAND Read and the Homespeak

will give us the account ID and the Cloud device ID,

which is great.

Now we've just got the Cloud data that we wanna look at.

So, Cloud is basically where we're gonna be looking

for all of the interaction that we really care about.

There's not really much found on the device itself

or on the app with regards to any of the queries,

any of the audio, anything really outside

of the Bluetooth device interaction.

So, I'm gonna cover a couple of ways

to get this Cloud data and examine it,

and then we're gonna talk about what data was found

that was very useful to me.

So you can go to myactivity.google.com

and that will show you all of the interactions

for that account.

I'm only going to focus on assistant

and voice and audio, but if you have a Google device

and you haven't been to that website,

you will be scared at how much information

is tracked and logged.

But the good thing is, if you filter for assistant

and voice and audio, you'll see all

of the interactions with the Google Home device.

It will identify that a Google Home device was used,

not which Google Home device.

So if you've got two Google Homes,

it might not be able to tell you

which one's which.

And the good thing is, it will also identify

there is a known user's voice used.

If two accounts have been set up on the same device,

it will tell you who said what.

You may also come into problems

if there are two users set up on the account,

because you'll need to access two different Cloud accounts.

To download this data, you're gonna be using Google Takeout,

which will get you all the spoken words,

it'll get you all of the responses,

all of the audio and the location data if it's set.

As I said, that location is set by the user.

Even though location services is required

when you turn the app on to set the device up

to begin with.

The only downside with using Takeout is it

A, notifies the individual that you're performing

a Takeout and it also will download everything.

So if time is of the essence or you're required

to only obtain a small amount of data,

then Google Takeout may not be the way to go.

Unfortunately, currently it is one of the only ways that

you're learning to get the most complete

piece of information.

Alternatively, I tested a number of Cloud data

acquisition tools.

These tools are basically the only ones

that were able to provide the information that I needed,

and filter it out in the right way.

Some of the tools will provide you

with the Google search information,

but not actually determine which device was used.

Was it the phone, was it the app,

sorry was it the Home device?

In the last three days Google changed the API

and every tool is broken with regards

to Cloud data acquisition of this specific information.

So Takeout is going to be your best bet.

But, once that's fixed, I'm sure all the vendors

are on it, we'll be able to get all that information again.

These tools are really good at helping you search,

sort, report on that information,

and so it's a good idea to, if you can,

get the Takeout information as well as do

an API acquisition and then just compare the two.

I know that some of the vendors are also working on

ingesting that Takeout data, because they don't necessarily

incorporate it in a really good way

that allows you to easily review it.

Alright, so specifically about our case,

what did we find?

We found that someone was asking,

do they have anything on their calendar?

Unfortunately, in this instance,

Google didn't tell me what they actually found.

The Home would've responded in some way,

but it doesn't always tell you what they said.

So I downloaded the Cloud, the calendar from the Cloud,

and that's pretty damning that they wanted

to blow up the Death Star the next day.

I don't know why they call it the Death Star,

I think that's crass.

It's always been the DS-1 Orbital Battle Station.

But, anyway.

They also were asking curiously about the weather on Hoth.

So,

I mean that's a clue, isn't it?

I feel like that's a clue.

And interestingly, Google responded

and it said, "Hoth's climate is cold."

Well yeah, Hoth's climate is cold,

but why wold they be asking if that's not

where they wanted to go next?

Just a hint though, when Darth Vader says,

"They're in the Hoth System,"

just go along with it, it's just a trick.

Alright, so for a generalized process,

what should we do if we're faced

with a Google Home and a phone at the scene?

The first thing we're gonna do

is get a physical acquisition,

it's gonna be the only way

that we're gonna get the home ref information,

and from there we can identify the account

and the Cloud device ID from the Home Graph.

Potentially more information as well.

I know that there's also the date that the Google Home

was added to that account, but haven't been able

to pull that information out yet.

We're then gonna query the Home device.

We can get the Cloud device ID from there,

as well as other Bluetooth data,

if that's of relevance.

And from there we can put those two things together

to confirm that that's what we need,

with the password or the oAuth Token,

to pull the Cloud data.

So overall findings.

What did we find?

What do we know from all of this?

We know that the room was probably related

to someone named Luke.

We know he had a calendar entry to destroy the Death Star,

and his home location was set to the Skywalker Ranch.

Which could be a previous location,

because we didn't find any Homes on the Skywalker Ranch,

we found them on Yavin.

We've got the last date and time that the phone

was at the base.

Which could be the last time they were at the base as well.

And we also know that he was asking about

the weather on Hoth.

So we've got a pretty decent idea

of where we should look next.

Further work is really where I would like to look next

to try and build out the research for this.

I would like to look in to parsing the Home file system

and decode the proto file, but at the moment

I haven't been able to figure that out.

As well as looking further in to the iOS app data,

in case that comes up.

There are a few other features

and a few other devices planned

in the future with regards to communication.

I wasn't able to test that as it wasn't provided

in this situation, but it's going to be coming

across many iOT devices, so that's something

to look forward to.

Lastly, I'd like to thank a number of people

that provided me with their tools to test.

All of these companies were very gracious

in providing me with their tools

and so I thought I'd give them a shout out,

and I know a lot of them will be working

on improving this data, as it's only gonna get

more and more as time goes on.

As well as a number of people

for helping me with the research,

and providing me with test data.

Cool, thank you.

(crowd claps)

(dramatic music)

For more infomation >> Investigating Rebel Scum's Google Home Data - SANS DFIR Summit 2018 - Duration: 21:38.

-------------------------------------------

Home-Cooked Vs. $1000 Gingerbread House - Duration: 13:14.

- Three, two, one!

Christmas!

Welcome to Night In Night Out,

a show where we compare a home-cooked, tasty recipe

to a night out at a fancy restaurant.

Today we're going not one but two dates,

and then at the end we're each going to pick

which one was the better date.

- Today's episode is gingerbread.

- It's the holiday special,

and for this special episode,

we partnered with the Google Home Hub,

and they're gonna help us make

a delicious gingerbread house.

- Mmm.

(upbeat instrumental music)

- Presents.

It's Christmas!

Ahh!

Okay, let's see if we can find a good gingerbread recipe.

- Mmm.

Hey Google.

Cook with Tasty.

- [Robotic Voice] Alright, getting Tasty.

Welcome back to Tasty.

What would you like to make today?

- Gingerbread.

- [Robotic Voice] Sure, gingerbread recipes.

- Ooh, this one looks good.

Gingerbread cookies.

We can make a house out of that.

- [Robotic Voice] Sure, here you go.

Does this look good?

- Yes. - Yup.

- [Robotic Voice] Great.

Let's get started.

- [Ariel] This is awesome.

- [Ned] Yeah, this is great.

- [Robotic Voice] In a large bowl, whisk the melted butter,

brown sugar, molasses, salt, cinnamon, ginger,

and allspice until smooth.

- Ingredient? - Ginger.

- All the spices.

- I don't know why we need other spices.

We just put in allspice.

- [Ariel] Yeah, you know, we can just bake with it.

- [Ned] Isn't it two teaspoons and a tablespoon?

- I have no idea, actually.

- Hey Google, how many teaspoons are in a tablespoon?

- [Robotic Voice] One US tablespoon

equals three US teaspoons.

- Three teaspoons, okay.

- [Ariel] Alright, I'm ready for an egg.

- [Ned] So smooth.

Boop.

Mmm. Oh, it's good.

- [Ariel] Oh, don't eat it; it has raw egg in it.

- Oh, yeah.

It's only got a little bit of raw egg.

- Yeah.

We only need a little bit to get sick.

- What?

Not only baking powder but baking soda.

- All the bakings.

- All the baking stuff.

I always get confused.

Oh my goodness.

Oh, that's making me hungry.

- [Ariel] That's really good.

- [Ned] Alright, now it's time to wrap it and chill it.

Snug like a baby.

- Snug as a bug in a rug.

- Well, now our dough is chilling,

and it's time for you and me to chill as well.

(slurping beverages)

Ahh.

- Alright, you ready to roll out this dough?

- Yeah.

Right now it just looks like a giant tootsie roll.

Nice job.

- Thank you.

- Wow, it's so hard.

- You need to tag out?

Oh, crap.

- What happened?

- I don't know.

It caught my knuckle.

Oh my God, just eyeballing it.

- Maybe I'm just a better drawer than you are.

- Yeah.

Just throwing caution to the wind.

Dang, we did not put enough flour down.

- It looks like a little hobbit house.

- It's vintage.

Alright, let's get this guy in the oven.

Let's make the other parts of our house.

- Okay.

And that.

Haha!

- It's like a pretty natural 45.

Ooh, ooh, ooh, and for this top.

- [Ariel] That's genius.

- Haha!

Oh yeah, you've got some flour on your face.

(blowing)

(blowing raspberry)

Oh, gross.

That's a wet one.

Wait, so what should we do with this little door piece?

- How about a little gingerbread man?

- A little gingerbread man.

Let's put Norman Pierre in the oven.

- Trees?

- Trees!

- [Ariel] I like just free handing it.

This is fun.

- [Ned] Yeah.

What else can we make?

- [Ariel] Candy cane garden?

- Maybe like a nice drainage system.

- [Ariel] We might have to sketch that out.

A dog.

- A dog, yeah.

Let me take in your face.

Let me take in your essence.

I've got it, okay, good.

- [Ariel] I've got it.

- Oh, Bean, you're beautiful.

It's really just a dog head.

Oh, let's check it out, Ariel.

- [Ariel] Ah, that looks so good!

- Look at that!

Bonjour, Norman Pierre.

- It's a girl.

- Right.

- Norman.

- Norman.

I think your snowman is missing a head.

- No!

That's the head.

- No.

Snowmen usually have three.

- I can't wait until Wes is old enough to do this.

- Oh, we have to make a little baby.

It's like an actual baby where, even if it's ugly,

you're like, oh, but he's adorable.

Let's get started on the frosting.

Do we want more of a pink,

or do we want more of a deep maroon?

- I'd like red, please.

- Okay.

He's got kind of a cool, casual smile.

Ready to build this house?

- You know I am.

- Let's raise the walls.

- I'm so happy with that.

- And the garage.

I think we made our roof too big.

- [Ariel] Looks kinda like a birdhouse.

- It's our ginger birdhouse.

- It's a ginger bird!

- It's ginger bird.

We're going to have a little

husband vs. wife decorating competition.

I will take this side.

- And I get this side.

Hey Google, set a timer for 10 minutes.

- [Robotic Voice] Okay, 10 minutes, starting now.

(festive instrumental music)

- [Ned] How's it going over there, Ariel?

- Oh no.

I can't.

- Oh no!

I'm losing shingles!

- [Ariel] They're all just falling off!

- My shingles!

It's done.

No, wait, you can't touch it.

No, you can't touch it.

No, that's cheating.

- This is a Spanish style tile roof

with exposed gingerbread walls.

- Very good use of the licorice

to cover up a large space at once.

And it also offers a lot of architectural pizazz.

- Yeah, right, like a window into the soul

of the ginger birdhouse.

- Yeah, I think you did great.

- Okay, well, let's move on to your side.

I love the gumdrops

and the candy sides. - Thank you.

- This window is lovely.

- Thank you.

- Literally wish I had--

- Thought of that?

- Thought of just done anything.

What's going on with this archway door?

- Those are actually bushes.

- Oh, those are bushes.

Okay, okay.

Alright.

Let's eat it!

Now it's finally time to taste our creation.

Our beautiful ginger birdhouse.

- [Ariel] What part are we gonna eat?

- Let's taste the snowman.

Decapitate him.

- Oh, you took the whole head off?

- I did, yeah.

- Okay.

I'm gonna take the top of the tree off.

- You ready to eat this?

- Yes.

- Clink.

Mmm. - Mmm.

- The frosting on top is super sweet.

And then the inside is a little spicy.

- It's soft in the middle.

- Yeah.

- I like that.

- Yeah, me too.

We put so much work into building the house.

Now I see why people just let it sit.

- [Ariel] I know, I don't wanna eat it.

- [Ned] For a while.

- No, Norman Pierre is so cute.

- No.

I feel like we have to try at least

a little bit of the house.

Turns out all of those red things are gum.

- Ew.

- Oh no.

Here you go.

- Thank you.

- There's your piece of the front door.

- Delicious.

- Oh, it's good.

- That's the best piece, right?

- That's the best piece.

It's the allspice.

Well, we destroyed the entire side of our house.

It's okay because we are headed to

a night out at a fancy bakery.

But first we gotta get changed.

(upbeat instrumental music)

Oh, you look great!

- Oh, thank you.

You look very nice.

- Understated.

Elegant. - Yeah, this is so subtle.

- Thank you, thank you.

We're on our way to the night out.

We're going to Half Baked Co.

We're finally gonna see the $1,000 gingerbread house.

- We don't get to eat it?

- Oh, yeah, we're gonna get to eat it.

Oh ho ho ho, we're gonna get to eat it.

- Okay.

- They have actually been working for two days straight.

I mean, I bet they can do things

with icing that we only dream of.

Hey, how's it going?

Very nice to meet you. - Hi, welcome to Half Baked.

- Thank you.

I'm Ariel.

- I'm Natalie. - I'm Ned.

- It's so good to meet you. - Nice to meet you guys.

Welcome in.

- So what sort of cakes do you specialize in?

- Custom cakes.

So that means first birthday parties.

Those are huge.

Weddings, corporate events.

We do a lot of stuff for the studios around Burbank.

Pretty much anything.

- So are we gonna get to go in the back?

- Yeah.

Let's go meet the Head Decorator.

- Okay. - Okay.

- I'm the Head Cake Artist here at Half Baked Co.

Pretty much whatever you can think of,

we can create it for you.

- Awesome. - Yeah.

- So what are some things that a professional baker can do

that a home chef might not think of?

- One of the things that a lot

of people don't use is white chocolate.

So you pretty much just dip it.

- What?

That's so easy.

- And then just start gluing your pieces together.

- [Ned] Huh.

- And it goes a little bit faster than using royal icing.

Chocolate dries very quickly.

On the inside I always like to use Rice Krispies Treats.

Another one of our secrets to keep stuff sturdy.

So to make your Christmas trees,

you just mold it into the shape of your tree.

You grab your green royal icing,

and then just start spreading it.

And just work your way all the way around.

To make it rough you can even go like this.

Some more dimension.

To make our reef, we grab fondant.

It's made with marshmallows, powdered sugar and corn syrup.

Kind of shape it into a donut.

And to give it more texture, I use a star tip.

And this makes them feel like pine needles.

Give it that realistic feel.

Use your edible gold,

which we mix with a little bit of vodka.

If you use water it doesn't mix as well.

And just go ahead and paint it.

- That's how you jack up the price.

- Yeah, exactly.

- That's how they always get you, with the edible gold.

- Evaporates?

- It evaporates, yes.

So it's safe for kids.

- Kids also, yeah.

- Safe for kids.

- We're new parents.

It's time to bring out the night out gingerbread house.

We should probably close our eyes.

- Okay.

- Three, two, one!

- Ooh.

- Ooh, wow.

- Oh my God.

- Look at this.

This frosting.

It's, like, stylishly--

- It's beautiful.

- And there's ice.

Oh, I burped, I'm so excited.

(laughing)

Look at this snowman. - Compared to ours.

- Yeah, compare that to our snowman.

Ew.

- It's Rudolph.

It has a little red nose. - Oh yeah, it has a red nose.

Oh my God.

I mean, everything's so precise and detailed and pretty.

Look at those sleighs.

- These are beautiful cookies.

- This is the most gorgeous cookie I've ever seen.

Merry Christmas.

- Merry Christmas. - Merry Christmas.

Mmm.

Oh, that is way softer than I expected,

and it is awesome.

- It's soft and kind of crumbly.

And it's spicy.

This, I wanna destroy.

(dramatic instrumental music)

(crushing sound effects)

Destroy!

- That's delicious.

I could eat that like a sandwich.

- Yeah.

Nom nom nom nom nom nom.

It is now time to pick which one was the better experience?

The night in or the night out.

So on the one we hand, we have the night in.

Our houses didn't particularly look great.

- [Ariel] They tasted great.

- [Ned] They tasted really good.

- It was really fun just to really get in there

in the kitchen, and laugh and joke around,

and I could just imagine when Wes is a little bit older.

That's gonna totally become a Christmas tradition.

- Christmas traditions, dirty kitchens.

- Yeah.

- But on the other hand, there's the night out,

which was just stunning.

- [Ariel] It was spectacular.

- [Ned] Beautiful.

- [Ariel] Absolutely spectacular.

- [Ned] Precise.

Just magical.

I mean, I felt emotions.

I felt things.

- It transported you to this winter wonderland.

- Yeah, I felt transported.

- [Ariel] I think I've made a decision.

- [Ned] Yeah?

- It is the holiday season.

I wanna be in my kitchen with the family.

It's the night in for me.

(dinging)

- Well, for me, I mean, yes,

the experience at home was really, really fun.

But that night out looked so good.

My final decision is

the night in as well.

(dinging)

- [Ariel] Really?

- Yes.

I loved making the gingerbread house with you,

and I just love Christmas.

I love you.

- I love you.

- I love cooking at home.

I'm inspired by the fancy bakery.

- [Ariel] Me too.

- [Ned] To try and take some of those techniques

to our home creations. - And do it again.

- [Ned] Props to Frankie

and everyone at Half Baked Co.

- [Ariel] Oh my gosh.

- [Ned] That house was beautiful.

Thanks to Google for sponsoring the episode.

The Google Home Hub was very helpful

when we were cooking-- - It was incredibly helpful.

- The gingerbread house.

- Happy holidays, guys.

- Happy holidays.

(upbeat instrumental music)

(beatboxing)

- [Ariel] Are you rapping?

- Hey, Ariel, rap and chill.

(laughing)

For more infomation >> Home-Cooked Vs. $1000 Gingerbread House - Duration: 13:14.

-------------------------------------------

UNBOXING Google Home Mini - Duration: 0:51.

Hi!

Unboxing!

Google Home Mini

GO

THANKS FOR WATCHING

For more infomation >> UNBOXING Google Home Mini - Duration: 0:51.

-------------------------------------------

"El oro está haciendo lo que ha hecho siempre" - Duration: 1:27.

For more infomation >> "El oro está haciendo lo que ha hecho siempre" - Duration: 1:27.

-------------------------------------------

Cookie Remembers When She Met Damon Cross | Season 5 Ep. 8 | EMPIRE - Duration: 2:32.

For more infomation >> Cookie Remembers When She Met Damon Cross | Season 5 Ep. 8 | EMPIRE - Duration: 2:32.

-------------------------------------------

Curry auf malaysische Art (Rendang) - Duration: 3:24.

For more infomation >> Curry auf malaysische Art (Rendang) - Duration: 3:24.

-------------------------------------------

'Fuller House' Star Andrea Barber On Her Years Of Playing Kimmy Gibbler | TODAY - Duration: 5:44.

For more infomation >> 'Fuller House' Star Andrea Barber On Her Years Of Playing Kimmy Gibbler | TODAY - Duration: 5:44.

-------------------------------------------

Why Does Warren Buffett Love Bank Stocks So Much?!?! - Duration: 6:43.

Mac Greer: Speaking of nice performers, there's a guy named Warren Buffett who's got a pretty

good track record, is my understanding, as an investor.

His company, Berkshire Hathaway, just reported its third quarter holdings.

Boy, does Buffett, or someone over at Berkshire, really like banks.

Guys, let me give you the ten holdings quickly. See if you notice a theme here.

Apple is the biggest holding.

Then we've got Bank of America, Wells Fargo, Coke, Kraft Heinz, American Express, U.S.Bancorp,

Moody's, Goldman Sachs, and JP Morgan Chase. Five of the ten are banks!

Ron Gross: You look at this portfolio and you say, a bunch of banks and a bunch of consumer

staple-ish stocks. It doesn't seem to be a very exciting portfolio.

Greer: The curmudgeonly trader, there you go again!

Andy Gross: [laughs] Mr. Buffett doesn't know what he's doing.

When I think of Buffett, I think of that folksy guy who likes See's Candy kind of businesses,

old economy types of businesses.

But we forget, he's a student of financials, whether it be insurance or financial services

or the big banks.

You'll remember long ago, he was actually interim chairman of Salomon Brothers.

Subsequently, in various financial crises, he's helped bail out more than one large bank.

He understands these companies where I will say I tend to not, because they seem like

a black box to me. He clearly does.

And I think that makes him comfortable investing big portions of his portfolio,

especially in this type of environment, where interest rates are going to start to rise, less regulation.

He sees some good stuff on the horizon.

And knowing what he knows about how these banks run, he's comfortable.

Greer: Does this get you more interested in banks, Ron?

Gross: No.

Cross: Warren Buffett has insights, like Ron was saying, into the financial world from

his 60 years of investing in all types of businesses.

He also has the Todd and Ted partnership, helping him out in the investing landscape, as well.

You look through his portfolio, you do see companies like the airline investments they've

made over the last year or so, combined with a lot of financials.

The financial investment doesn't really surprise me. Ron mentioned the rising interest rates.

From a scale perspective, from competitive position, the largest banks continue to widen those moats.

Frankly, Mr. Buffett is not one that's going to pay 10X revenues, per se, for software-as-a-service companies.

And he has a lot of capital to put the work. They have $100 billion in cash on the balance sheet.

They generate so much cash from their operating businesses to be able to invest.

Making investments like this -- including Oracle, which they bought last quarter, as well.

These are the kinds of investments you expect to see from Berkshire Hathaway.

Given the size of the organization and amount of capital they generate.

and the traditional valuation bent and thinking, these don't really surprise me.

These investments, he knows them well.

Gross: Yeah. It's good to see the Ted and Todd influence.

Buffett was notorious for staying away from tech.

He said it's because he couldn't understand it.

It's not really about not understanding, it's about not being able to predict the future,

which I completely understand.

But it's nice to at least see him in consumer electronics like Apple; Oracle, a business

where either he or Ted or Todd can understand.

We saw recent investments in fintech, financial technology, companies.

Good to see, because clearly, that's going to be a big place to put capital for the future.

I like to see some of that in addition to the old Kraft, Coke, AmEx kind of stocks that

he's owned forever.

Cross: And, by the way, let's not forget, he's also buying his own stock.

They bought almost a billion dollars' worth of Berkshire Hathaway stock in the last quarter.

That's significant. He doesn't really go out there and aggressively buy his own stock.

Instead, he changed his methodology for thinking about when to buy that stock from a price

to book value target to "when we think the stock is undervalued."

And they bought a bunch last quarter.

Greer: I'll be curious to see if he starts buying even more Apple.

For perspective here, Apple, his largest position by far, almost $57 billion worth of Apple stock.

Bank of America, around $25 billion. Wells Fargo, $23 billion. Apple, far away.

Gross: I would imagine, with the Apple weakness that we've seen lately, he's in the market buying more.

That's just a guess.

I don't think he gets hung up as much as traditional Wall Street does on the quarter to quarter

iPhone unit sales numbers.

I think he's thinking longer-term about what Apple will do, in terms of generating cash

flow and buying back stock over the next five or ten years.

So, I would imagine he's increasing his position on this weakness.

Greer: If I'm an investor, and I hear about these ten holdings, and I'm like,

"Buffett's had an incredible track record.

One of the most successful public market investors in history.

Why not just mimic this portfolio?" Why shouldn't I just go out and buy these ten stocks?

Cross: I think you'd be better off buying Berkshire Hathaway.

Gross: You could mimic these stocks, but then what?

He's constantly changing the portfolio, adding to other companies.

But more important, you're getting all the operating businesses of Berkshire Hathaway,

which are generating all those billions of dollars of cash flow.

Geico generating the float capital, which you then can invest in stocks.

Just buying these publicly traded companies,

you would not be getting all those operating businesses, as well.

Cross: I think if you want to go investing in some of these businesses, they can be fine investments.

But considering he was buying his own stock, and he's pretty particular about when they

buy that stock ... Berkshire Hathaway is one of my largest personal positions.

Gross: Me, too.

Cross: I think the stock is undervalued now, so if you wanted to put your money behind

Mr. Buffett and that team, especially with the insurance operations that Ron mentioned

and the operating businesses, buy Berkshire Hathaway.

For more infomation >> Why Does Warren Buffett Love Bank Stocks So Much?!?! - Duration: 6:43.

-------------------------------------------

Lion Air Crash: 'Black Box' Data Reveals Pilots' Struggle To Regain Control Of Flight | TODAY - Duration: 3:05.

For more infomation >> Lion Air Crash: 'Black Box' Data Reveals Pilots' Struggle To Regain Control Of Flight | TODAY - Duration: 3:05.

-------------------------------------------

Descubre cómo saber si tu hijo es realmente inteligente | Un Nuevo Día | Telemundo - Duration: 4:48.

For more infomation >> Descubre cómo saber si tu hijo es realmente inteligente | Un Nuevo Día | Telemundo - Duration: 4:48.

-------------------------------------------

President Donald Trump Threatens To Cut General Motors Subsidies | TODAY - Duration: 3:06.

For more infomation >> President Donald Trump Threatens To Cut General Motors Subsidies | TODAY - Duration: 3:06.

-------------------------------------------

¡Lupillo y Juan Rivera visitan una cárcel de mujeres! | Un Nuevo Día | Telemundo - Duration: 3:04.

For more infomation >> ¡Lupillo y Juan Rivera visitan una cárcel de mujeres! | Un Nuevo Día | Telemundo - Duration: 3:04.

-------------------------------------------

¡La tumba de Chespirito no tiene ni flores! | Un Nuevo Día | Telemundo - Duration: 2:56.

For more infomation >> ¡La tumba de Chespirito no tiene ni flores! | Un Nuevo Día | Telemundo - Duration: 2:56.

-------------------------------------------

Horóscopo hoy, 28 de noviembre de 2018, por el astrólogo Mario Vannucci | Un Nuevo Día | Telemundo - Duration: 3:12.

For more infomation >> Horóscopo hoy, 28 de noviembre de 2018, por el astrólogo Mario Vannucci | Un Nuevo Día | Telemundo - Duration: 3:12.

-------------------------------------------

¿Se debe devolver el anillo de compromiso? #1 | Un Nuevo Día | Telemundo - Duration: 5:59.

For more infomation >> ¿Se debe devolver el anillo de compromiso? #1 | Un Nuevo Día | Telemundo - Duration: 5:59.

-------------------------------------------

¡Vuelve la nanny más querida, "Mary Poppins Returns"! | Un Nuevo Día | Telemundo - Duration: 5:16.

For more infomation >> ¡Vuelve la nanny más querida, "Mary Poppins Returns"! | Un Nuevo Día | Telemundo - Duration: 5:16.

-------------------------------------------

Ningún Médico Quiere Que Sepas: El CÁNCER MUERE Cuando Usted Come Esta Semilla - Duration: 4:08.

these are the 4 seeds with the most power anticarcinogen check these

powerful anti-cancer seeds are very efficient at the time of prevention

cancer or at the time of accompanying the treatment in recent years has been

discovered that in nature there are several ingredients with powerful

anti-cancer properties what could prevent the disease or be a

perfect complement for your treatment these anti-cancer seeds are

able to strengthen the system immune killing any agent

evil that is in him as they are by example cancer cells seeds

anticancer drugs that you need know seeds of apple seeds

of apple have been chosen by many professionals as one of the most

powerful anticancer substances natural has been shown

scientifically that the seeds of apple are able to prevent

cell formation origins of various types of cancer

like for example breast cancer cancer of colon cancer of lung cancer of

prostate cancer of the pancreas stomach photochemical compounds

present in these seeds anticancer drugs are much better at

time to delay the growth of cancer cells compared to

the drugs used in the process chemotherapy grape seeds

the extract obtained from the seeds of grape contains high doses of compounds

powerful in combating the Cancer

apparently the b2 c2 present in the seed confuses the environment in which

the cancer cells grow and they reproduce by making them die

it is quickly believed that the seeds of grape can reduce by 67% the

growth of malignant tumors seeds of flaxseed the lignans present in the

Flaxseed make this substance one of the most powerful seeds

anti-carcinogenic flax seeds They are also highly recommended for

to prevent and fight breast cancer that

powerful natural ingredient is capable of promote apoptosis of cells

tumors and inhibit anf and monya avoiding the appearance of metastasis

these seeds also contain high alpha linolenic acid levels a

omega-3 acid very effective in the fight against cancer and other diseases

apricot seeds said seeds anticancer drugs contain large

amounts of vitamin B 17 in your composition what makes them very effective

in the fight against cancer cells Vitamin B 17 is essential not only

to prevent cancer but also it is optimal support in the treatment of

disease to consume the seeds of apricot just break the fruit

with a hammer and take out the seed in almond shape present in its

interior it is important to keep in mind that the medications in this product

that are sold in pharmacies are not as efficient as the extracted seed

of the fruit itself if you feel the seed very bitter

you can mix with a little nut grated coconut or nutmeg recommendation

before consuming those seeds recommends consulting the doctor and not

replace functional treatment indicated to deal with cancer

but if you turn it into a complement you liked to know these seeds

anticancer drugs share with friends and friends

if you liked the video of a I like it Enroll in the channel and do not stop

share with your friends until the next video chao

For more infomation >> Ningún Médico Quiere Que Sepas: El CÁNCER MUERE Cuando Usted Come Esta Semilla - Duration: 4:08.

-------------------------------------------

Get 100% Results-tried & Tested | Best Way To Remove Blackheads From Cheeks | Remedies One - Duration: 4:16.

when making these homemade exfoliant you need to keep your skin type in mind if

your skin is too sensitive you may need to choose a smoother option today's

video will discuss three homemade exfoliant that get rid of blackheads

before you watch this video please take a moment to subscribe our YouTube

channel by clicking the subscribe button then tap the Bell icon so you will be

the first to know when we post new videos daily blackheads

are harmless they appear when fat accumulates in cavities and little by

little hardens the part that is exposed to the air oxidizes and takes on a black

color this is usually rather ugly luckily there are different homemade

exfoliant that can help you to get rid of them homemade exfoliants that

eliminate blackheads today we want to present three great homemade exfoliants

you'll definitely find all of the ingredients in your home as a result you

won't need to spend large amounts of money

one deep homemade exfoliant if you haven't ever cleaned your skin you

should start with an exfoliation this is one of the deepest treatments it helps a

lot when getting rid of blackheads however you don't need to do this more

than once per week this is because it can be harmful to your skin ingredients

one tablespoon of baking soda one lemon juice instructions one combine both of

these ingredients until you get a smooth paste to wash your face with warm water

and apply the cream with circular movements three move your fingers in all

directions in the most affected area for at the same time don't forget these

pieces of advice 5 don't put excessive pressure on your face 6 you can exchange

the baking soda for sugar however this is a bit thicker and could hurt your

skin you shouldn't use this treatment unless

the exfoliant is as smooth as possible 7 you should exfoliate each part of your

face for 4 minutes this will get rid of the impurities in your skin and the dead

skin cells on your face 2 paper towels and egg whites for removing blackheads

for this treatment you'll need paper towels or facial tissues and an egg

however you'll only use the egg white one first wash your face with warm water

warm water helps your pores to open this increases the extraction of your

blackheads it's important that your face is completely free of oil so that the

egg whites can fix themselves to the blackheads well to apply the egg white

all over your face with circular motions or only focus on the areas that you want

to remove blackheads from 3 then put a paper towel on your face after that put

another layer of egg white on the paper towel

this should soak it up for wait until it dries then remove the facial tissue or

paper towel from your face 5 almost like magic you'll find many of the blackheads

attached to the dry mask 3 tomato and yogurt 4 blackheads we choose tomatoes

because of their antiseptic properties you can blend them chat them or juice

them the yoghurt will help to moisten and remove oil from your face 1 mix both

of these ingredients then rub them on your face to take a few minutes to give

yourself a massage this has two functions on the one hand you're getting

rid of blackheads on the other the nutrients are getting into your skin 3

try to give 30 minutes of your time to massage your face with these ingredients

which method do you use to get rid of blackheads let me know in our comment

section below if you liked this video give it a thumbs up and share with your

friends for more daily tips subscribe to our channel below thank you