Shadowing Practice: Exposing The Flaw In Our Phone System - Learn English Speaking with Video
Creating lesson...
1
This is Linus from Linus Tech Tips and we hacked the phone network in order to spy on him.
2
That's pretty messed up, Derek.
3
I slept easier not knowing that.
4
We intercepted his phone calls and stole his two-factor passcodes.
5
Is that your number, Linus?
6
Yeah, but I didn't get.. mine didn't even ring.
7
We didn't touch his phone, we didn't send him an email or a text, nothing.
8
We did it all remotely.
9
And the worst part is, it could happen to you.
10
I think I'm really surprised that, no offense, but like, you guys did it.
11
You know?
12
Well, you're not a career criminal hacker mastermind, necessarily.
13
No, indeed.
14
But here it is, a normal looking and feeling device with no,
15
you know, obvious problem with it, and you just.. receive my call instead of me receiving it.
16
Just what, like on command?
17
You just, it's an app on your computer or what?
18
I don't even know.
19
But before we explain how we did all that...
20
The first startup that Steve Jobs and Steve Wozniak made wasn't Apple.
21
No, they were tackling a different problem, one where their product was actually illegal.
22
So back in the 1970s, long-distance phone calls were really expensive.
23
Adjusted for inflation, a call from New York to London could run you $25 a minute.
24
So these two entrepreneurs created a little blue box.
25
And what it did was it hacked the telephone network.
26
They could trick the telephone company into connecting the calls for free, among other things.
27
We were young, and what we learned was
28
that we could build something ourselves that could control billions of dollars worth of infrastructure in the world.
29
I don't think there would have ever been an Apple computer had there not been blue box.
30
Wasse said you called the Pope.
31
Yeah, we did call the Pope.
32
Wasse pretended to be Henry Kissinger.
33
And we got the number of the Vatican and we called the Pope.
34
They started waking people up in the hierarchy, you know, I don't know, cardinals and this and that.
35
And they actually sent someone to wake up the Pope
36
when finally we just burst out laughing and they realized that we weren't Henry Kissinger.
37
But how were they able to do all of this with one electronic box made from Radio Shack parts?
38
Until the mid-1920s, most phones had no way of dialing.
39
When your phone was on the hook, about 48 volts was connected from the exchange to your phone.
40
Then when you lifted the receiver, an internal circuit connected the speaker and microphone, drawing power, and that caused the voltage to drop to around 10 volts.
41
And at the telephone exchange, this drop turned on a light bulb, alerting the operator who would then pick up and ask who you're calling.
42
Boston?
43
Sir?
44
Get me the Bluebird Diner.
45
And after consulting a directory, they would connect a wire between your line and your friends.
46
Manually connecting calls was labor-intensive.
47
Operators had to handle hundreds of connections per hour.
48
In 1910, one pundit said, the telephone system will need to employ every working-age woman in the country as an operator.
49
By 1950, there were more than a million of them in the US alone.
50
To reduce costs, companies sought to automate the call connection process, and one solution was the rotary dial telephone.
51
To use it, you place your finger in a number hole, rotate it to the end, and the dial rotates back.
52
And on the inside, a metal disc with ridges turns.
53
Each ridge pushes two metal plates into contact, completing the circuit to the exchange.
54
The dial sends pulses to match each number.
55
For the number two, it sends two pulses.
56
For the number three, it sends three pulses.
57
This goes on up to ten pulses for the number zero, which is why zero is at the far end of the dial instead of beside the one.
58
Those pulses that travel down the phone line, they determine how your line is connected.
59
So they're known as control signals.
60
But as the length of the transmission line was increased, so did its capacitance and resistance.
61
And this caused the clear input signals to become distorted, smoothing out voltage changes.
62
So now the pulses couldn't trigger the switching at the exchange.
63
While this wasn't a problem for local calls, it made automating long distance almost impossible.
64
Now, all phone lines, including long-distance ones, were built to carry sounds in the human voice and hearing range, mainly from 300 to 3,400 hertz.
65
So why not use this built-in capability to carry control signals?
66
To do this, phone companies introduced the touchtone or push-button telephone.
67
On a keypad, specific frequencies were assigned to the horizontal axis and the vertical axis,
68
so that each button was uniquely identifiable by the combination of two tones.
69
By sending control signals within the voice band, all telephone networks could receive it using their existing systems, independent of distance.
70
But with this innovation came an opportunity for Jobs and Wozniak to exploit.
71
When you made a long-distance call, it was first routed to a central node.
72
This node communicated with a remote node, and they determined if a line was free by checking whether both sides were sending a 2600 Hz tone.
73
So Jobs and Woz exploited this.
74
First, they would dial a toll-free 1-800 number, which would get them into a local node.
75
and then they would send a 2600 Hertz tone into the phone.
76
This would trick the remote node into thinking the call had been disconnected.
77
So the remote node would start playing the 2600 Hertz tone again, but Jobs and Woz were still on the line and when they stopped playing the tone on their side,
78
the remote node assumed a new call was being placed.
79
By sending a key pulse tone, followed by the desired phone number and ending with a start tone,
80
they could connect to any long-distance number for free, as the home node still believed it was connected to a toll-free number.
81
The vulnerabilities in the signaling system were obvious.
82
To mimic the 2600 Hertz tone, some people would even use a toy whistle from a Cap'n Crunch cereal box.
83
It just happened to make that frequency.
84
The telephone companies clearly needed to develop a new signaling protocol, and their solution was to use a separate digital line for carrying control signals.
85
That way no one could control the network by sending tones down the voice line, because it no longer controlled how the call was connected.
86
This new protocol was called Signaling System Number 7, or SS7 for short, and it's still broadly in use today.
87
But it may not be as secure as people thought.
88
Princess Latifa of Dubai claimed that her father, Sheikh Mohammed, the ruling emir had held her in solitary confinement in the dark, beaten and sedated for several years.
89
In late February 2018, her Finnish martial arts instructor Tina helped her escape.
90
They fled to a yacht captained by former French intelligence officer Hervé Jaubert.
91
For eight days, they sailed toward India.
92
Latifa was hopeful, but it wasn't to last.
93
Late on the night of March 4th, a dark boat pulled up alongside.
94
It was sent by her father.
95
Laser sights pierced the smoke as agents boarded the yacht, abducting Latifa and taking her back to Dubai.
96
But how did they find her?
97
Well, the captain had been the victim of a coordinated SS7 attack, one aiming to pinpoint his location and,
98
by extension, the whereabouts of the princess.
99
And I'm going to show you how, using the exact same steps to spy on my friends.
100
With their permission, of course.
101
This is Karsten Nohl and Alexandre de Oliveira.
102
They are cybersecurity specialists who are helping me spy on Linus.
103
We took three steps to spy on him.
104
First, you have to infiltrate SS7.
105
Second, gain trust.
106
And third, attack.
107
Of course, the main reason any of this is possible is step one.
108
When SS7 was introduced in 1980, mobile phones barely existed.
109
They were so big that they were mainly just used as car phones.
110
But things changed quickly and the number of mobile phones in the world exploded.
111
Roaming is one of the main use cases of SR7.
112
Say Derek, you visit me over here.
113
Your phone would try to connect to a network that's foreign
114
and that network would then have to reach out to your home network in Australia asking, is this a valid customer?
115
Are you willing to pay for the charges that they'll incur on my network?
116
And all of that information is exchanged over SS7.
117
For this to work, telcos need to communicate with each other.
118
So the way they do that is by making sure they're part of the same club.
119
The way they share membership to to this club is by using unique addresses to identify where requests are coming from.
120
SS7 is a global network, just like the internet.
121
And like on the internet, you need some addressing scheme.
122
So you need some way of saying this is me and this is you.
123
And on the internet we use IP addresses, on SS7 we use what's called global titles, GTs.
124
So to provide global roaming coverage, telcos typically establish agreements with two providers in each country they serve, one primary and one backup.
125
Telcos generally accept messages only from global titles with which they have agreements.
126
The whole system is designed to be a closed network with few barriers once inside.
127
This is known as the walled garden approach.
128
So this system seems pretty secure, and it was.
129
When SS7 was developed in the 80s, the telecommunications landscape was dominated by a few large, reputable operators.
130
These operators had established relationships and mutual interest in maintaining the integrity of the network.
131
But 45 years on, the landscape has shifted dramatically.
132
Now there are over 1200 operators and 4,500 networks, many of which need SS7 access,
133
from virtual network operators to mass tech services sending Uber Eats notifications.
134
There are so many more players in the garden that not all of them are trustworthy.
135
Those companies, some of them sell services onto third parties, some of them can be bribed, some of them can be hacked.
136
So there's probably thousands of ways into SS7 at reasonable effort or cost.
137
How much are we talking?
138
Like, how much would it cost to buy access to SS7?
139
Buying a single SS7 connection isn't that expensive.
140
We're talking a few thousand dollars per month.
141
The people who do sell access, I mean, why would they do it?
142
People sell SS7 access for one reason, money.
143
And thanks to global agreements between providers, accessing a trusted GT is like gaining access to all the GTs they have partnerships with.
144
We even saw the invoice of a valuable US-based GT being leased illegally for $13,000 a month.
145
Are you buying access to SS7?
146
I'm paying for access to SS7, yes.
147
And we do that because we do SS7 security tests,
148
so we need to be in a similar position as real hackers to get near real results.
149
So step one, infiltrate SS7 is complete.
150
On to step two, gain trust.
151
Hackers today can try many different things once they've scaled the wall into the garden.
152
But you need more than just SS7 access and a phone number to attack.
153
Even a trusted GT and the phone number of the target isn't enough to uniquely identify them.
154
No, you need something from the SIM card.
155
The real key in a mobile network is a unique 15-digit identifier which belongs exclusively to the SIM card on the phone.
156
It's called an International Mobile Subscriber Identity, or IMSI for short, and it is very important.
157
Basically, to be able to collect the IMSI from a subscriber,
158
we would launch some of the messages such as send routing info or send routing info for SN.
159
These messages are normally used to collect the IMSI.
160
Networks have firewalls in place that will deny some requests if they look suspicious.
161
Getting an IMSI is crucial to appear trusted.
162
So let's move on to the critical step three, attack.
163
Do you want to just like try the phone?
164
Is there anything you can try to see if it works?
165
Like call someone or text someone?
166
Sure, I'll call my wife.
167
Does she normally pick up?
168
Yeah, she'll probably pick up.
169
Hello?
170
Hello, Yvonne.
171
This is the voice of your husband.
172
I would like to talk to you about the payment.
173
Um, okay, hi.
174
No, no, it's me, it's me!
175
Did she hang up on you?
176
Yeah, yeah, she did.
177
So we've established the phone works as a completely normal phone.
178
Do you have any important calls coming up?
179
I don't know if I'd say it's important, but I'm on my way to Creator Summit tonight, and James from Hacksmith was gonna call me, and we're gonna kind of make some plans.
180
Uh, I'm getting a call right now.
181
Are you getting a call?
182
No. Hello, this is Linus.
183
Hey Linus, it's James.
184
How's it going?
185
It's going really well.
186
How are you?
187
Pretty good.
188
Am I going to see you at the YouTube Summit?
189
Yes, I'm really looking forward to that.
190
And man, do I hate Macs.
191
I feel like that's your persona, man.
192
You can't game on a Mac.
193
Uh, Linus, you want to talk?
194
I would like to talk, but I never got the call, so...
195
What number did you dial?
196
4473 Is that your number, Linus?
197
Yeah, but I didn't get- mine didn't even ring.
198
I heard it ring, but I heard it through my speakers on my computer, because I assume it went to your phone then.
199
That's right.
200
Or did it go to your computer?
201
No, yeah, it went to everything of mine.
202
So, yeah, James, I don't know.
203
You called Linus and it went to me.
204
Thank you for taking part in this weird demonstration.
205
There is absolutely nothing here to indicate that I was supposed to receive a call.
206
Yeah.
207
And I mean, the crazy thing is that's like a regular Canadian SIM card in there.
208
So, any Canadian SIM card, in theory, could be vulnerable to such an attack, where, you know, someone dials your number and it just doesn't go to you.
209
This is like, freaking, but on a completely different level.
210
That's exactly it!
211
Now, I'm familiar already with the concept of SIM swapping, where you social engineer a way to get a SIM
212
that is registered to someone else's account actually had accounts stolen that way in the past.
213
But in this case, my phone still works.
214
Hey, so the demo we're doing is pretty trippy hun.
215
Basically, they had Hacksmith call me, my phone didn't ring at all,
216
and instead Derek from Veritasium picked up the phone call and was able to talk to him, and Hacksmith had no idea that he called me and then...
217
Sorry, I'm with Cindy.
218
Oh, oh, hi Cindy.
219
Oh, you're not a speaker.
220
Okay, that's fine, just tell Cindy hi for me.
221
Okay, bye.
222
So how are we able to seize control of Linus' number like that?
223
When you put a phone number in your address book, you often don't put the country code.
224
But then if you're in a roaming scenario, that phone number would connect to a completely different person in the country you are currently in.
225
So it does make sense to basically overrule people's choices as to whom they're trying to dial
226
because they're not going to triple check each time whether their address book entries have country codes in them.
227
This is a powerful function.
228
By tricking the network into thinking his phone is roaming, we can rewrite the number he is calling to a number that we control.
229
And so what I did at the end was when I received this message,
230
I sent back your number that you can see here was your US-based number.
231
So even if you were located in Australia, I was still able to forward the call to you on your US number in Australia.
232
That's amazing, you just try a few times and then it works, right?
233
Yes.
234
It's not always that simple.
235
But this time it was quite difficult.
236
So the most important question I have now then is, what did you need to steal from me in order to become me?
237
Like, is this something you can social engineer out of my carrier?
238
Is this something that I would need to accidentally leak a screenshot of my IMEI?
239
At the very simplest, all we would need is your phone number.
240
That's it.
241
You could even do something where I could act as a middleman where I would reroute the call to me,
242
but also simultaneously, I would dial for you the real number and I would send you through to them.
243
And then I can sit on the line and just record that call.
244
Yikes.
245
But this isn't the only attack.
246
We can do a lot more with SS7.
247
We can also intercept text messages as part of our suite of attacks.
248
Similar to phone calls, we can trick the network into thinking the target is roaming, which reroutes their messages to our GT.
249
We can then steal one-time passwords used in two-factor authentication.
250
This type of attack works until the subscriber interacts with their phone network, at which point the phone reconnects to the correct GT.
251
But you need a few seconds only to hack into somebody's account, of course.
252
You need that few-second window to receive the one-time password.
253
So we actually set up a new Linus YouTube channel.
254
Okay, so theoretically, he could get this username and password via a dump
255
because I'm a butthead and I use the same username and password across different accounts.
256
Or he could install a keylogger on my system he could get it that way when I'm typing it in.
257
So then I verify my number, but of course he has my number because that's realistically not that hard to find.
258
And theoretically, I'm supposed to get a two factor code right now, except...
259
I got it.
260
820299. I'm in.
261
He's in, he hacked the mainframe.
262
Wild, hey?
263
Yep, we can hack your YouTube account.
264
I'm going to start posting science videos on Linus Tech Tips.
265
Oh, that's okay.
266
I'm sure they'll get like 30 million views or whatever, so I'll be fine with it.
267
Thanks for the AdSense.
268
Deal.
269
And you could see the code right there.
270
Exactly.
271
So you could see it at the bottom, 820299.
272
So basically, once the interception is running, then I would receive any SMS sent.
273
He would never have known that he missed those messages or that they were intercepted.
274
Exact.
275
Wow.
276
Yeah, this seems pretty serious.
277
I mean, SMS two-factor authentication is almost the default, right?
278
Unfortunately, yes.
279
It's not only the default, but in some cases it is the only available option.
280
And sometimes that can even be for accounts that should be treated with the utmost of care, like a bank account.
281
There's a third method of attack that we weren't able to show Linus.
282
Lucky for him, his network blocked the requests.
283
On many networks, you can use the IMSI number
284
and the switching center info we harvested in step 2 to send a command deeper into the network.
285
By targeting the switching center where the device with the IMSI is connected, we can issue a command routinely used for legitimate purposes, such as routing and forwarding calls,
286
or providing emergency services based on the device's location.
287
Using this request, we can track a target's location.
288
It's not as hard as you'd think.
289
SS7 doesn't even rely on GPS to locate someone.
290
In fact, it was invented before GPS was even in public use.
291
One way to do this is if a target is in range of multiple cell towers, their location can be narrowed down to where the signals overlap.
292
The more towers in range, the more precise the location.
293
A more accurate method measures the time it takes for signals to reach a phone from three towers.
294
By calculating the distance based on transmission speed, we can pinpoint an exact location on a 2D plane.
295
But SS7 attacks don't use either of these methods.
296
They try to be subtle.
297
An SS7 location request simply identifies the cell tower the target is connected to.
298
In an urban area with many towers, this can place them to within 100 meters.
299
You will definitely know which city block somebody is in.
300
And if you wanted to, for instance, find out whether they're at home or at work, this is a great way to do it.
301
Yeah, that's a little bit scary.
302
In 2016, Karsten and his team used this method to track US Congressman Ted Lieu.
303
The Congressman has been in California, more specifically the LA area.
304
Let's zoom in here a little bit.
305
So that is how we did it.
306
We executed three steps.
307
We infiltrated SS7, gained trust and attacked.
308
We intercepted Linus' phone calls and text messages.
309
I'm not sure he was as excited about it as I was.
310
This is why we can't have nice things.
311
Up until now, this has just been a bit of fun.
312
I've demonstrated these attacks on a friend of mine.
313
But the threats are real, and they can have devastating consequences.
314
They will kill her, the captain texted shortly before Latifa was abducted.
315
His phone was the target of an SS7 attack that involved all three of the steps we explored.
316
To start, the attackers had leased multiple GTs in different countries.
317
Then the following all happened in a five minute window.
318
First they sent at least seven separate requests aiming to get the captain's IMSI from his US based operator.
319
When that didn't seem to work, they followed up with at least four location requests.
320
So did it work?
321
Well, all of these requests were blocked by firewalls.
322
That's why we have all the details.
323
But there was a sixth GT we haven't shown, this one nearby in the US.
324
We have no information about the requests on this GT because they likely weren't stopped.
325
We spoke with Crofton Black, the investigative journalist who revealed the SS7 exploits in this story, and this is what he told us.
326
It's a brilliant example of SS7 involvement because it illustrates a classic, sophisticated pattern of attack.
327
Multiple GTs in multiple countries, it's a textbook example of telco penetration risks.
328
Though because the Emiratis were also using other software like Pegasus and other hardware like spotter planes,
329
we can't say that any single one of these was the thing that led to her being found.
330
But the evidence is damning, and SS7 is used pretty widely.
331
Criminals have used SS7 to intercept SMS two-factor authentication codes and empty millions of dollars from bank accounts.
332
For some, SS7 is just the first step.
333
The NSO Group, a notorious Israeli cyber surveillance firm, acquired an SS7 tracking company in 2014.
334
NSO is the company behind Pegasus, a spyware tool that gains complete access to targeted phones without a user clicking anything,
335
embedding itself and erasing traces of entry.
336
Such zero-click hacks are costly.
337
They can cost more than $4 million per exploit.
338
Before NSO commits resources targeting specific software or vulnerabilities on a phone, first they gather basic data, like device type and software version,
339
to make their lives easier.
340
And as you've seen with SS7, this isn't hard.
341
One expert we spoke to tested a foreign network and found 20 to 30 VIPs were constantly under surveillance there,
342
including the country's chief of cybersecurity.
343
Accurate data on tracking is difficult to come by, but another expert provided evidence of more than two and a half million tracking attempts per year,
344
though they reminded us that the people being targeted are generally those of interest to state agencies.
345
Now, we couldn't find data on interception attempts, but luckily experts told us this is far less common.
346
So millions of malicious SS7 requests are sent each year, but it used to be even worse.
347
To request location over SS7, you used to be able to send a command without even knowing the IMSI, and the network would just provide it to you, no questions asked.
348
The classical example is the anytime interrogation request, which as the name already suggests is kind of a creepy command.
349
I don't believe there is ever legitimate purpose for one network to send this command to another network interrogating about their customers.
350
Karsten Noll and fellow security researcher Tobias Engel exposed these vulnerabilities publicly in 2014.
351
The SS7 research that was disclosed in 2014 was a wake-up call to the industry.
352
Most people had heard rumors that SS7 tracking and spying was possible, but they hadn't really seen hard evidence of it, and especially how easy it is.
353
That a ragtag gang of hackers from Berlin with very amateur means can do any type of SS7 hacking that they want.
354
After their conference, all of the German telcos immediately started refusing these requests.
355
Anytime integration is the first SS7 command everyone stopped because it was abused a lot and never used constructively,
356
but there is over 150 other messages that need to be stopped as well to make SS7 be completely secure.
357
So if there are so many ways to abuse SS7, why haven't we gotten rid of it?
358
Well, because it's the backbone of 2G and 3G communications.
359
So what if we phase out 2G and 3G?
360
that has caused problems.
361
Since 2018, cars in the EU are equipped with mandatory emergency call buttons that trigger in an accident.
362
They need a SIM card to work.
363
And to cut costs, guess what auto manufacturers are using?
364
That's right, 2G and 3G SIM cards using SS7.
365
You have to have that legacy support or when 4G connectivity drops, you have absolutely nothing left.
366
Dude, the number of times that I'm on 3G, not insignificant.
367
And I'm in a metropolitan area.
368
What's surprising of course is
369
that there hasn't been a global push yet to replace SS7 with one of the two newer versions of the technology,
370
the latest of which that was introduced with 5G, seems pretty secure, but that's now a problem of first mover disadvantage.
371
So because of the the network effects, you get nothing out of adopting a technology as the first guy.
372
You want to be the last one when everyone else is already connected
373
and you get the full benefit from also joining the club.
374
So even though the 5G signaling protocol can stop the attacks completely, and many networks are using 5G technology on their networks, when routing calls between networks,
375
SS7 is still the de facto standard.
376
You create a tremendous amount of inertia, to use a term that's probably more your channel than my channel, that makes moving on extremely difficult.
377
So unless there's some new major events that put this back on the public radar, it could be another 10,
378
15, maybe even 20 years until SSF networks are finally switched off.
379
What's crazy is that we exploited these vulnerabilities and I'm just a YouTuber.
380
I did have the help of some excellent security researchers, but I'm surprised at how easy it all is.
381
Now imagine if I had the backing of a government.
382
This is a real problem.
383
So what can you do to protect yourself?
384
On the personal side, as long as you have a SIM card, unfortunately there's not much you can do about location tracking.
385
If possible, choose alternatives to SMS-based two-factor authentication, so messages can't be intercepted.
386
Use an authenticator app or hardware tokens.
387
And if you're worried about phone tapping, use encrypted, internet-based calling services like Signal or WhatsApp.
388
We've been told this is mainly used on people of interest.
389
So should it really matter to you?
390
SS7 is a huge privacy intrusion and there's millions of abuse cases every single month.
391
Whether privacy intrusion is a problem for everyone individually, of course, is almost a philosophical question, right?
392
Somebody who grew up more in the Berlin tradition of the Chaos Computer Club, like myself, strongly believes that privacy
393
and the ability to kind of form your own thoughts without being observed is a prerequisite for democracy.
394
But many other people would argue, nothing to hide, nothing to fear.
395
Our technological world will never be perfect.
396
By the time we secure or replace SS7, vulnerabilities will already have been found in the new system.
397
But luckily, there's an easy way to be ready for whatever the future holds.
398
Build your knowledge and problem solving skills a little bit every day.
399
And you can start doing that right now for free with this video's sponsor, Brilliant.
400
Brilliant has thousands of interactive lessons where you can learn by doing, making you a better thinker and problem solver.
401
You build real skills in everything from math and data analysis to technology and programming, you name it.
402
Brilliant is designed to be uniquely effective.
403
Their first principles approach helps you build understanding from the ground up, so you'll not only gain knowledge of key concepts, you'll learn to apply them to real-world situations, all while building your intuition,
404
giving you the tools to solve whatever problems come your way.
405
Brilliant's new course on data clustering, for example, equips you with the same tools security researchers like Karsten used to spot trends among the billions of SS7 messages.
406
This is really helpful when hunting hackers, but the concepts you'll learn also help navigating a world where
407
data influences everything from what movies are being recommended to national politics.
408
And one of the best things about Brilliant is since every lesson is bite-sized, you can build your skills and sharpen your mind whenever and wherever you have a few minutes,
409
helping you build a daily learning habit that sticks, the opposite of mindless scrolling.
410
To try everything Brilliant has to offer for free for 30 days, visit brilliant.org slash Veritasium.
411
Or you can scan the QR code or click that link in the description.
412
You'll also get 20% off an annual premium subscription.
413
So I wanna thank Brilliant for sponsoring this video, and I wanna thank you for watching.
📺 Same Channel
C11
Something is jamming GPS over Europe. Here's what we found
IELTS PrepTOEFL PrepUniversity Students
C11
Why It Was Almost Impossible to Make the Blue LED
Business EnglishUniversity StudentsWorking Adults
C12
You've (Likely) Been Playing The Game Of Life Wrong
Business EnglishUniversity StudentsWorking Adults
B22
We're trying something new...
C120
How does light 'know' the shortest path?
IELTS PrepTOEFL PrepUniversity Students
C12
The CIA's new tech doesn't make sense
IELTS PrepTOEFL PrepUniversity Students
C11
Why does every mammal get 1 billion heartbeats in their life?
IELTS PrepTOEFL PrepUniversity Students
C13
Why Cold Drinks Were Deadly Before 1914
Business EnglishUniversity StudentsWorking Adults
C12
Our Greatest Delusion
IELTS PrepTOEFL PrepUniversity Students
C13
The Most Controversial Problem in Philosophy
IELTS PrepTOEFL PrepUniversity Students
B25
Why Boredom is Good For You
Daily ConversationUniversity StudentsWorking Adults
B24
Why Are 96,000,000 Black Balls on This Reservoir?
IELTS PrepTOEFL PrepUniversity Students
C13
We've Been Using The Wrong Science In Court For 50 years
IELTS PrepTOEFL PrepUniversity Students
B24
Explaining Pi With Pizza
University Students
B214
5 Fun Physics Phenomena
Daily ConversationUniversity Students
C11
The Most Misunderstood Concept in Physics
IELTS PrepTOEFL PrepUniversity Students
B11
Falling ladders - why does this happen?
IELTS PrepTOEFL PrepHigh School Students
C110
How a slinky falls in slow motion #shorts
University StudentsWorking Adults
C13
We're 99.9% sure this pattern is true, but no one can prove it
IELTS PrepTOEFL PrepUniversity Students
C15
The Science of Thinking
Business EnglishDaily ConversationUniversity Students
✨ Recommend Video
B2276
24 sentences
How Cell Phones Impact Our Relationships
Business EnglishDaily ConversationUniversity Students
C13
78 sentences
Tragic mistake... Anthropic leaks Claude’s source code
American AccentBusiness EnglishUniversity StudentsWorking Adults
B2282 sentences
Steve Jobs Interview - 2/18/1981
Business EnglishInterview EnglishUniversity Students
C11
284 sentences
How to Become Your Own ISP
Business EnglishUniversity StudentsWorking Adults
B21
231 sentences
Destroying a scam call center
Business EnglishUniversity StudentsWorking Adults
C11
40 sentences
The Engineering that Runs the Digital World 🛠️⚙️💻 How do CPUs Work?
Business EnglishUniversity StudentsWorking Adults
B2371 sentences
Building the world's largest WORKING iPhone!
Business EnglishUniversity StudentsWorking Adults
C11
101 sentences
Yes, Prime Minister - The need to know
Business EnglishUniversity StudentsWorking Adults
C11
54 sentences
Traceroute: You're Probably Reading the Results Wrong
Business EnglishUniversity StudentsWorking Adults
C13
246 sentences
$15 Trillion Money-Making Machine | How BlackRock Became Too Powerful to Ignore
Business EnglishDaily ConversationUniversity Students
C11
207 sentences
How I Made $30,000 Hacking Broken Access Control
Business EnglishUniversity StudentsWorking Adults
B21
74 sentences
Why Android is Simply Better Than iOS
Business EnglishUniversity StudentsWorking Adults
Who Will Benefit from This Video?
This video is perfect for intermediate English learners ready to level up their listening and speaking skills. Whether you’re prepping for IELTS speaking practice or just want to understand real-world conversations better, the mix of casual dialogue and technical explanations keeps things engaging. It’s ideal for those who learn best with authentic content—you’ll pick up natural phrasing while exploring a fascinating topic. Plus, the conversational tone makes it great for shadowspeak practice, where you repeat phrases aloud to mimic rhythm and intonation.
Words & Idioms to Add to Your Toolkit
Here are standout terms from the video that’ll make your English sound more native:
- Messed up: Confusing or wrong. Example: “That hacking trick is really messed up!”
- On command: When something happens immediately after being asked. Example: “The device can intercept calls on command.”
- Burst out laughing: Suddenly start laughing. Example: “They burst out laughing when the prank worked.”
- Labor intensive: Needing a lot of work. Example: “Manual call connecting was labor intensive.”
How to Nail the Pronunciation
The speakers in the video use a clear, conversational American accent—great for improve English pronunciation practice. Focus on these tips: - Reduction of “did it”: In “how we did it,” the “d” in “did” softens, making it sound like “how we di’ it.” - Stress in multi-syllabic words: “Infrastructure” (in-FRA-struc-ture) and “capacitance” (ca-PAC-i-tance) have stress on the second syllable—listen closely to match this. - Intonation in questions: When Linus asks, “Is that your number?” his voice rises at the end. Practice this with a shadowing app to sound more natural. Repeat short clips aloud, pausing to mimic the pace and tone—you’ll notice progress in no time!
Grammar in this video
The structures the speaker uses most, with the exact words from the video:
| Structure | In the video |
|---|---|
| “Used to” used to + verb — a past habit or state that is no longer true | used to collect · used to be · used to spot |
| Present perfect have/has + past participle — a past action that still matters now | has shifted · they've scaled · we've established |
| Passive voice be + past participle — the focus is on what happens, not who does it | was connected · is connected · was increased |
| Relative clauses who / which + clause — extra information about a person or thing | zero, which is · people who do · Somebody who grew |
What is the Shadowing Technique?
Shadowing is a science-backed language learning technique originally developed for professional interpreter training and popularized by polyglot Dr. Alexander Arguelles. The method is simple but powerful: you listen to native English audio and immediately repeat it out loud — like a shadow following the speaker with just a 1–2 second delay. Unlike passive listening or grammar drills, shadowing forces your brain and mouth muscles to simultaneously process and reproduce real speech patterns. Research shows it significantly improves pronunciation accuracy, intonation, rhythm, connected speech, listening comprehension, and speaking fluency — making it one of the most effective methods for IELTS Speaking preparation and real-world English communication.