Just be a minute more as we get soft ice running, things like that, get our presentations done. Presentation was originally developed for an hour and 30 minutes. However, this time slot's an hour and 50. I mean, 50 minutes, and we've already filled like 7. Therefore, we may run a little bit late if we need to leave at 3. However, I will blow through the first 20 slides in about 2 minutes because we don't have time to get them in. And Sherry does the interesting slides, so I will introduce her soon. My name is Jamie Butler. I'm from Rookit.com. This is Sherry Sparks, and we developed a project called Shadowwalker, and it's to hide Rookits. You can find the description of this talk probably later on Rookit.com, so the source code I believe Sherry has composed it. Also, it will be in FRAC 63 that if it hasn't appeared on already, probably the next week or two will be there. If you don't understand much about Rookits or you are new to the Windows world of Rookits, you can go to Rookit.com. We posted it there for free. There's a lot of source code for free. Nothing there is for pay. Or you can buy the book Rookit. Rookit's supporting the Windows firmware by Greg Hogan and myself. So we'll get started with Shadowwalker. So quick, blow through Rookits. They don't propagate themselves, they're not like a virus, they're just here to provide stuff. So the attacker gets on the box and they try to maintain presence. They don't want to keep using their Zero Day to come back all the time to the machines, so they install Rookit. Rookit is there to hide their presence and also to give them future access at a later date. Rookits could also be used for all source code for things like a slaking peak or a properly executed search warrant and so forth. There's two levels of protection within the Windows and Linux operating system. There's basically two rings, ring zero, ring three. Ring three is user land processes. They are unprivileged. Ring zero is kernel land. Once you are in ring zero, your kernel Rookit can do whatever you want. Operating system provides basically an intermediary between upper level user processes and things that they want to query the operating system for. So I want to open a port. The operating system does that for you and then hands it back to the user land process. They also provide an interface between user land processes and the lower hardware. So if you have a ring zero kernel Rookit, you are just like the operating system you are a man in the middle. Some of the different OS components that a Rookit may want to attack would be the IO manager. You can install key longers. Sharing has a project on Rookit.com. That's a keyboard slipper. And you can also attack the file system. You can write your file filter driver and interface between every single access of the hard drive. The object manager has things like processes and threads that it uses to keep bookkeeping. And you can attack the object manager in order to hide your processes and threads. That's enough for that configuration manager to use at the average speed. So first generation Rookits, what were they? These were simple and trigonized replacement programs in the hard drive. They may include the Unix login program, LS, PS, so on and so forth. Second generation Rookits, they started to get more to be more sophisticated. These modified static tables within the kernel are within the upper levels of the operating system themselves. So you can replace the import address table of a PE file and alter the execution path in a command. You can also alter the system call table within the kernel. And that will zero and change what function actually gets executed within the kernel when the user requests them. Third generation Rookits, we term these, they use DECOM direct current object manipulation. These actually don't click anything because hooks are a bit easier to detect. Third generation actually manipulate the data structures in memory. So there's no code off, you don't alter the code at all, you just alter the data structures themselves. This is almost undetectable. Data structures come in very frequently and they're constantly changing, that's why they're in the data section. This is very hard to detect and we'll talk about how you can use this to hide processes and threads if you want to. Or you can even use it to hide drivers, escalate processes, privileges, use tokens, etc. So real quick, about two years ago at one of the Blackhats and all the slides are online, you can see process hiding with DECOM. Also mentioned a little bit last year when I talked about vice. What the kernel uses to keep track of all the processes is this list of active processes. Every E-process block you see there represents an individual process in the system. This individual process could be your little hacker program. It's doing things and you don't want the system administrator to know you're there. If you simply unlink, at the bottom slide you see that there's a series of links. If you simply unlink the process that you want to have hidden, it will disappear when you try to list it out. So when you run task manager, etc., it won't be there. Now per group of detection methods, there's basically four types. You don't have time to go into all of these. But just quickly, behavioral, integrity, signature-based, and difference-based. So when there's AB products, basically, example, signature-based, integrity checkers such as chip wire, check some of the disk files so that if you replace it with charging it will be found. Different-based purges is kind of a new thing. Microsoft's doing it, F-Secure's doing it. It's just internals. What this is, it does some kind of low-level scan within the kernel about following structure directly. Tries to get a list of things like files and processes, registrities, etc. Then it does an upper-level API call. If there's a difference, it knows something's up. Behavioral detection. At least you try to detect the effects of a rootkit. So you might want to look for alterations in the execution path. Or if one is actually executing a different program. So like system calls or they're ordering, etc. We don't have time to go into more of that. But everything's checking exactly. It's a CRCD. This could be on-disk or in-memory. However, hardly anyone is going to remember. Signature-based, you scan memory or on-disk. For a particular set of points that represents the mal code. So we have a really powerful way to hide rootkit or high-processes, etc. within the kernel.modify-modify status structures. However, if you look for our driver, because we are in the kernel, so we have a kernel-level driver, you can just do a simple scan, like signature scan, through the presence of the malware. And that's not very good. So what we want to do is to try to shake it up. So even if you scan memory, you can't detect all that outcome trouble. So again, if you rootkit, you want to make sure you can't detect, or rootkit can occur. So this is a problem that viruses have to face for a long time. And they use tools that probably work with little stuff around it. However, in the kernel, it gets more problematic to build a good polymorphism code. Also, no one's doing it other than Holy Father and then in his hack or tender. And you have to get here to handle that. And I think it's like 40 euros every time he does it. So really quickly, we're going to walk through how we have this in the lake and share it with people. Thank you, Jamie. I'm going to be discussing the technical implementation of Shadowwalker, which is our rootkit hiding technology. Like Jamie said, polymorphism has not really been seen a lot in rootkit so far, but it's not really an optimal approach for a rootkit. Viruses need to hide their code. Rootkits not only need to hide their code, but they also need to hide changes to operating system components. Polymorphism is not necessarily an optimal solution for that when you consider that you have the memory-based equivalents of, say, Tripwire or other types of integrity checkers. So basically, what we wanted to do is we wanted to figure out a way to hide in memory such that we actually hook the memory of the system without actually changing the code at all. And that gave rise to Shadowwalker, which we're pointing kind of as a prototype for the fourth generation in rootkit technology. Basically, the alternative to polymorphism is virtual memory subversion. Basically, what we're going to be showing you today is a proof-of-concept demonstration that a rootkit is capable of transparently controlling the view of memory seen by user applications, kernel drivers, and the operating system itself. Now, the cool thing about this technology is the fact that there's a minimal performance impact. Because we exploit some features in the hardware, that means that basically our memory hook engine hiding a rootkit is virtually undetectable. It has no slowdown or system performance hit. Obviously, this makes this type of technology attracted to not only a rootkit, but also to maybe a virus or worm or spyware applications. Just a few implications of virtual memory subversion. For a long time, rootkit scanners relied upon the integrity of the operating system API. Like Jamie mentioned, ever since the second generation rootkits, rootkits have been hooking the API, and upper-level processes can no longer trust the results returned to them by the API, either the user-level API or the kernel-level API depending upon where the rootkit is hooking. Basically, rootkit scanners have gotten a little bit smarter. They're starting to realize that they can't rely upon operating system APIs anymore. But even those rootkit scanners said don't rely upon operating system APIs, they still rely upon the integrity of the virtual memory system. Therefore, when a security scanner does a read of a certain memory address, it expects to see the data that's actually stored at that address. What we're proposing is actually to return some data that is in fact not actually stored at that address. Basically, there are two implications here. If we can control a scanner's memory read, then we can pull signature scanners and potentially make a known rootkit or virus to code immune to an in-memory signature scan. Because basically, the scanner will access the range of memory where the rootkit code is stored, and it will be returned data which is a clean copy or does not have the rootkit code. We can also pull integrity checkers, those kind of checkers like Jamie Butler presented a talk on a tool called device which basically attempts to detect hooks. Hooks typically work by replacing the beginning of the function prolog in an API with a jump instruction to a stub which is the rootkit code. So basically, under normal situations, you would not expect to see the first instruction in an API to be a jump instruction. The normal code would be such stuff as stack set of code, allocation of local variables. So basically, Jamie uses characteristics like this to determine if functions are hooked. Basically, the implications for this is that if we are subverting that particular function in memory, the scanner would perform a read and it would receive a clean copy of that API function code, yet the actual code that is executing is actually the hook code. Since we're going to be talking about this aversion of virtual memory, we're going to need to do a little bit of a review. This is stuff that's normally covered in a college-level operating systems class, but I know that for most people, we probably need to review some of this stuff. First thing we're going to talk about is virtual address space layout, and then we're going to talk about some of the concepts of virtual memory. We're going to go over the ideas of paging and segmentation, page tables and PTEs, how virtual to physical address translation actually occurs, what the page fault handler does, and then some performance issues associated with paging and how those are actually mitigated using a hardware solution or the translation look-aside buffer. Finally, we'll talk about different memory access types and some little eccentricities with the X86 architecture. So basically what you have here is a layout of the most common, the two most common layouts for the Windows virtual address space. The first one breaks the virtual address space up into two main components. Like Jamie said, we have two modes of operation under Windows. We have a privileged mode, which is basically kernel land, and we have a non-privileged mode, which is basically user land. The memory address space is arranged similarly to that. The lower two gigabytes corresponds to user land address space. That's going to contain your application code, DLL code. The upper two gigabytes is going to be where the operating system kernel is. In the upper two gigabytes, you're going to have N2S kernel, HAL hardware abstraction layer, move drivers. We're going to have key operating system structures, the process objects that Jamie was talking about, process page tables, and then non-page pool and cache memory. Alternatively, we have a second address space layout, which has been used on some of the server 2003 systems, which actually allows you to expand the user address space up to 3 gigabytes. By far the most common layout is going to be the one where it's split in half. So basically, what is the main idea behind virtual memory? Basically, the idea is we want to separate the virtual from the physical address spaces, or separate the virtual and physical address spaces. By that, what I mean is the virtual address space, the size of it, is going to be defined by the size or the width of your memory bus. So if you have a 32-bit system, that means that you have the ability to address 2 to the 32, or approximately 4 gigabytes of continuous memory locations. So therefore, your virtual address space spans from 0 up to 4 gigabytes. In contrast, most of us don't really have 4 gigabytes of RAM installed on our system unless we're really lucky. So therefore, we can say that our physical address space is constrained by the amount of RAM on our system. And the amount of RAM is most likely going to be less than the 4-gigabyte limit for the virtual address space. So basically, virtual memory concerns managing these virtual and physical address spaces by dividing them into fixed-size blocks. If those blocks are all the same size, we have a paging architecture. If those blocks may be variable sizes, it's a segmentation architecture. The x86 architecture is actually a combination of segmentation and paging. However, for the purposes of our talk, we're focusing upon the paging architecture because that's the level that we're going to subvert. As far as how this map... There's actually mapping information that actually maps a virtual block to a physical block. And the OS is what actually maintains this mapping information and determines which virtual blocks map to which physical blocks. Like I said before, the virtual address space may be larger than the physical address space. And also because the OS is managing this mapping, virtually continuous memory blocks do not need to be physically continuous. This actually shows an illustration of those two points on the previous slide. As you can see, we have our virtual address space divided up into blocks. Under a paging architecture, we call these blocks pages. The physical address space is smaller than the virtual address space. It's also divided into big-size blocks. This is termed frames. Basically, as you can see, the virtually continuous blocks do not necessarily have to be physically continuous. So what actually maintains this mapping information that the OS uses? This mapping information is contained in page tables. And page tables consist of entries called PTEs, or page table entries. Page table entries contain at least two pieces of useful information. They contain status information and they contain mapping information. The page frame number bits are the bits that actually describe where that page actually maps to in physical memory.  A few of the most important ones would be the V there for valid. That's going to determine if the page is actually resident in memory or if it's been paged out to the disk. You have the writable bit, which is going to be concerned with protection, whether or not that page is read only, or whether it's going to be writable as well. You also have some bits, the cache disabled, the dirty bit. These are bits that the OS uses in its virtual memory management for page swapping and such. And then the last bit of kind of a venture is going to be the global bit. The global bit is interesting because it determines whether or not this particular mapping information will be flushed from the hardware cache on a context switch. This actually becomes important later on. So basically, here's an illustration of the big picture just to kind of summarize all these ideas. We have our virtual address space layout divided into user space and kernel space. We have our pages, which are the divisions of the virtual address space. We have process page tables located in the kernel memory section. Process page tables contain PTEs, which contain status information and mapping information, which will basically say where those pages are located out in physical memory. So how do you go from an address to actually figuring out where that particular page is in the page table? Basically, virtual addresses encode the information necessary to index into page tables. Page tables may actually be single-level or multi-level. The x86 maintains a two-level paging architecture. Basically, we divide the virtual address into two pieces. We're going to divide it into the virtual page number, which is going to contain the page table indexing information, and we divide it into the byte index, which is going to contain an offset from the physical frame in physical memory. So basically, the virtual page number, in this case, since we have a two-level architecture, basically what that means is not only do we have a page table, we also have a page directory. And basically, the page directory is a table of pointers to page tables. And the page tables, of course, mean pointers to physical frames. This actually is used, a two-level scheme is used to actually to save memory, since the page directory is going to have to be resident. So basically, in this case, our virtual page number is actually divided into two pieces. We have to be able to figure out the index into the page directory so we can locate the correct page table, and then we have to figure out the index into the page table so we can locate the correct page frame. So basically, under x86, the upper 10 bits in the virtual address are going to provide your index into the page directory while the middle 10 bits are going to provide your index into the page table. This slide gets a little bit complicated, but I'm going to give it a go here to try to explain it. Basically, there's a number of steps involved in virtual to physical address translation. This is performed by the hardware. The first step is going to be to locate the page directory, the base address, the page directory in memory. The page directory base is actually located in the page process block. Physical address is also located in CR3, which is the control register on the processor. So basically, the first step is to locate the base of the page directory. The second step is going to be to locate the actual entry in the page directory that contains the pointer to the page table that we need. So basically, we're going to extract the upper 10 bits from the virtual address and use that to add to the page directory base to obtain the entry in the page directory table. Now, the contents of this page directory entry is basically the pointer to a page table or the base physical address of the page table in memory. So now at this point, we have the base address of the page table, and now we're trying to get to the PTE or the entry in the page table. So to get to the page table entry, now we do the same type of thing. We take the middle 10 bits of the virtual address and use that to add to the base address of the page table, and we now get the actual page table entry, which is going to contain the pointer to the page frame in physical memory. So now at this point, we have a pointer to the page frame and we're actually looking for some byte within that frame. So it's finally at this point that the actual byte index comes in and we add that to the base address of the physical frame to actually resolve the full physical address. Like we said earlier, the physical memory, maybe smaller than the amount of virtually addressable memory you have. So therefore the OS may need to move some pages from main memory out to the disk to satisfy current memory dimensions. Basically, when the OS does this, it marks the PTE for the page in question as invalid, writes it out to the disk, and the next time that page is accessed, it's going to generate a page fault. A page fault is basically just an interrupt that's going to cause a vector to an interrupt service routine, which in this case is going to be the page fault handler. There are actually several conditions where a page fault can occur. The most common condition is going to be the case where the page table entry is marked invalid and that page has been swapped out to the disk and needs to be brought in. There's a little caveat to that, because not only does the PTE need to be marked invalid, that entry cannot be present inside the TLB or the hardware cache of virtual to physical mappings. This becomes very important later on. The second situation where you can have a memory protection violation is going to be basically user mode code attempting to access kernel memory or perhaps an attempt to write to memory that's marked as read only. For all of you guys that I lost on that previous slide of virtual to physical translation, I have a little bit clearer one that shows the whole page fault path. Sorry about that. Space bar from now on. First thing, you have a memory access. The first thing we do is we need to look it up in the page directory to resolve the actual page table. In this case, it's present. We can move on and go out to the page table. In the page table, we're trying to look up actually where the physical frame is. In this case, that particular PTE has been marked invalid and the page fault is generated. This causes the page fault handler to be involved. The page fault handler now is responsible for issuing the disk IO to go out to the page file and load that frame back into main memory. Once it's loaded back into memory, it now marks the PTE as valid. Some people would say that PTE is not such a good idea. This is because there's this deep performance hit associated with paging. Basically, we take one memory reference and we turn it into three memory accesses. We're cutting our performance by a factor of three. Basically, the first thing, we have to access the page directory. That's one memory reference. We have to access the page table. There's another memory reference. Now we have to actually go out and get the bite at the correct physical address. There's our third memory reference. Actually, in the best case, every single memory access requires three memory accesses to resolve the virtual to physical address. In the worst case, not only do we need three memory accesses, now we might potentially need two disk IO's because since we have a two-level paging scheme, our page tables may be non-present and our actual page frames may be non-present as well. Therefore, you may have up to two additional disk IO's. As you can see, paging introduces a speed performance hit. Hardware designers found this to be unacceptable and they developed a solution for this to help mitigate this problem. Their solution was the translation look-aside buffer. The TLB is basically a high-speed hardware cache generally implemented in associative memory that holds the most frequently used virtual to physical mappings. Basically, the TLB caches the information held in the PTEs for certain pages that are used frequently. The TLB is actually a lot smaller than main memory which means that it's possible that an entry in the TLB could actually be evicted if another page that maps to that TLB entry needs to be loaded into the TLB. Basically, the TLB is actually first on the memory access path. It sits in front of the page table path. Therefore, on the memory access, the TLB is actually searched first before we ever even go out to the page tables. Since it is high-speed associative memory, that means that a reference found in the TLB can be resolved much, much faster than it can be resolved by even going out and doing a single memory reference in main memory. If that reference is actually found in the TLB, we say it was hit. If it was not found, we say that we had a miss. The x86 actually uses a split TLB architecture, and what I mean by that is there's actually two TLBs. There's one that holds translations for code, that's the ITLB, and there's another one that holds translations for data, that's the DTLB. I should note that modern TLBs have extremely high hit rates, which means that most translations are actually resolved via the TLB cache as opposed to actually having to go out to the page tables, which significantly increases performance. This is just a simple example of a TLB search. Basically, the TLB is a cache. It consists of two parts. You have a tag, which in this case is going to be the virtual page number, and then you have the corresponding frame that maps to that virtual page number in the data section of the cache line. Basically, when a memory reference occurs, the TLB tags are going to be searched in parallel to see if they can find a match on that virtual page number. If they can, the data or the corresponding physical frame mapping is going to be returned. In this case, we had a TLB hit on virtual page 17, and its corresponding frame is 84. Basically, here I have an illustration of the memory access path that includes a TLB. We're also going to stick with the x86 architecture, which actually has a split TLB. That means that on a memory access, code accesses are going to be checked in the ITLB. In this case, we have a hit on the ITLB. We now have the corresponding frame, which is 132, and we can go directly out to physical memory. In this case, as you can see, since we had a TLB hit, we were able to completely bypass the page tables. It may be possible that we don't have a TLB hit. We could get a miss, and what's even worse than a miss, now that we have to go out to the page tables, now we might actually get a page fault, which will kill performance even further. In this case, our memory access is a code access. It goes out to the ITLB, searches it, is not there, so now we have a miss. Now we have to go out to the page tables. In this case, we go out to the page tables, and we find something we need is not present. So we have a page fault. Now the OS page fault handler has to be invoked. It has to go out to the disk, bring that frame into memory, and finally mark that PTE as being present before the access can be completely resolved. So basically, we have three memory access types. Everyone's familiar with this. We have read, write, and execute. Unfortunately, little caveats in the x86 architecture is we actually only have two memory access types. We actually have read, execute, and read, write, execute. By that, I mean the execute access is implied to all memory. This poses a slight problem. In some cases, we might like to actually differentiate between execute access and read, write, access. One common case, one common place where this might be the case would be the implementation of non-executable memory. This is used as a buffer overflow protection scheme. Basically, you have your stack space, which is typically readable and writable. I mean, you store data on the stack, but normally the stack does not contain executing code unless a buffer overflow attack is in progress. So therefore, heuristically, if we were able to detect an execute access over a read-write access on the stack, we could say if we detect an execute, that heuristically there's a good probability that we're in progress with buffer overflow attacks. Now, the little carry-off here is, like we said, x86 doesn't let us distinguish between read, write, and execute. So basically, we have not had hardware support up to this point. We do now have some hardware support, but previously, there's a project called PAX. Basically, PAX implemented read, write, no execute or non-executable memory semantics using strictly software support. This was before there was any hardware support for non-executable memory. Windows XP Service Pack 2 and Server 2003 Service Pack 1 now also implement software support in the form of what Microsoft calls Data Execution Prevention, or DEP. As a side note, hardware support has been added for non-executable memory on the 64-bit processors, as well as the Pentium 4. Well, in the case of a root-camp, it's also kind of advantageous to be able to distinguish between executable and read, write access to a range of memory. Basically, we're going to take an offensive stance on the PAX technology, which has been around for a while. This technique's been around for a while, but so far, it hasn't really been shown how you could invert that technique for malicious purposes. Basically, we want to hide code. We want to differentiate between read, write, and execute. The idea is, if we have a read access of the code section of our root-kit driver, for example, that's going to be a very strong heuristic that a scanner is trying to locate us. Basically, what we would want to do in that case is we want our root-kit code to run, but if the scanner tries to read it, we want to basically return an image of that memory that does not contain the root-kit code or contains something clean, if it's in the case of a modification to the operating system. Basically, what we're proposing here is we're going to do an implementation that is the inverse of PAX. That is, it's an implementation of execute, allowed, but diverted read, write, memory semantics. We're going to use the PAX technique that PAX discovered to implement non-executable memory, but in this case, we're going to use it to hide a root-kit. Like I said, the technique is not totally new, but the application is somewhat new. Basically, there are three implementation issues here. First, we need a way to filter, execute, and read write accesses. Step one. Second, we need a way to fake the read write accesses once we detect them. Obviously, we don't want the scanner to receive the correct data when it reads our root-kit memory. Lastly, we need to ensure that performance is not adversely effective. Obviously, this would not be a viable solution if when we install our root-kit, the system administrator notices that his machine is suddenly running really, really slow. So to solve the first problem, basically, we said earlier that if we mark the PTE as invalid, the next memory access that occurs to that page is going to generate a page fault. So basically, that means that we can trap memory accesses by marking their page table entries as invalid and basically hooking the page fault handler and replacing the operating system's page fault handler. In the actual page fault handler, we have access to some interesting information. We have the saved instruction pointer. We also have the virtual address where the fault occurred. So therefore, if our instruction pointer equals the address of where the fault occurred, we can say that this was an execute access. Otherwise, it's going to be a read write access. There's one important thing to note here and that is the fact that our memory hook for the root-kit has to work safely with the operating system's memory management because the operating system's resolving page faults all the time. So that means in practical terms that if we're going to mark pages not present to capture memory accesses, then we also must be able to distinguish whether those memory accesses are a result of someone trying to access the hidden page or a result of normal operating system paging activity. In order to satisfy that, we actually impose two constraints. The first constraint could be that pages that are hidden are required to be a non-page memory. That means there's no possibility that the OS could page that file out to the disk. The second constraint could be if you're using pageable memory that you use an operating system API to lock it down. So once you're able to detect execute secure from read write, well, now it concerns the issue of, well, how are we actually going to fake the read write accesses? So basically this is the technique that was shown in packs that it used to implement the inverse of what we're going to talk about and that is we're going to desynchronize the hardware caches, the TLBs. Like I said, the x86 has two of them. It has one for code, which is searched on execute. It has one for data, which is searched on read write. So therefore a memory access, under normal situation, the ITLB is going to contain the virtual page number in the corresponding physical frame and the DTLB is going to contain the same thing. So in this case, for virtual page number 12, we see it maps to frame two. For the DTLB, it also maps to frame two. Under normal situations, read write and execute, they all map to the same physical frame. However, what if we could desynchronize them? What if we could have the ITLB to actually map off to a different physical frame than the DTLB? So basically the idea here is that the ITLB contains a pointer to a frame which contains the root kit code and the DTLB contains a pointer to the frame which either has a clean copy of something or some random garbage, which is not the root kit code. So basically, since all these translations are performed at the hardware level, this is going to be transparent to the application program to the kernel driver or even to the operating system. So basically, once we've decided that we're going to desynchronize the TLBs, the question is, well, how do you actually do this? TLBs are almost entirely in hardware control. However, there is a little bit of support for software control, which in this case happens to be enough support to implement this. First of all, we have the capability to flush the TLB. Basically, we can flush the entire TLB by reloading register CR3. This normally occurs on a context switch. On a context switch, typically CR3 will be reloaded, which ends up flushing the entire TLB except for global entries, which will remain in the TLB. This is mainly a performance enhancement for operating system components, which will remain resident at all times. Also, we also have a method of not only flushing the entire TLB, but of flushing an individual entry in the TLB. That would be the invalidate page instruction. So now that we've established that we can flush the TLB, how about loading it? It is possible actually to load the TLBs separately, which means that actually executing a data access loads the DTLB, but not the ITLB. Conversely, executing a call loads the ITLB, but not the DTLB. Therefore, it is possible to discreetly load the two TLBs separately and desynchronize them. Basically, our group of concept implementation consists of two main components. We have the memory hook engine, which has a hook installation component, which sets up the hook, and then a custom pagefall handler, which basically is responsible for filtering execute and read write accesses and correctly manually loading up the right TLB. Also, our second component is going to be a modified FU root kit. So basically, we've modified Jamie's root kit to work in collusion with our shadow walker. So basically, on memory hook installation, there's several steps that have to be performed. First of all, since we're going to mark pages not present, we need to install a new pagefall handler. Once we've done that, on a pagefall, we're going to need to be able to determine relatively quickly if that fall is due to one of our hidden pages being accessed or if it's due to the actual operating system performing normal paging activity. So in order to do that, we just insert that page into a simple hash table so we can perform a quick lookup. Next, we mark the page not present. And then the last step is really the most important here because we said that the TLB is first on the memory access path, which means that a pagefall is generated, one, when the PTE is marked present, but like I said earlier, two, when that entry is not present in the TLB. So therefore, we perform an explicit flush of that page that we're hiding. This means that on the next memory access, we will be able to generate a pagefall. If you could please hold your questions to end. We'll have time for questions. So basically, the custom pagefall handler's main responsibility is to filter, read, write, and execute accesses for hooked pages. If it determines that the page is not a hooked page, meaning it's just a normal operating system pagefall, it passes it down to the OS handler. If it is a pagefall due to a hidden page, it's either going to manually load the ITLB or manually load the DTLB depending upon the type of access. Most memory references will be resolved via the TLB path. So intuitively, you would think that you would be generating a lot of page faults. You would take a big hit in performance, not the case, because we're using the hardware caching mechanism, which is simply desynchronizing it. So basically, we will still have page faults. But page faults are not as many as you would think since the TLB path will handle most of the memory references. Page faults on the hooked pages will, of course, occur on the first execute or data access to the page. Remember, we had to flush it, flush the TLB when we instantiated the hook. It will occur on the TLB cache line of fiction. So it's possible that the mapping for that hooked page got evicted from the TLB. Well, the next time that a memory access occurs, it will now generate a page fault, which the page fault handler will now reload the correct mapping into the TLB, and that memory access will go through. Likewise, the last case would be on an explicit TLB flush context switch if the global bit has not been enabled. So basically here we have some really rudimentary page fault handler pseudocode for what's going on. So basically, we are only hiding kernel pages right now. So we're going to disregard user land accesses. So in the page fault handler, we want this to be as efficient as possible, so we don't want to tie things up if we're not interested in handling this fault. So the first thing we do is we just check if the processor mode is in user mode. If it is, we pass it down. We're not dealing with user mode. If the faulting address is a user page, we're also going to pass it down because we don't hook user pages. In contrast, if the fault is from a hidden page, now we're going to check if it's a read write or an execute. If it's an execute, we're going to jump over to load the ITLB. If it's a data access, we're going to jump over to the load DTLB code. Basically, in the load ITLB, what we're going to do is we're going to basically replace that physical frame information in PTE with the mapping for the actual physical frame that contains the root kit code because we want it to execute. We're going to temporarily mark that PTE as present to allow the memory access to go through. We're going to perform a call into the page which is going to load up the ITLB, and I should note here, I forgot to put this on the previous page, that we do have to perform a call. Basically, that means that we need to find an empty byte in our hidden page that we can insert a return off code to. In practice, if you're going to hide sections, say in a driver, those are PTE sections. Therefore, there's going to be some alignment. Therefore, there's normally some empty space in there. You shouldn't really have trouble finding one byte that you can just pack to return into. Therefore, basically, we just make the call to this point in the page where the return has been patched, and it returns control back to page fault handler. In process, it loads up the ITLB. Finally, the PTE is marked as non-present again, so we can catch subsequent accesses. We also replace the frame back with the original innocent looking frame. We go ahead and we return back to the faulting application, or driver if the case may be, without passing down to the OS. The OS doesn't need to have any knowledge in this PTE fault. If it's a DTLB load, basically the steps are a little bit simpler, because by default, we're going to maintain the clean mapping in the PTE. Therefore, we just mark a present, perform a read access, and then mark it non-present again. Then, of course, return without passing down to the OS. Basically, all this information so far concerns how you would hide executable code. We're running out of time, so I'm going to go ahead and skip this section on data hiding. The slide should be available probably on rootkit.com within the next week or so. Basically, I'm going to move ahead and we're just going to talk a little bit about the rootkit here. The rootkit is, of course, the object that we are implementing this process on to hide it is proof of concept. It doesn't really do anything malicious. It just hides processes. It runs as a system thread. It has no dependence upon user land initialization, which means it has no symbolic link or no functional device in the driver. Also, basically, we envision this rootkit as being an in-memory rootkit, meaning that ideally it would be installed via a kernel-level exploit. Obviously, if this rootkit driver is to be on the news, we open up a whole new can of worms for detection and basically invalidate all these selfie things that we're trying to do. Basically, we never wanted to reside on the disk. This is a perfectly reasonable thing if we consider attacking, say, a server system, which is infrequently rebooting. Chances are high that this rootkit will sit in memory and by the time we come back, it'll still be there. Lastly, the impact on system performance, like we said, modern TLDs have high hit rates. That means most translations will be resolved via the TLD and not the page fault path, which means that we're going to have a very little performance hit. I can't speak from a performance metric point of view here because we haven't really done any rigorous testing on performance, but I can say, that subjectively speaking, hiding Jamie's rootkit with this Shadowwalker memory hook engine, there is no subjective, noticeable performance impact. Clearly, the performance impact will probably vary depending upon the number of pages you're having to hide. In this case, hiding a kernel driver, how many pages you really have. You have four or five sections in a PE, portable executable, so chances are, you only have four or five pages. If they're page aligned, four or five pages is really negligible. So for small numbers of pages, we haven't observed any performance impact at all. As this is not really a weaponized attack tool, there are a number of known limitations. Jamie and I have done this basically on our spare time, so basically we've not implemented a fully productized or weaponized version. So first of all, there's no PAE support. PAE basically extends addressability from 32 to 36 bits. We don't support that yet. There's no hyperthreading or multi-processor support. There's clear issues with regards to synchronization problems involved with porting this up to a multi-processor system. We've not addressed those yet. Currently, we only hide 4K-sized kernel pages. We are theoretically capable of hiding four megabyte pages. The X86 architecture actually has two page sizes, four K and four megabyte. The main point of interest with the four megabyte pages are going to be hiding of NTUS kernel, which is sitting on a four megabyte page obviously in interest to a root kit developer who wants to install his hooks into the operating system kernel. Currently, we can't hide NTUS kernel. There's some technical difficulties with that, which we're working to resolve. But it's quite effective for hiding drivers and other drivers such as maybe Indus, which sit in the 4K page range. So we could hide things, hooks, and the network drivers, for example. As far as detection, I'm going to go over this real, real brief. I think we're really running out of time here. First of all, like we said earlier, we have to make the constraint that we have non-paged memory that we're marking non-present. So we don't conflict with the... So we can differentiate our page faults from OS page faults. Obviously, non-present pages in non-page memory are empiristically abnormal. If that's sufficient to indicate that a root kit's installed, highly debatable, but it's still abnormal. Obviously, the page fault handler code itself cannot be marked not present, because that would imply that we're marking the page containing the page fault handler as not present. We would end up with lots of recursive problems, of recursive re-entry. Therefore, the solution for hiding the page fault handler, we have to fall back to more tried-and-true approaches. It's small. In assembly, there's no APIs. So, you know, polymorphism seems like a fairly reasonable solution to that problem. Likewise, it's also difficult to conceal hooks on the IDT. Currently, this proof of concept makes no effort to conceal the IDT hooks. Yes, this root kit is very easily detected right now because of this, but that was not really our goal. We're just showing a proof of concept. So, right now, we're really running short, so I'm going to proceed to the demo and skip the last couple slides. I know we're late, so if anyone has any other engagements, feel free to head on out, but I am going to go ahead and perform the demo for anyone that's interested. I'm going to do a GUI version of this demo. I have a hardcore softice version if anyone wants to see after the talk. So, basically, the first thing I'm going to do is, right now, I'm using a driver monitor. It's a tool with a softice driver suite. It allows you to load a kernel driver.  So, go. Our driver has started successfully. Now, if we enter softice, we can get the base address of where this driver is loaded in memory. This is the virtual address of where this driver is loaded in memory. We're going to go ahead and dump it. Dump the memory at that address. So, for all of you guys that use HexDumps all the time, this should look pretty familiar. This 4D5A, that's simply the mz signature inside the PE header. Right now, what we're seeing is the PE header of this root kit driver loaded in memory. Now, at this point, I'm going to go ahead and load up a shadow walker. So, it started up successfully. So, now we're going to go ahead and perform another memory dump. Well, now, it's gone. So, we'll take questions off line. We're leaving the room. We're being evicted. We have swag books. We'd love to hear from you. Thanks a lot.


Hello Upgraders and welcome to another edition of The Upgraded Ape Show. I'm your host Will Barron and today's show we have Sam Vaknin who is an expert on narcissistic psychopaths and has been diagnosed with both conditions. Absolutely fascinating talk. Sam's an absolute wealth of knowledge in this area and we're talking about how you can recognize narcissistic psychopaths in the workplace and then what you can then go on to do to one stop them bullying or manipulating you and two perhaps manage them better if you're a manager or how to survive working underneath them. What fascinated me about all this is that the literature suggests that one percent of people in the western world are either narcissists or psychopaths. However most psychopaths for example don't know that they're a psychopath because they think that they're fine they think that they're great so that one percent is actually a tiny amount so it's very likely that you have friends or family or colleagues that are narcissists or psychopaths and all this is on a sliding scale from you know Hannibal Lecter to the boss who likes attention and who is stealing credit for your work so that's something to bear in mind and Sam is the editor of mental health disorders in the open directory project he's got a book out malignant self-love and his work has been featured on mental health matters mental health century mental health today mental health review are loads of other websites and publications so just before we get into the show exciting news in that you can now download upgraded it magazine directly to your iOS device or your iPhone or your iPad if you just go into the app store type in upgraded it magazine you'll see it there download one bam and it's yours every week you'll get a little notification that tells you that the latest edition is available and then just click download and you view and you can just swipe through it and it's it's actually a way better experience reading the magazine on the iPhone or iPad versus in your browser how it is at the moment so yeah go check that out it's totally free and let's jump into today's show welcome to the upgraded it show your daily dose of brain upgrades to help you kick life's ass and here's your home will bear hi sam and welcome to the upgraded ape show thank you for having me you are more than welcome and today we're going to dive into the fascinating world of narcissism and psychopaths and just before we dive into that and we're going to talk about it in the context of the workplace can you tell us a definition of what a narcissist and a psychopath is just for listeners to clarify what we're going to talk about the distinction between narcissists and psychopaths has gradually become more and more blurred and today it is thought that a psychopath may be simply an extreme form of narcissists psychopaths are more prone to anti-social behavior including criminal conduct they are less empathic than narcissists if at all possible they are more centered on their benefits on tangible benefits that they may derive from people and from situations anything from sexual favors to money to the accumulation of power to the exercise of power etc etc psychopaths are also a bit more in a more the bits a bit more addicted to inflicting pain on other people they find it pleasurable and some of them even find it funny narcissists are a mellowed version of a psychopath they also lack empathy they are exploitative but they are addicted to input from other people input which we call narcissistic supply which essentially is attention whether positive or negative narcissists of course prefer admiration and adulation to not a rioting but if they cannot obtain the positive kind of attention then they would definitely go for the negative kind of attention so while psychopaths are stand alone units they are totally autonomous and they are not reliant nor are they dependent on anyone for anything narcissists are narcissists are addicted to narcissistic supply and therefore they are addicted to the input provided by people around them they go and solicit this input actively and sometimes forcefully so these are the distinction between the two types but both of them are callous ruthless de-sympathic emotionless and pretty terrifying okay well before we dive into how to spot these people and whether that whether it's good or bad and the sliding scale of how narcissistic and how psychopathic you can be can you just tell us some a little bit how you got involved in this world in the first place well i've been diagnosed with both i'm a narcissist and a psychopath and having confronted my own diagnosis multiply i've decided to delve into the uh into the issue and in 1997 when i started my 95 actually when i started my work on on these topics it was personality disorders in general and narcissistic and antisocial personality disorders in particular were an obscure and neglected sub sub sub filled of expertise among a very limited set of scholars narcissists and psychopaths are very hateful and difficult patients they do not yield to authority nor do they improve with treatment so they are very disappointing and resilient subjects both for study and for therapy and so psychiatrists ecologists and therapists tend to avoid narcissists and psychopaths in 1995 there has been nothing absolutely nothing written about this disorder with the exception of one or two books and so i had i had to do you know i have to start everything from scratch and i've spent the last 20 years studying both disorders coming up with a vocabulary that is widely used today actually and uh suggesting insights some of them accepted some of them rejected with regards to these two afflictions i have written several books the most well known of which i believe is malignant self-love narcissism revisited but i've written other books as well about personality disorders and i have corresponded and observed thousands of narcissists people diagnosed officially with narcissistic personality disorder and with hundreds of thousands of family members neighbors colleagues bosses co-workers you name it but by now by now i probably have it would be safe to say that i have the largest database with regards to these uh aliens among us for sure for sure that's fascinating some and one question that comes from my mind listening back to you then was how and why did you go to get a formal diagnosis in the first place is this something that you'd notice the traits of narcissism and psychopathic yourself or someone else mentioned them to you i've been coerced twice into into evaluation once by my then fiancé who had the wits and the intelligence to bail out and uh second time in prison i did time for securities fraud and as a condition for parole i was i had to commit myself to psychiatric evaluation so on both occasions the verdict of narcissistic personality disorder was rendered in conjunction with one or two other personality disorders and then about four or five years ago i participated in a documentary titled i psychopath in which quite publicly i was diagnosed with psychopathy they used a test called the pcl a pcl r a test concocted by one robot fair and while there are there's a serious debate about the validity of the test for instance it is not accepted by the diagnostic and statistical manual committee which is the body the body of orthodoxy in psychiatry but still it's indicative and so it would be safe to say that i'm a psychopathic narcissist after all these luminaries have poured over my record and and myself multiply but i've been coerced into it and that's an important question actually which you've asked i've been coerced into into evaluation and coerced into treatment and therapy you see prior to prior to being confronted with my diagnosis i was completely unselfaware i i would have found it pretty funny had you suggested to me that something's wrong with me i would have thought that you are dim with it i would have ascribed pernicious and paranoid motives and motivations to you for having said it for having suggested that something's wrong with me i would have blamed everyone and anything for my misfortunes and defeats and and so on and recall this whole thing alloplastic defenses alloplastic defenses better known as external locus of control means simply that narcissists and psychopaths before they become self-aware and some of them do i'm i'm an example but before they become self-aware psychopaths and narcissists tend to blame everyone and everything for the mishaps and the misfortunes and the downfalls in their lives they can do nothing wrong nor will do nor do they ever do anything wrong everyone else is to blame the bosses envious of them their co-workers are jealous of them and undermine them no one appreciates them properly the universe is badly designed god is to blame society this to the increasing stupidity of the populace you name it the waiter the cabbie they i mean everyone was with one exception the narcissist himself and this is called alloplastic defense a defense mechanism which shifts the blame and the responsibility and the attendant guilt feeling to the outside in order to avoid an inner conflict i think we all know people who don't accept blame themselves and blame other people for things that are going on in their life and struggle to take responsibility but what percentage of the population are actually i guess clinically narcissists or psychopaths is this a big amount or is this a very small minority according to the latest edition of the diagnostic and statistical manual published in june 2013 last year i mean about a year and something ago about one percent of the population would qualify as suffering from narcissistic personality disorder but this is of this is obviously a massive underestimate and the reason that it is an underestimate is that narcissists rarely subject themselves either to psychological testing or to a therapeutic setting so it's very difficult to come across narcissists in a scholarly environment or in a therapeutic environment and so narcissism is heavily and massively underestimated not so psychopathy psychopathy or antisocial personality disorder i believe is pretty well measured the prevalence and the incidence of antisocial personality disorder i believe is is accurately reflected in the literature and the reason is very simple many psychopaths end up in jail end up in prison so there they are subjected to compulsory evaluations assessments and sometimes therapy indeed robot hair the father and mother of modern the modern study of psychopathy is actually a prison psychiatrist his bulk of his career he had spent in prisons where he studied this population but narcissists are a lot more insidious a lot more stealth a lot more they act by proxy they are great they have great cesspion skills they're great actors they are they know how to adopt themselves so that they appear to be socially acceptable pillars of the community indeed many of them climb up the corporate ladder or politics or show business or the judiciary or law enforcement or the clergy end up in positions of authority i'm not diving into that a little bit further then because that one percent that you said was an underestimate i thought that was quite high number no not knowing as much about it as you obviously and one percent would suggest that you most people would definitely know someone who's narcissistic but if it's higher than that then it's likely that you know either family members or definitely people that you work with if you work in a big not big organization are going to be afflicted with this so if we look at a stereotypical organization now so they can relate this to their workplace are we talking about management that are more likely to be narcissistic or is it likely to be the CEOs of company or is it sales people is there a specific part of the company that tends to have more narcissistic people than others with your with your kind permission before i answer your question i would like to to make two comments why not narcissism is only partly a mental health diagnosis mental mental health construct it is equally influenced by culture and society it is what we call a culture-bound syndrome it tends to increase in societies which are narcissistic or which reward narcissism so societies which would place emphasis on individualism on ambition on trampling on other people you know Darwinistic societies societies which would emphasize competition and ruthlessness and so on so forth would tend to reward narcissists and in these societies people would become narcissistic indeed there is a suggested diagnosis by professor millman of harvard university situational narcissism narcissism which is provoked and and engendered by circumstances so this is comment number one in societies such as the united states for instance countries such as the united states it would tend to reason that narcissism is more prevalent more visible and more widespread than in let us say japan which is a collective society that's one thing second second comment i would like to i'd like to make narcissism or pathological narcissism is rarely diagnosed alone it is usually comorbid in other words it's diagnosed with other mental health disorders mood disorders other personality disorders and so on so one might one comes across narcissists whose main complaint or whose main syndrome or symptom is not narcissism prime example will be borderline personality disorder which is extremely accentuated narcissistic dimensions so narcissism is not an isolated phenomenon it it i think a good case can be made that pathological narcissism is the foundation of myriad other mental health problems so these are the two comments as to your question narcissists tend tend to gravitate towards positions of authority because there they can exercise power and extract not to say extort narcissistic supply attention adulation admiration from their surroundings human surroundings they need this input of narcissistic supply it is both a drug a drug and a fuel to their machinery in the absence of narcissistic supply they crumble crumble and crumble and go to dust so they would tend to gravitate to these positions of authority but if they fail to gravitate if they fail to reach these positions i'm sorry if they fail to reach these positions they would opt for second best and second best is to become minions and psychophants and fans and admirers and followers and subscribers to those in power so you can find them actually most represented in these two positions either as the figures of authority imposing authority on others and thereby enhancing their own feelings of omnipotence and grandiosity or by serving as satellites as extensions of people hello as satellites or extensions of people in positions of authority and thereby deriving the narcissistic supply by proxy if you wish indeed the second type of narcissists that i've just described the satellite or the extension is known as covert narcissists or inverted narcissists narcissists who is very much like the moon he shines but with reflected light and it is the reflected light of the fun the main narcissists the one who is in power so these are the two it's very rare to find narcissists in you know low level long-term low level occupations and so on if they are completely unable to reach the top they would tend tend to be itinerant they would tend to be desultory they would tend to hop from one job to another from one position to another they would change 40 careers in the span of 20 years attempting to reach the top somewhere somehow from then a business and workplace perspective then what traits do narcissists have that are actually positive for the business if it seems like some things like if you if you're willing to trample on others to get to the top that might not be necessarily positive but if you're willing if you know that the reward in attention is there at the end you might be willing to put in way more work than someone who isn't potentially narcissistic is that about right intuitively it sounds right but the correct response is counter-intuitive pathological narcissism is never ever good for business now what I've just said is not accepted by some scholars such as Kevin Dutton and others Makobi these scholars claim that narcissism can be harnessed and can be put to good use within the corporate structure and that the drive of the narcissist is in irradicable energy his neediness and addiction to narcissistic supply and so on so forth are actually energies that could be channeled and leveraged for the benefit of the organization and that is a serious serious mistake in thinking and a serious misrepresentation of case studies narcissists are very good as entrepreneurs they are charismatic usually they are intelligent they are driven they have clear goals and they motivate people around them either in the form of a cult cult-like setting or in preferring a vision a common vision and we call this shared psychosis kind of a hypnotic psychotic state into which everyone else buys and so they are good at inducing these pretty pathological states and they are therefore good at building up businesses at gobbling up businesses through mergers and acquisitions they are very good at creating teams putting teams together on condition that they had they are you know at the helm and they are the chiefs of these teams they are very bad team players but they are very good team builders and so on and so forth however narcissists invariably implode ultimately all narcissists without a single exception are self-destructive they would put 20 years into a business they would build it up into a global conglomerate but then their self-destructiveness will come into play and they will and it will all tumbling down why narcissists are self-destructive is perhaps outside the remit of this program but it it is a given narcissists are self-destructive in a variety of ways they are very inventive they're very inventive in the way that they extract narcissistic supply from people and they are equally inventive in the ways in which they self-destruct implode and ruin everything and everyone around them but they invariably do perhaps an excellent example would be Adolf Hitler Adolf Hitler who was remote diagnosis and narcissists by Eric from a prominent psychoanalyst Adolf Hitler has succeeded to build out of the ashes and the ruins of the first world war having come having appeared on the scene having burst on the scene literally from nowhere and with zero credentials and achievements to his name this nobody succeeded to put up together a formidable a formidable war machine involving an empire the likes of which the world has not seen since Alexander the Great now and he has done all that in less than a decade yet we all know how it ended so they are great in the phase of construction unfortunately they are also unequaled in the phase of destruction so I've mused about Adolf Hitler before and this is a slightly going off topic I guess from the business world but I've thought and contemplated that perhaps if he hadn't done and gone into the role that he did because he was an artist beforehand and he could from sound things he could have been an entrepreneur he could have been anything are you suggesting that whatever he'd done even if it had been for the good of mankind rather than you know what he did end up doing that it would have imploded eventually now first of all for a very long time everyone thought that he was acting for the good of mankind I can show you adulating and forming articles in the British press about Adolf Hitler not to mention the American press well into the late 1930s so his post-mortem assessment posthumous assessment as a monster is Victor's history throughout most of his life he has not he was not considered a monster at all he was considered a fresh political talent with innovative courageous ideas a rebuilder of his own nation a reconstructor of the space of Europe and so on and so forth it is only when in 1940 that the images you know changed but yes the answer is yes whatever he whichever field he would have entered whichever endeavor he would have embarked upon he would have ended up the same all narcissists do all of them do from Enron to the further right they all do okay so let's put this into context for the listener then listeners listening they work in the corporate environment and their boss fits perfectly to the role and the aspects of a narcissist or psychopath which we just talked about they are constantly claiming that the subordinates work as theirs they're taking potentially advantage of them in different ways what is the best way to deal with this situation if you know your boss is a narcissist is there a best way to deal with it or is the best way to move to a different place within the company and have different management well best using the word best is a bit misleading best to whom in which circumstances depending on one's character as well the best way is to adulate admire adore visibly volubly and repeatedly your boss brown nose if you wish to use a less savory experience phrase so that's the best that this this is the winning tactic never fails because by doing that you're you're stroking their ego so they're more likely to work with you and you'll be in there good books by doing that you're stroking their ego you're distorting their reality because you are providing them with fallacious feedback and by doing so you are in control of the reality you have information which they're not privy to and this gives you the the leverage and the power to manipulate them and indeed narcissists are very gullible and easily manipulable they are junkies think junkie you know you provide them with the fix provide them with a dose they're yours for the taking so this is the the winning and only viable long-term strategy of survival around a narcissist and in the work environment however very few people are either willing or able to countenance let alone implement such a strategy because it requires you to some extent to possess psychopathic and narcissistic traits of your own or that is what I was just about to ask in the it's a fascinating twist in the speaking to yourself as a narcissist you're telling me how to manipulate other narcissists which leave me to the question then of do you then get to a point within the corporate structure where you get a higher and higher percentage of narcissists because they're the only people that are willing to manipulate and play the game with each other yes that's precisely what i've said i've said that narcissists tend to gravitate and and conglomerate and accumulate in the upper strata that means in positions of authority and in the satellites and extensions around them so yes level c and a bit down that these would be narcissists narcissists are rarely found in the lower echelons or in the lower levels of the of the corporation they gravitate up they they're likely to come you know they go to the top well sam i've got two questions for you one question that i ask everyone who comes on the show which i'll ask you in a second but before that just to wrap things up here you mentioned the pclr tests that may or may not be the best test to look at this but if i remember the audience now and me included if you feel like you have some of these traits it was talked about what's the best way to go about like an initial kind of test before you'd speak to a doctor or a psychiatrist whoever who would give you a clinical diagnosis is there a test that you can do perhaps online or from a book that would give you a heads up as to how narcissistic or psychopathic you are no not really because all these tests both online and offline regrettably require self-reporting honest self-reporting and no matter how honest you think you are especially if you're a narcissist you're not honest it's a self-defeating proposition it's like the famous abdera paradox you know all all abderans are liars and who says that an abderan so is he lying or is he telling the truth so self-reporting is a problem and this is the main obstacle in diagnosing narcissism psychopaths because ultimately we have to rely on their honest self-reporting and the self-reporting of people around and the reporting of people around them who are usually scared of them or like to avoid them or would say anything just to obtain certain outcomes so it's very difficult to diagnose them but they are tests designed in order to circumvent self-reporting so we have a test such as the MMPI 2 which is a dimensional very complex test and very difficult to beat even if you know the test intimately so that would be my recommendation my the first line MMPI 2 and perhaps MCMI 3 these are the two tests that I would the other the most common test used to diagnose narcissists the narcissistic personality inventory is idiotic sorry for being blunt because it requires the narcissist to self-report honestly unflinchingly and to be self-aware since this borders on on anonymity so and the second the second way is with a trained observer diagnostician who is a trained observer who has been exposed to hundreds of cases and is able through a structured interview and through direct observations of body language demeanor reaction reactivity and so on so forth in a therapeutic setting after several sessions reached a conclusion that perhaps we are dealing with a narcissist and perhaps not so it's a process diagnosing a narcissist is a process especially taking into account that narcissists have developed over the years have developed numerous strategies to hide and disguise the less savory aspects of their personality they have been exposed to a lot of censor a lot of social rejection and criticism as they were growing up so they have learned to disguise these guys who they are and they apply that in a therapeutic setting but after several sessions a trained diagnostician with or without structured interviews and an end with or without applying psychological tests such as the MMPI would still be able to say if someone is a narcissist or not okay okay well Sam just before we come on to you tell us a little bit about your book and where the audience can learn more about you and your work I've got one final question for you and that's something I've asked everyone who's come on the show so far and that is if you could go back in time and speak to your younger self what would be one piece of advice you'd give him to help him upgrade his brain in my case I benefit mightily from my dysfunction we are talking to each other because I'm dysfunctional and disordered so I have I have leveraged and and applied and used my disorder my dysfunction and my ruination in order to obtain the very narcissistic supply that I require narcissists would be unable constitutionally to respond to the question that you've asked because they are emotionally invested in their disorder they're very happy with it they are what we call in psychology ego-syntonic means they're comfortable with their disorder they aid and abet the disorder and the disorder aids and abets them it's a partnership symbiosis so nothing's wrong with it nothing could ever be wrong with it retroactively or prospectively amazing well Sam your your insights are absolutely fascinating to me and thank you do you want to just tell us a little bit more about your book malignant self love where we can find where we can find it where we can bind it yeah sorry malignant self love narcissism revisited is available of course via amazon and balsa novel I think your first stop if you want to get acquainted with my work and more generally narcissism and psychopathy and so on the first stop might well be in in my youtube channel that's Sam back in my name s a m v a k and i am so youtube.com backslash some back name there are well over 300 videos there and I believe you'll find your match and then my book malignant self love narcissism revisited amazon balsa novel and my website which is narcissistic-abuse.com just type my name into google I'm sure you'll come up with some results well Sam I really appreciate your time today it's been absolutely fascinating talking to you and we'll link to all them in the show notes at radio.upgradedape.com for anyone who is in the car or at the gym at the moment and Sam I just want to thank you again for your time today really appreciate it and thank you for coming on the upgradedape show thank you for having me


Thank you Will Is picking about a virtual currencies actually one of the first things that Let's come to my mind is that there actually there's no one single word to refer some people refer us as as virtual currencies Someone just referred us like to Bitcoin or the name of the specific currency But but in general we see that is a phenomenon that is going that is growing In the last in the last years And just something that is happening like the last Like few weeks we can see that we have like new actors like especially private actors that are starting to enter into these the development of these technology and this type of Currency I will give you the two examples if the person needs a case of Facebook So Facebook in the last weeks has announced that it pretends to develop their own Virtual currency or cryptocurrency that is to be used inside the social network So when we see that actually Facebook is entering into these into this scenario We see that there's actually some development on this area another thing that happened in the last in the last weeks I Don't know if you if you follow when the Samsung 10 was announced It was announced that this specific phone was gonna be launched with a wallet for a virtual For with occurrences and I think this wallet was using some currencies like Bitcoin Cosmocoin and another one. So again, we see how these These these companies are starting to enter into these Into these into the into this business and we can see that is actually a growing field But also very very unstable So another thing that you probably have here is that all these issues related with with occurrences are very Volatile markets because the prices actually are have been going down in the last in the last months on more than more than a year So in this context, I want to to to study these these these notion with relation of international international law So what what do I understand to try to get some some context to the debate? So I usually prefer the term virtual currency to this to refer to a Representation of value that is in power with the distributed ledger technology This technology is commonly referred as as blockchain. So blockchain is probably like the commercial name like everybody knows but the technology behind this is Distributed ledger technology now What is interesting to see is that why this technology actually is so innovative And that's probably the key part of analyzing any any type of Virtual currency scheme and the thing is that it brings a concept of decentralizing computing And I think that's probably the most innovative thing that is bringing with these with this concept so every time that I Speak about this and I think about a development in general I like to show you actually this this card here that is called the the content This car is exhibit on the Museo del automobile de Torino That is actually one of my kids favorite place as why I usually go a lot to this to this to this museum And every time I pass him by this museum this disc, you know this can get my attention especially because of the day We see that it is recorded that actually achieve about 100 kilometers per hour in this year at the end of the 19th century What is interesting is that by the end of the 20th century of the 19th century beginning of the 20th century We see that electric cars were actually the the main the main idea or one of the ideas that was going to supposedly take over the Auto industry what happened next after this is that we see that a troll gas actually dominated And what is more interesting? And I want to stress that to you is that we have to wait about 100 years until an Invention or a technology that was really innovative have actually some economic value and actually was inserted in in an industry so When we have something new One of the things is that this thing a new technology usually depends from other type of Factors or other type of circumstances like the same fact that there is other technologies and other social context That will make a technology that was now in the museum becomes some kind of relevant. I mean, I'm speaking about the idea not a precise Patent or something so I usually like to use these to illustrate how a New idea or a new technology can take actually some time to get some ground on on economic terms So making this this the short analogy Then this is a way that I have actually tried to to draw even for myself. What what is to what is distributed? technology so I Was looking in general and speaking with people from IT and every time I found that it was even difficult for someone like me that is not And especially on the field I would say that I am like an average person that maybe can look into social networks or turn off the phone and nothing else So then even I found that there was this these Barrier of actually knowing some things like like programming that is inserted with these What is unique about this is that for so many years? We have used to have the control of one computing that that's why the concept of decentralizing computing We have that a computing actually can be Taken in several Ledgers or blocks across across borders and an application can be executed across borders between several Computers of this is kind of like a very simplified way to to to understand how actually this technology operates And that actually bring us several several issues the people that actually defend and I'm very enthusiastic about this technology They tell you that because of these these applications that are power empowered with this technology are really hard to To crack or to hack why because it's almost impossible to Hack all the computers that are partying of the system and once a block is added to the to the system Then we see that it is very impossible to remove this information Which actually can be used for many many ways So this is like a simplified way. So then you will see that just to make it bigger If we have several states a blockchain will look actually look even bigger than this So you have all these blocks around the globe So that's why I found this this technology at least at least appealing or worth of attention for International law and the object of my of my research in the last in the last month Actually, it has been to to actually answer what doesn't mean for international law and more completely What doesn't mean for global governance out for the international economic law regimes? Are the current categories of international economic law? suitable to actually deal with some with a structure or a system of this Of these of these characteristics. So after yesterday is a Keynote of professor Kingsbury now I can refer these two maybe as a digital infrastructure So it's international economic law capable to deal with this type of digital infrastructure Why because there are several issues the first one is that it actually the execution of applications go beyond the authority of What a state and then we see that if there's no one a state that I can actually control Once a blockchain has or one of these systems have been Spread across across borders. So usually you will see two trends of thinking of authority in a world based on this really legit technology one is trying to Create some kind of central DLT systems where one a state would actually control or a group of the state would actually control that most of the blocks are under the authority of one states and then you will have another vision that is probably the most Liberally in a way that try to have this this figure where actually a state cannot control what is going on on the or cannot actually Influence too much. What is going on in this in this bro bro system? So in this in this case What doesn't mean exactly for international law and especially for international economic law usually we used to think about Categories, but especially an international economic law. We have all these Subregimes that they are used to specific economic transactions So another thing is that we have agreed that mutual currencies despite their names They are not actually accepted most of them as actually currency or legal tenders I think only Japan is the only country that have By law recognize some legal tender characteristics to the to the Bitcoin, but in general if this It is these currencies or these systems are not Understood as as a currency itself or as a legal tender then there is this question of how to interpret it under the current categories So for instance in the case of WTO law if these Systems cannot be subsumed into a currency Can maybe they can be subsumed into financial financial services or another category And in the case of investment law the question that rises is can any Digitalization of assets could be understood as an as a protected investment under the current Investment regime that as probably you know is this actually very fragmented network of bilateral and international investment agreements So then we see that the question can become more more complex depending of each case so It is in this regard there So in this regard from the point of view of of international investment law, we have this contradiction of Having to regulate a new a new trend with a very old treatise or with old treatise And not only with all treatise, but we can say with all law with all treatise will all concept and actually with all Cases so that's kind of like the contradiction that is generated with the image of these new technologies, especially Especially this one so in the case of investment law We see that most of the cases that are brought to a iteration and that you probably hear many many of these cases that have been controversial They are arising from treaties that were signed in the in the 90s So there's a note that is a statistics that says that about 90 percent of the current investment cases are based on cases that were brought by treaties or bilateral treaties that were signed and dropped there in the in the 90s So then we can see that even though that we have in all these discussions about CETA about these mega mega regionals most of the most of the complex that we are dealing having have these old Categories or old treatise from the 90s as the as a legal base So the first question is can we use these old concepts and old treatise to? regulate or to apply to economical transactions that are used in the decentralized System and the question actually it depends that's probably what one of the favorites answers for for a lawyer It depends of many many characteristics of the of the system But in general we can distinguish or I distinguish two ways of approach this the first one is to see how the investment on Empowering this technology can be subsumed as any other economic activity So as you see they usually there is this this this word that is called mining That is a word that is used to describe of how another block is added to the to the to the blockchain of the to the to the system And then for doing this actually you need to have a lot of you have to actually expand a lot of energy And a lot of services to actually provide this the service So certain states have make the regulation more or in general more Friendly to have this type of business on the territory where example is Mongolia another sample is the Belarusia So in that sense we can see that there are like kind of like the same incentives that we have for attractive investment in any other Feel of or economic transaction that is also being used to this specific to the specific feel So in that case what we can see is that we can subsume the activity of for instance mining into one of the categories of Foreign investment protected under bilateral treaties in that case We eventually can apply the same standards as if we are speaking about of any farm like a shrimp farm or mining operation on DLT technology So this is one one approach and we can actually go further and then we can see that like for instance We will have like maybe another type of investment arbitration cases that are arising from this But the question that I I post especially on these on these papers Can or do we need actually a specific additional concept for dealing with these on international? Economic law in general. So I think at least that there is the possibility to advance advance a concept of crypto investment That eventually could be used as an another category that it can be implemented into treaties Or even as an object of a specific regulation So this this this concept of of of crypto investment The first characteristic is that it should have to go Beyond the territoriality idea of actually what is a foreign investment. So in general we have seen that The the concepts in international law usually have changed during during time Usually it takes a lot of time to to move one concept across the years But in the case of investment we saw that if you take any book from the from the 19th century And before you have this notion of property So you don't have a notion of investment on on the 19th century you have this notion of protection of property of aliens or something similar So then we see that in in the case of Investment the word investment start to get inserted in a treatise after the After World War II especially so then we see that there was this evolution between Property to investment in about 100 years. So maybe we are reaching a point That we have to think in another categories To actually a update international law and that's the question that that I leave open And I hope that I will be able to to put it in a more consistent way in the paper that I'm Thank you


Once you've left school, you are not in a fixed institution. You have to be able to find your own way of doing things. And so it seems to me that one of the problems we face, you face in British Columbia, we're facing all around the world, is that actually we have over-schooled children. We keep them in school, we tell them what to do, and they simply wait for instructions. And that is devastating. In the earliest years of schooling, teachers should work with every child on a personal basis to discover something which could become their life passion. Nothing to do with the curriculum. It could be about the study of apples, it could be the study of animals or something. It doesn't matter what it is. The whole thing is the child should become really enthused every child needs to feel they're an expert in something.