Welcome to another episode of In the Zone. I am your host, Chris Broussard. We've got an outstanding show for you today. Ralph Sampson is in the house. I can't wait to interview the big man who was just tremendous.  Only injuries could stop Ralph Sampson. And then, of course, we got Jason McIntyre stopping by for an episode of Knock Down Jay. But first, you know I have to hit you with a list. So here is this week's top 10. What a week for the LA Lakers. Kobe Bryant's two jerseys retired at the Stateful Center. I was there. The atmosphere was tremendous. And everybody afterwards was talking about where does Kobe Bryant rank all time? Which got me to thinking, let me put together my top 10 list. So checking in at number 10, it is none other than a Kobe rival, Tim Duncan of the San Antonio Spurs, five-time NBA champion, best power forward of all time, the anchor of what became a tremendous long-running dynasty in San Antonio. At number nine, Larry Bird, six foot nine inches, tremendous three-point shooter, second best shooter in history, according to me, behind Steph Curry. He was the precursor to all of these stretched sports. He was a three-man, also a four-man, and by the way, the greatest trash talker in history. At number eight, Bill Russell. I couldn't deny 11-ring. Some people might think I put him too low. Didn't have the great individual numbers offensively, but arguably the greatest defensive player in the league, battling Wilk Chamberlain, Nate Thurman, Walt Bellamy, all these great centers. And he was winning every single time. At number seven, it's your man of the day of the week, Kobe Bryant. Yes, Kobe Bryant, 81 points in a game, nine straight 40-point games, 62 points in three-quarters. That was one more than his opponent's whole team, the Dallas Mavericks, and of course, five NBA championships, two times he repeated as champion, Kobe Bryant, you can't deny it. His teammate at number six, Shaquille O'Neal. I picked Shaq over Kobe, because if I had to choose one to start a team with, it would be the big man, Shaq Diesel, absolutely dominant for the bulk of his career, the first several, you know, decade and a half. But then that three-year stretch where he three-peded as champion with Kobe, 36 points, 15 rebounds in the finals. Then at number five, Wilk Chamberlain. Here's what I call the NBA record book. The biography of Wilk Chamberlain. I mean, that's how dominant this dude was statistically. 50 points, 26 rebounds, a game one year. Then the next season, 44, 45 points, 24 rebounds a game. I mean, his numbers are astronomical. We will never see them past or equal again. And of course, the hundred points in one game. At number four, Magic Johnson, best passer of all time. The precursor of all these big point guards, even guys like James Harden, who really aren't true point guards. We had never before, Magic, seen a guy that size running the show and doing the magnificent no-look behind the back, between the legs, passes that he did. Do yourself a favor and check out a Magic Johnson highlight. Oh, he played 12 years, made it to the finals, nine of those years and won five times. At number three, his teammate, Kareem Abdul-Jabbar, six MVP awards, that's the most in history, six NBA championships and the greatest shot of all time. The sky hook was unstoppable. It allowed him to play well past his prime at an effective level. So much so that he was 41 years old when he won his last championship. At number two, LeBron James, yes, already. Look, he's played, he's in his 15th year. He's already played more games than Magic. Larry Byrne and Michael Jordan. If he retired tonight, he would still have a full outstanding career. Three titles, I mean, the size of Carl Malone, passes like a point guard. Now he's hitting three pointers. Can't shoot free throws that well, but hey, he's human, LeBron James number two. And number one, of course, the goat. Just about everybody's goat, Michael Jordan, six-time NBA champion, 10-time scoring leader, 10 straight times led the league in scoring, broke all types of conventional wisdom. You can't build a dynasty around a shooting guard. Oh, well, here comes Jordan. You can't lead the league in scoring and win championships. Oh, but here comes Jordan. 30 points a game to him, which was his career average, was like what other all-stars did at 20 points. He could get 30 points in his sleep, average 37 points one year, 35 points another year, 32 points, eight assists and eight rebounds another year. Michael Jordan, the all-time goat, but no surprise there. I'm joined by Hall of Famer Ralph Sampson. It's great to have you here in the zone. Yeah, I'd love to be in it. Wish I could get back in the zone, but it's good. The basketball zone that is, it's good. When I saw, we saw each other at the airport about a year ago and we started talking, we had lunch together and I was saying, I really wanted to get you on the podcast because to me, you were like a forerunner to all of these seven footers now that play on the perimeter. You could dribble, you could shoot jump shots and at the time when you were doing it, some people kind of looked down at it. They wanted you in the post. Talk about that and how you, do you see yourself as kind of a precursor to these guys? Well, people have said that time and time again and I didn't pay attention to it over the year, but now I do a little bit more.   And then Rudy Tomjohn, which was a scout. But Rudy never wanted to be in practice. He wanted to get away from the politics of everything.   A seven-footer, you shouldn't be a shoot-through. A seven-footer, you can't dribble. If you turn it over, then what happens? But you know, my mentality is I learned from high school because of the boxing one and his own defense. I never get the ball. I had to go get it and dribble up. My high school coach would let me do it in practice every day. So you would bring the ball up the court. I would bring the ball up the court just because I couldn't get the ball.  So if you're gonna do it, we're gonna teach you how to do it in practice. So it started in high school. And then in college, we're the same thing, trying to be able to shoot, you know, Coach Allen was like, let me get the first long shot out of my system, you know, to get it out the way. So I just kind of evolved and then in the NBA, you know, we just saw highlights and trying to figure some stuff out as well.  And that's the evolution of the day's game. Big guys, there's no post-ups. The game is a three-point game.  So it's evolved. And I wish I was playing now. I was gonna ask you, would you have preferred to play today versus the air? I mean, I love both errors, but you know, I guess with the skill set that I had, you know, what could I have done today? I don't know. But I look at, I could post up, I could shoot a three, I could dribble, you know, the fan block shots run the court. I mean, it's a fun time to play the game of basketball and the skills I had, I probably would have, would have hopefully been pretty good right now. So I don't know how closely you followed the guys, but you got Chris D'Aspore-Zingus, seven foot three in New York, Yannis Adedicumbo in Milwaukee, Joel L. Embiid who even shoots some threes. Kevin Durant even is basically a seven footer. Who do you think you would have played, like if of those guys or maybe there's somebody else out there? Well, like all of them have a different, as you mentioned, have a different perspective, a different ability to play the game. I love Kevin Durant's game, but he doesn't have a post-up game, typically. Nabebe has a post-up game and he has a little bit of an outside game, but more of a post-up game. And nobody's able to stop him on the 12th of his size. But the Greek Freak is the one that you watch every day. Once you get that jump shot a little bit, but he can post up, he can run the court, but his, I watched him play the other day in his tenacity, just going to get a loose ball. Being active is a little bit better than most of those guys right now. And I think over the next year or so, whatever you can see him evolve and see how really, really good he is.  I think it's a combination of the Greek Freak and what he's able to do and Nabebe and what he's able to do if he can stay healthy. Again, Kevin Durant is the top one right now. Big guy, I think, but he probably doesn't consider himself to be the big guy, but it's size-wise he is. But his demeanor, his tenacity, his heart, you can't beat that. Now your perimeter skills enabled you and Hakim Elijah on to play well together. And I say all the time, you had about three and a half healthy years in the NBA. I think your injury, it not only obviously changed the course of your career, but I really think it changed the course of the NBA history because in your third year, your second year with Hakim, you guys beat the Showtime Lakers four to one in the Western Conference finals, got beat by Boston in 86 in the finals four to two. But do you feel that, like, the Lakers went on to win two more titles, 87 and 88, with you guys healthy, I don't know if they would have done that. How good could that team have been if you would have remained healthy? Me remaining healthy was one of the keys, but you guys understand we had no point guards. Yeah, was it Robbery? Robbery was our point forward. That point forward evolved at that point in time because we had our point guards go down with some personal incidents. And so, you know, riding McCray and Robbery was our point guards. Mitchell Wiggins played with us as well, and so we had no point guards. So we would have had a point guard and I'd stay healthy. I don't think too many people would have stopped us at that point in time. But again, the evolution of the game today with big guys, you know, I was the first guy to bring weights to the NBA locker room. You were? Yeah, Houston had no ways.   So if I'd have maintained that physical skill level on and off the court and with the evolution of what they have today, it'd have been a different story. Now that 86 Boston team that beat you guys, a lot of people think that might be the best team ever. Do you feel that way? Or what are your thoughts on that? I mean, they played well. I mean, Parrish, McKay, or Byrd, obviously unstoppable as far as the way they played. I don't think they're the best ever, but they're ranking it probably at top five. You know, if you look at the history of the league itself, those three guys, all Hall of Fame guys played well.  So it made him hungry the following year to go back and then have to play Boston again and defeat them. So that era, Laker Celtics obviously was the dominant team, but best ever is hard for me to figure out who's the best ever or the best team ever. You played against all of the best players in the 80s, including Michael Jordan in college, even in pros too, but who do you think is the best player of all time? Well, you know, I gotta stay with the big guy. So it depends on how you define the best. If it's championships, it's Bill Russell. Coach, I mean, so in the area he played in, he played against Welk, you know, played in the era. So I think the number one is Bill Russell. And then you can kind of pick and choose who's second, third after that. And then, you know, I always liked Welk just because of Welk average, double, double, average 20 rebounds. I don't care what area you played in with him. I mean, you can average what he did. So from a big guy, I like the big guys. You played Jordan in college. Did you have, I mean, he obviously was good in college, but could you foresee what he became at all at that time? Well, I tell a story of, you know, we play them down in Carolina, and he steals the ball from our point guard. They were down, and they put him on the point guard to defend. And so he steals the ball a couple of times, and he goes down, dunks it, and right, and then they get up in the game, and they end up winning the game. So you can see flashes of it. And I know he says all the time that only one that held him back was Dean Smith.  But you can see flashes of it, but you didn't expect it, obviously, to be who he became after that. I tell people all the time, he, you know, he could score 60 points against Boston and still lose. And that was great. But until he understood the game itself, and then they got some pieces around him with the triangle and started to make his teammates better, then it became to me, that's Michael Jordan, not before that, before he scored 60 points, and had his shoes and all that kind of stuff as well. That's just for flash. But when he started to learn the game and understand it, I think that's the Michael Jordan that people can respect. How good, because I don't think people fully appreciate how good Larry Bird was. You played against him, obviously. How good was he? Larry, you know, Rodney McCray had to guard him. And, you know, we would try to beat Larry to the gym. We'd go to Boston, play in the garden. You know, you'd go up to the service elevator, had rats and roaches and all the kind of stuff. You'd go up and you're gonna lock them. It's hot.  But Larry would always come to the game, you know, a couple of hours early to get his shots up. So we would try to beat him right here. And Robert Reed would try to get to the gym and beat him. They never could. Because he was in the gym a couple of hours before the game started. And working on this game, working the shots, getting his mindset right. So I think mentally tough, and you know, he wasn't a great athlete, but I think he was mentally tough to know what his skill set, what he could do, what he couldn't do. And he used it to the best of his ability. He became, you know, a Hall of Famer and one of the best players that ever played the game. Now he's, people have told me he was the biggest trash talker ever too. Did you hear him on the court talking trash?  You know, it's all day long.  But very quietly, it wasn't flamboyant, like Gary Payton or somebody like that. But you know, he would whisper and talk to you and say, I'm coming to get you or whatever. I got this, whatever. He would fake the ball one way and say in your face and this stuff like that. But again, that's this tough mindset he had. Who was the toughest player you played against? Oh, I tell people in that era, that question's been asked a number of times. I think the toughest player for me was myself. Because one night you gotta play Kareem. One night you playing Robert Pairs. One night you playing Moses Malone. One night you playing Street Rollins.   So all those guys will get, but I didn't like the Buck Williams. I didn't like the undersized big man.  So I hated those guys to play against. But I loved the centers because I could run them up down the court. Artist Gilmore's become a good friend. I hated to play against artists because he was the strongest human being that you could possibly ever see. He would take a Kimmel Arju on and put his left hand on him and just pick him up and move him anywhere he wanted to move him because he was that strong. So artists, you know, strong, human, love him to death, but we always wanted to dunk on artists. Rodney McCrae, he's just a big guy and he would take you out. But Rodney McCrae said, one game that I need to dunk on artist Gilmore and he finally got him but took him a couple of years to do that. But, you know, artist is a great guy but he's one of the strongest people I know. You mentioned all those centers. I mean, that was the best era of big men. And then, you know, Patrick Ewing and others came in later. How do you, can you even compare how a teams back then would play against the teams today? Like who might win a game of the best teams back then versus the best teams today with the three pointer? Well, I'm sure that, you know, you look at the Steph Curry's and the three point shot, whatever, and he can shoot it from half court. But can you imagine either Thomas defending Steph Curry or Gary Payton? They let you get physical. Right, it gets physical back then. Greatest player there is, but hand checking and all this kind of stuff. I don't think they would have done what they do today but they would have been still effective and they would have played well. But I think the teams back then would have killed cause of the mindset, cause of the mental toughness. You know, I tell people, when I played against the Lakers and they had Marvie Lucas, he would come jump ball and just hit me in the chest. Take an L ball, I'm here. Just from, the game ain't started, you know? So those guys would have never, you know, you do that today, like, okay, great, what's going on? The Flager. Exactly. But the mindset back then, I think it's tougher than the guys today. Now, you guys have super teams too. I mean, you and a team as a super team, obviously the Lakers, the Celtics, the Sixers had great players. How do you, not on the court, but just do you think the super teams today are similar or is it a whole different dynamic cause of the way they come together? Well, that's why it's a super team because the way, the structure, there's not enough teams with great players. So now you have to, I even become a super team. Back then, imagine, you had three good players, Magic, Bird, you know, with the teams, Kareem, James Worthy, Byron Scott, Michael Cooper, super team, the Celtics with Parrish and Mikael, Ainge, Dennis Johnson, the Sixers with Julius and, you know, they had Moses and they, so there was always super teams back then. Atlanta with Tree, Rollins, Dominique, you know, they had super teams back then. It just evolution of the day's game and social media and things that's happening that now Kevin Durant leaves and goes to go to the state. Now, as a super team or the Brown leaves and goes to Miami, as a super team, not too many teams have those type players anymore. So it's kind of warded down today as far as the league standpoint, my concern. And the teams that don't have super players, you don't never hear about the Utah's and they can never build a super team cause there's not enough players that are super players at this point. How do you feel about what Kevin Durant did going to, you know, 73-win team and then finally winning the championship? Well, you know, not a lot of people liked it in the beginning, especially the Oklahoma City Thunder. And I was telling people as well, can you imagine Oklahoma had Westbrook, Durant and Hardin? Whoever did you imagine that it should have been far and long time ago, right? And so I would try to keep that together from that standpoint. But, you know, KD was like to me, let me see what this year is going to be like before he left Oklahoma City. If we can't win, you're not bringing me any other help. I gotta figure out time for me to make a move. He makes the move. No one really likes it, but they play really well together. But in the finding moments in the playoff where he had to show up, he showed up. And so, you know, I gained much more respect. I respect him anyway, but I gained much more respect then because he showed up, he played MVP. He did what he had to do. He won the championship. That's what it's about. You and King were dominant, McHale and Parrish dominant, you know, even David Robinson and Tim Duncan later were dominant. I'm looking at New Orleans, DeMarcus, Cousins, Anthony Davis. They're just struggling to stay up 500. Why do you think, I mean, those are two of the best big men in the league. Why do you think they can't be dominant? I think they can be. I love Alvin Gentry as a coach, but you gotta put them in the right situation. You know, now the game has evolved from a post-up game to a three-point game.  Anthony Davis has evolved as a superstar, taking him a number of years to do that. Somebody has to step up. Somebody, you know, they need an old-school vet on that team to tell those guys, let's go play. And then they need some other pieces around them, and they didn't even have a different system, I think, of play, so that they can be dominant. The market in New Orleans is a little soft, probably, but they should be one of the dominant teams in the league. And the first couple of years playing together, they have to understand that Mannequin kind of knew our skill sets from the beginning, and it took us a year, and then it happened with a wrap. But I think those guys have to be a little bit more hungrier and know that we can take anybody out every night if we want to play. But again, this game situation down the stretch of the fourth quarter, somebody's got to put those guys in a situation where they can win. And maybe they don't understand game situations. Maybe they need a better point guard. Maybe they need a vet. You know, it's a coaching situation. So I don't know all the pieces down there that make sense, but they should be one of the dominant teams in the league. Nowadays, there's always talk about who's taking the last shot. LeBron's got to take it, or Doran, or whoever. I think when you hit one of the famous last shots, when you guys beat the Lakers in 86 in the conference finals. But I'm sure every time it was a close game, it didn't go to you. It could have went to Ikean, it could have went to somebody else. Do you think teams should do more of that, like just run a play, or maybe that has options where anybody could get it, or that they should always go to their best player? It's funny because people today use all these analytics in the arena and say, you shoot the ball from here, you shoot the ball. And they don't use that down the stretch because it's reacting. But think about Michael Jordan when he spread the court. He created shots for Steve Kerr, Paxton. And look, dude, you were in that corner, that's a shot you were to make. I'm gonna give you the ball, you better knock it down. And they did. So you got to know game situation.  There's gotta be a set play. Look at the Houston Rockets last year with Harden down the stretch. That table of basketball is good during the season, but down in the playoffs, when you gotta have a shot, somebody's gonna turn it over, nine times over 10. The ball's gonna be in the wrong hands with the wrong person because there's no set play.  So you can't get an offensive rebound.  So that's the playoffs, that's what happens. And then nobody ever, those of power teams, you gotta Steph Curry, those guys can knock down a shot. They understand the draw and kick and the give and go in the pick and roll because they played it so well. But if you down the stretch like LeBron the other day, he gets a lot of attention, but he has nobody around him that can take that last shot. So he has to take it and nine times over 10, you can make it, but when you don't, it looks really bad. Do you think anybody's a threat to beat Golden State this year or can beat them? I think so. I watched them play against Oklahoma City and Oklahoma, they had, everybody was ready to go and they beat them. I wish they had to get their stuff together, but you know, injuries is gonna tell tell this year, I think because of the long games and league and how long you play. So we'll see what happens to play out, but I think they're a team that can beat them. I think Houston can beat them if they play well, but it's a four game series, you know. So can you make those adjustments in four game series to be beat or not? And I think Steve Kerr and Steph and those guys are smart enough to make those adjustments. I don't know if Harden and Paul are ready to make those adjustments. He has been the first year to play together and it can Oklahoma City get their stuff together and then there's always Popovich. There's always Pop. I mean, this thing last year, what your nobody did in a series against Harden blocking the shot down the stretch and Popkin, he knows how to make those adjustments. So I always watch him, he's quieter than Cap. They'll sneak in, they got Parker back, they got the nucleus back now and let's see what they do in the next couple of months. People say he modeled his game after Michael Jordan. I had one more Jordan question for you. Last question overall. I was reading on your Twitter that Jordan wanted to play with you at Virginia, but Virginia didn't really go scouting. They just sending like a form. That's what we have talked about this number of times. He wanted to come, he wanted to play at Virginia, but they didn't recruit him that hard. We had a captive character that were coming in, but I need to ask Coach Holland that question. Why did they recruit him a little bit harder to make it sense that he would have came to Virginia, but I don't know if they thought he was ever gonna come out of Carolina from what I understand. And he wasn't like the highest recruited guy overall. No, I mean, it was freshman year. He got cut from a team. Yeah, yeah. And he tried to figure it out. So he wasn't recruited early, but I think from what I can remember, he said he probably wouldn't ever come out of North Carolina. Do you know him? Are you guys keeping in touch?  Yeah, every now and then. I mean, we see each other on the circuit, one of Fred Woodfield, that's the president of the team, the personal friend of mine, and I introduced Fred and Michael a lot of years ago. So they became friends.  He's like, I know, but we working on it, we working on it. So we can brass each other a little bit about that every now and then. I used to go down there to a one or two game of the year, just haven't done it in the last couple of years, but we'll see each other, respect. And we talk about basketball and just kind of be at the round a little bit.  Is that your experience? Absolutely. I can recall at dinner and we had this little private set with Achievement Unlimited Basketball School that they have down in North Carolina now, 30 some years moving. It was me, Michael, Donnie Simpson, a couple other people. And we were talking about cars. And I was like, okay, great. I'm a Porsche guy, Michael and Donnie had Bentley's and they're racing Bentley. They're talking about my car is faster than yours. And they do, what makes a difference? As long as you don't reckon that car, Michael had the motorcycle or whatever and Donnie said, they was going back and forth. Like, let's go race right now. It's like 12 o'clock at night. Like, dude, you're not going to race tonight. You're not going to race tomorrow. So very, very competitive. You know, at every, I think thing that he does or represents, he had that competitive spirit. Great. Well, Ralph, I thank you for your time. It was great to talk with you, great to interview you. And good luck going forward. Thanks so much. And likewise to you. Thank you. All right, here we are for our final segment of the day. As always, it is knock down, Jay, I bring in my man, Jason McIntyre, who gives me his best opinions and I knock them down like bowling pins each and every week on In the Zone. I'm about to go back to back. Last week I won. This week I'm going to win again. Like the Warriors. Who tells you you win? What do you mean? I don't know. The crowd, the audience on YouTube. You obviously aren't reading the comments. All right, Chris, first, I want to commend you on a very nice job on your top 10 all time players list. However, I was about to say, I know there's a butt.  You got to have Tim Duncan ahead of Kobe Bryant. I'm sorry. Listen, Kobe had a tremendous career. He would have been my 11th choice, but Tim Duncan is certainly, I had a Kobe Bryant. I'll hit you with a couple of quick things and I'll let you try to rebut them. NBA Finals, MVP awards. Tim Duncan, three, Kobe Bryant, two. NBA regular season MVP awards. Tim Duncan, two, Kobe Bryant, one. Years missing the- Do you have Tim Duncan ahead of Shaq? Just wondering. I do not. Okay, Shaq. Well, don't get it wrong. We'll get to Kobe in a sec. Tim Duncan has two. So just throw that last point out. No, no, we will come back to- Going back to Kobe versus Duncan. Tim Duncan never missed the playoffs once in his career. Tim Duncan's teams never won under 50 games with the exception of the lockout year where there was only 60 games or what have you. Tim Duncan has to be ahead of Kobe Bryant. That's it? That's all you have? That's all I need. Well, they both won five titles. They did. Tim Duncan had two Hall of Fame teammates for two of his titles or three of his titles. Just remind me of their names. Manu Jnobli and Tony Parker. Yes. And then he had three, what looks like, Kawhi Leonard looks to be on the path. A little early, but probably. A little early, but probably, right? So three of them for one title. And then just one teammate, David Robinson for his first title. Kobe Bryant had one Hall of Fame teammate for every one of his titles. Shaq, that's a heck of a teammate, but that's one Hall of Famer. And then Powell Gasaw, another great teammate, but that's the only Hall of Famer on Kobe's last two-peat. Here's another thing Kobe did that Tim Duncan did not. He repeated as a champion and not only did he repeat, he did it twice. Tim Duncan couldn't do it once. Kobe Bryant did it twice. Do you know the names of the players who have repeated in the last, since the NBA, ABA merger in 1976? Let me, let me read them all for you. Indulge me. LeBron James and Dwayne Wade. Oh yeah. Shaquille O'Neal and Kobe Bryant, Michael Jordan and Scotty Pippin, Hakeem Olajuwon, Isaiah Thomas, Magic and Kareem. That's an impressive list. That's, but to do and Kobe, of course, Kobe Bryant and Shaquille O'Neal and Kobe Bryant and Powell Gasaw did it. Not, then there's the little matter of, they both won a lot. Five rings, five rings. Did Duncan ever score 81 points? Did Duncan ever score 40 points in nine straight games? Did Duncan ever outscore an entire team by himself? I don't believe so. 2005, the month was December. Kobe Bryant scored 62 points in three quarters. The Dallas Mavericks scored 61 in three quarters. Wow. I mean. Regular season numbers, way to go. And you can't, don't get me winning cause they both got their five rings. Now let's look at a few of the individual things. Yes, let's focus on the individual. And you can't look at the ones that I just pointed out. You can't rebut those. Let me give you one more. Kobe Bryant had a 16 year stretch of outstanding basketball. Second year in the league, he makes the All-Star team. 17. He was the sixth man on the Lakers that year. He started one game in his second year. He made the All-Star team. Second year in his league, Tim Duncan was the MVP of the finals. He made the All-Star team. 17th year in the league, he averaged 27 points. So that's a 16 year, yes they did. Okay, they went around. That's a 16 year stretch of outstanding individual play. Duncan was great too, but he only had a 13 year stretch when he was in his prime. Then he came back and had rebounded a couple of years later with 17 points a game, but it's just kind of dry. Listen, Kobe was a scorer by nature. That's what he did. Tim Duncan was a rebounding machine. A eight time. Did he ever leave the league in rebounding? No, come on, of course not. He was where there was Shaq. Come on, Shaq was the rebounder in the league. Shaq never led the league in rebounding. Dwight Howard in his prime was like an MVP candidate. There were other great centers. Kobe was not. But he's better than Kobe. Tim Duncan. Tim Duncan, what he did, he never led the league in it. Kobe Bryant was not even the best shooting guard in the NBA history. Michael Jordan, we would agree on that. Tim Duncan, best power forward NBA history. Of course, who's the argument? Don't give me, call him alone. No, no, no. I go with Duncan. Unless you count, some people would count Larry Bird as a power forward. No, he was a small forward. Michael was a power forward. Again, individual games, Kobe was the scorer. Did Duncan ever lead the league in anything? That's a great question, I don't know. Did he? I mean, all I know is he led the league in three NBA finals MVP awards against Kobe Bryant. Kobe got zero, he was the second banana to Shaq. He got two. Yeah, when he got Phil Jackson later on with Paul Gasol, okay? That's fine. But a lot of people would be second banana to Shaq, including your man, Duncan, because you said he's ranked below Shaq. Well, no, in terms of rebounding, yes. Oh, you were my all-time top 10? No, not really. Okay, all right, okay, I thought you needed to do it. I think I just demolished your argument. So, head to head, Tim Duncan, finals MVP awards, more regular season MVPs. Is that fun? I just, you didn't say anything. Andre Iguodala has a finals MVP award. Does that mean we're gonna throw him in the Hall of Fame or something? No, but he's got, we're not comparing him to Kobe. That's not how you measure the better position. Listen, a spirited argument, I'll applaud you, but there's no way Tim Duncan's ahead of Kobe Bryant. All right, next topic. You are the number one O.K.C. fan, I believe in the building here at Fox Sports.  There's a bunch of haters up in there. So let me hit you with this statement. I don't believe Russell Westbrook will ever get back to a conference finals now that Kevin Durant is gone. And let me just hit you, only a couple things. Russell Westbrook's now 29 years old, okay? He's a 39% shooter this year with two great teammates. 30% from three. His game relies on athleticism, getting to the rim, thunderous dunks. He's 29. It's tough to keep that going as we saw with Allen Iverson, getting into the lane, getting to the foul line. His style isn't conducive to longevity. And I told you, he can't shoot. I compare Russell Westbrook to Iverson. Iverson at the age of 25 got to the finals, never got back. Dwight Howard, another great young player, got to the finals, age 23, never got back. I don't think Russ gets back to the finals. I don't think he gets back to a conference finals. Very possible, because obviously the Western Conference is stacked. It is. Golden States still a relatively young team. Everybody's in their prime. Houston doesn't appear to be going in where if Chris Paul stays there. Minnesota's coming, they're gonna be, you know, just keep it moving. As long as Jimmy Butler stays. Yeah, yeah. And even without Butler, they're still gonna have Carl Anthony Towns and then Andrew Wiggins and all that. So that's possible. What I would say Oklahoma City has to do, I like your Iverson comparison. I think you heard me saying that before. So you stole it for your segment. I did not hear that. But I do think he's similar to Iverson. There's no question about it. And the Philadelphia 76ers, the best postseason run they had with Iverson when they made the finals against the Lakers was when they put the right pieces around it. Fewer things they had. They put grinders, defenders, spot up shooters around Allen Iverson. Guys who couldn't really create on their own offensively. So they were happy to play their role. Those are the types of players you need to put around Russell Wesson. They tried that last year. Put three in, no, they didn't, they didn't have any shooters last year. Victor Oladipo was not a shooter last year. It's interesting that Victor Oladipo shooting really well this year. He wasn't a great shooter in Orlando either before he got to Oklahoma City. So you put three in these shooters around Westbrook. I love Stephen Adams with Westbrook, some defenders. And that Allen Iverson team had an all-time great coach in Larry Brown. No disrespect to Billy Donovan, but he's not an all-time great coach. I love when people say no disrespect because you're about to disrespect them. Yeah, not at the NBA level.   Oh, listen, if players are abandoning ship, are you sure players are abandoning ship? Nobody wants to play with him. How, what coach is gonna wanna go there? One player, isn't that one player?  He dealt it because he didn't fit alongside Westbrook. Paul George, we'll see. He's about to leave. We'll see what happens. Carmelo Anthony, let's see if he leaves a lot of money on the table to leave. My point is, I don't know that at 29, a leopard's gonna change his spots. What I'm saying is you don't need, I wouldn't try to put superstars around him. I would put three and D guys. Did James Harden have superstars around him last year? No, he had three and D guys. And he had a great system that Mike D'Antoni created. That's what OKC needs. They need a coach that's gonna create a great system for Westbrook and they need role players who will be happy to defend, lock people up, spot up, shoot at the three point line and rebound and let Russ be Russ. Now it may not work. It may not work because you have so many stack teams in the West, but I think that's the best route. Okay, so getting back to my question, conference finals, Westbrook, if you don't wanna say yes or no cause you're afraid or what have you. Well, let's see what happens. People love to clip this stuff and put it online and be like, oh, you were wrong. What's the percentage chance Westbrook gets back to a conference final? It's probably low. It's probably low cause the West is so strong. 3%? No, no, I'll give you 15%. 15? 20%. Yeah. Like I said, it depends on what they put around them. But Westbrook is a first by the Hall of Famer, iconic player. Who wouldn't wanna be Allen Iverson? I mean, everybody gets it. Would you rather be- If Bayla said today on Undisputed, everybody gets in the NBA Hall of Fame. So let's take that. But there's a Hall of Fame and then there's a Hall of Fame. Westbrook will be in the Hall of Fame. Would you rather be Robert Orrey or Allen Iverson? Let's save that for another day. I don't wanna go. Then stop dissing- That's a good question. I'm undissing. And that's what Westbrook is going to be. Westbrook is great. He's gonna be a Hall of Famer. He ain't gettin' to a conference championship again. All right, my final take. This is lukewarm. Like most of them. In addition to loving the OKC Thunder, you love you some Rockets. They were just on Speak for Yourself today. You said the Rockets have a 30 to 35% chance? Of beating the War State. I'm saying right now- They're the second best team in the league right now. Double zero, no chance. The Rockets, as of now, I mean, health pending, we'll see. I know you love to talk about injuries. No chance the Rockets take down the Warriors. Why? Why not? Oh, you want me to explain myself? Yeah, yeah. Okay, so number one, we've seen a worn-down Warriors team. Dreymond Green's miss some games. Kevin Durant has missed some games. Steph Curry is currently hurt. They're not at full strength. When they're trotting out Nick Young and Omri Caspy and Rookie Jordanbell, we know Steve, Steve Kerr's tinkering. Okay, so that's the first point. Number two, we've seen this from Mike D'Antoni, Chris. He's a great, phenomenal regular season coach. Post-season? I don't know about that. We're gonna find out. I also want to add, the Warriors have faced James Harden in the playoffs twice. 2015, 4-1. 2016, 4-1. And my final point, and there may be a point of contention here, I don't think you could go against the greatest backcourt of all time that you said last week and try to beat them at their game. I don't think you can try to beat the greatest shooting team in NBA history at their own game. I think you've gotta come at it differently. I believe the Memphis Grizzlies a couple of years ago, pushed them. Now this was pretty durant. Really pushed them with Gasol, the big men, the passing. Kerr figured it out. Nobody last year even slowed down the Warriors in the post-season. I don't feel like the 15th best team in three-point shooting, the Rockets, is gonna go toe-to-toe with the Warriors and push them in the conference finals. The Rockets currently have a top five offense of all time. So you can talk all you want about 15th rated percentage-wise in three-point shooting. Percentage, yeah. They're making, I believe, the most in the league. I'm just curious, does Mike D'Antoni responsible for number two and number five all time? The Suns? Are they all up there? No, I don't believe so. They're way ahead of the Suns. Showtime, Lakers, the Warriors, the Warriors of a couple years ago, or no, the Warriors of last year and the Warriors of this year, and then these Rockets. And to beat Golden State, cause you're only going to slow Kevin Durant, Steph Curry and Clay Thompson down, but so much. So that'd be in the case, even if you play knock down, drag out basketball, like Memphis or maybe even San Antonio would try, you're gonna have to score a certain number of points. I mean, narrowly gonna be slowed so much. So Houston, I think is capable of doing that. They can score. Now I do believe Steph Curry and Clay Thompson are the best starting backcourt of all time. All time. But right now when you add in the bench and Eric Gordon averaging 19 points a game off the bench, those three, Gordon, Chris Paul and James Harden, that's the best backcourt in the league right now. But that's unfair. Why is it unfair? They're all guards on the same team. That's a backcourt. Now it's not starting backcourt, but it's a trio of backcourt players. They also defend and that's what, you're right, Mike D'Antoni, I'm with you. He has his lack of attention to detail, has cost his teams in the playoffs before. It cost New York when he was there, not New York, it cost Phoenix when he was in Phoenix and they always would have a bad mistake at a critical time, a lot of times against the Spurs. But those Mike D'Antoni teams also didn't play defense. Now you have a team that's playing defense. Their seventh ranked in the league in defensive efficiency. Warriors are second by the way. Look, and I'm still favoring the Warriors. I mean, if 30 to 35%, that means I'm 65 to 75, 70% Warriors. So I'm with you on the Warriors, but I'm just saying this team looks like to me like they can play with the Warriors. I would favor Golden State, but I give them a decent chance. A decent chance of winning one game. Let me ask you about James Harden's problems with the Warriors. I looked it up. Four games last year against Golden State. Shot 31% from the field, 14% on three-pointers. By far the worst numbers Harden against anybody. That's the Clay Thompson factor. Clay Thompson is one of the best defensive shooting guards in the league. He against Harden now. I know what you're gonna say. Now you got Chris Paul to help. No, you got Chris Paul to help. If he does defend Harden well. He has to. You got Chris Paul now to take a little pressure off. And I'm concerned about Harden and Chris. They haven't been tremendous in the clutch. Chris has had his moments, but he's also had some bad ones. Let me, they've been great in the fourth quarter lately. Well, I'm talking about the playoffs. That's what it matters. Let's see if they bolster each other and give each other more confidence that they don't screw up in the clutch. But Paul also gives them a mid-range game. Last year they were very predictable. And those playoff matchups with Golden State in the past, they've been very predictable. Golden State's gonna give you all the mid-range you want. Well, take your choose. We're gonna make Chris.  So they force them off the three-point line and into the paint, they wanna go all the way to the basket. They don't wanna stop and take mid-range. Now with Chris Paul, you got a guy that can stop and take mid-range. So now you can do it in the paint, mid-range and a three-point. Let me ask a quick X's and O's question. We gotta wrap up, but you said these three guards and Houston, Gordon and James and CP3.  Well, those aren't, he's not a guard. See, that's the question. In the final five minutes, when the Warriors try out the Hamptons five, what are the Rockets countering with? I don't, they don't have an answer for it. You've got PJ Tucker. Now I'm not, nobody's locking up Kevin Durant, but Trevor, but no, it's not a problem. LeBron couldn't stop him in the finals on the four quarter. Nobody can lock him up. And that's the difference here. But if you make it come up. I just gave you the numbers. Clay locked up James Harden last year in the full regular season game. Let's see if he locks him up this time. I don't think he'll lock him up this time. He's so doubtful on Clay. Why is he so doubtful on Clay? Clay's a watchist. Clay Thompson loves these debates, and that's why he's a fan of me. You know his Flash Brothers, follow me on social media.  Oh, probably not. Jason McIntyre, Clay. But job well done, Chris. Yeah, I know. This is one of your more, it's the holidays, I'm in a generous feeling. I wanted to give him a shot at Kobe Bryant's stuff. Oh my goodness.  What, Duncan?  But good job. Knocked down Jay. My man, Jason McIntyre, he tries hard. I give him an A for effort. D, D plus for execution. But hopefully you enjoyed it. And join us next week. We had a great show with Ralph Samson, my man Jay Mack, and of course, the definitive top 10 NBA players of all time. Check us out on iTunes, Apple Podcasts, and SoundCloud, and leave us five stars and a friendly comment for In the Zone. We'll check you out next week. Oh, happy holidays.


Thank you very much Mr. Speaker. Mr. Speaker, I stand in support of the resolution brought to this honorable House. By the Minister of Finance to borrow from the Caribbean Development Bank the sum of five point two million dollars to finance the building capacity and resilience of the health sector to respond to the coronavirus 19 project. Mr. Speaker, this government believes that sustainable inclusive development requires us to paraphrase Dr. Jean Leo, the president of the CDB, to build a resilient ecosystem encompassing all dimensions of resilience including social, financial, economic, institutional, environmental and yes Mr. Speaker, health. Mr. Speaker, I am proud to say that our government is taking steps in all of these dimensions of resilience to ensure that we reduce the vulnerability of our economy to of course the vagaries of the shocks emanating from the global economy, natural disasters and pandemics. Mr. Speaker, we are all aware of the massive and unprecedented damage that the impact of COVID-19 had on our economy. Indeed Mr. Speaker, Saint Lucia was one of the economies in the world had its heat by the pandemic suffering a deep and unparalleled contraction in economic activity of 24.4%. Mr. Speaker, the IMF has indicated in its latest article for report that this is the largest output decline on record in Saint Lucia. It is the view of our government that the COVID pandemic was mismanaged by the former government from misguided fiscal policies that did not mitigate the fallout from the COVID-19 pandemic. We have articulated before Mr. Speaker the reasons for this previously in debates in this honorable house and there is no need to revisit it Mr. Speaker at this time. There is no doubt however that the COVID-19 pandemic exposed the structural weaknesses in the economy and clearly showed the need for us to address the structural weaknesses in our economy. There is no doubt Mr. Speaker that there is a need to reduce the structural challenges to growth and boost productivity by diversifying our economy through greater focus on agriculture and in particular food security, private sector development, exports, increasing energy, independence and addressing labor skill shortages and shortcomings through the establishment of the youth economy. Mr. Speaker this government has taken a strategy of a deliberate and focused approach of rebuilding our economy and our policies are beginning to bear fruit. After recording growth of 12.2% in 2021, Saint Lucia has recorded significant growth in 2022. In fact while we await the data from the statistics department the ECCB has estimated Saint Lucia's growth at a whopping 15.88% in 2022. Yes Mr. Speaker you heard right 15.88% but Mr. Speaker we will have ample time to debate the successful economic policies of our government shortly in the debate on the estimates and of course the policy debate. This growth estimate by the ECCB is much higher than the initial IMF forecast of 9.1% and reflects the success of the favorable policies pursued by this government led by a capable, competent and highly proficient economist our Prime Minister, Minister for Finance and the member for Cassuages. The sustained robust economic recovery of the economy is also taking place Mr. Speaker amid significant headwinds from the economic repercussions from the Russia war in Ukraine resulting in a lowering of global growth, increase inflation, higher interest rates, high oil prices and supply side bottlenecks but this Prime Minister and this government is ensuring that this economy is taking off notwithstanding the turbulence of the moment. The IMF in its latest world economic output in January of this year cut global economic growth in 2023 from 3.4% to 2.9% and inflation is projected at 6.6%. The IMF further forecast that the balance of risk to growth are tilted to the downside particularly possibly having severe health outcomes associated with the reopening of China and the ongoing Russia war in Ukraine being major risk factors causing global growth to contract even further. The reopening of China is likely to boost economic growth but that there are risk associated with the transmission of COVID across borders and having potential adverse impacts associated with the spread of the virus. Mr. Speaker, the world has learned to adapt and adjust to COVID and the reopening of the world has been largely successful with St. Lucia being one of the most successful countries in its swift economic recovery. However, Mr. Speaker, COVID remains with us and we must not rest and become complacent. At the 44th meeting of heads of carry come recently held in the Bahamas between 15th and 17th of February less than two weeks ago as of government reaffirmed the need for member states to remain vigilant and continue to carry out active surveillance and promote the use of established prevention and control guidelines to curb further the spread of COVID-19 and other infectious diseases. The heads emphasize, Mr. Speaker, the need for a more comprehensive approach to COVID-19, monkeypox and other regional health security threats. In this regard, Mr. Speaker, I wish to accentuate in this Parliament the decision by the World Bank to establish a pandemic fund which will finance critical investments to strengthen pandemic prevention preparedness and response activities at national, regional and global levels with a focus on low and middle income countries. We must not drop our guard, Mr. Speaker, and ensure that we take the necessary action to be proactive and address the impact of COVID-19. It is to be noted, Mr. Speaker, that CAFA reported 12 cases of COVID-19 sub variant XBB1.5 which has been circulating in China, the United States, the United Kingdom and some other countries. According to the Chief Medical Officer, the confirmed cases are distributed in most districts with the northern and central regions most affected. According to John Hopkins University, this strain of the virus, which accounted for less than 10% of cases in the U.S., now accounts for more than 25% of cases. It is said that the virus contains more mutation to evade immunity than any other variant. It is further said by the experts that the virus has a mutation that is helping the virus to better bind to cells, thus making it more transmissible. The experts have indicated, Mr. Speaker, that someone infected by an earlier strain of COVID is likely to be reinfected with XBB1.5, given that it is more immune, evasive and a person's immune response naturally decreases over time following infection. This reminds us, Mr. Speaker, that we must constantly be on our guard as new mutations of COVID-19 are likely and ensure that we equip ourselves with the tools available to combat this dangerous virus. This loan, Mr. Speaker, from the Caribbean Development Bank in the amount of 5.2 million U.S. dollars will go a long way in strengthening the capacity of the health system to respond to health threats and emergencies. It must be seen within the context as one of the important channels of assistance that will be required for St. Lucia's strategic holistic response to COVID-19 to ensure that we can keep our economy open and to ensure that people are protected, especially the elderly and those with pre-existing medical conditions who are vulnerable to this disease. Mr. Speaker, as I prepare to close, I want to of course express that I'm sure that we can all agree that this is a small price to ensure that our economy continues its rapid recovery from COVID-19 and our people remain safe. The loan is highly concessional in that, it's highly concessionary and in that it is repairable over 20 years in 80 equal installments with a freer grace period at a variable interest rate of 5.16 percent on the amount of the principal disburse and outstanding. Our government is a credible, trustworthy and honest government, Mr. Speaker. We will only go through credible agencies like the CDB. Having said so, Mr. Speaker, I wish to thank you, Mr. Speaker, for granting me leave to make this very brief intervention and therefore I yield the floor, Mr. Speaker.


So, next, um, I'm gonna make the same joke I did earlier. Don't care. Uh, how many people here use antivirus at work?  Oh man. CISSP over here. How many people have said, well, I'll solve this problem, I'll get an EDR, yeah? How many people think the EDRs are worth a shit? Ah, sucker. Time to learn about how EDRs may not be as effective as you think they are. Let's give Nomad a big round of applause. Had a great time, man. Thank you. Appreciate it. Hello Defcon. And today we're going to, well, my name is Dimitri Snashkov. And a couple words about what I do and who I am. Just because it is applicable to our talk. Um, Red Team Operator helped my team execute the testing efforts. Um, sometimes create tools. Sometimes release them. And so because this talk is going to be from the perspective of Red Team Operator, um, I want to set some stage before we go dive into details. Um, I think that Linux matters. I think that it runs a lot of payloads in the cloud and elsewhere. And I do think that, uh, attack and offense actually tries to get there as fast as they can by passing office networks, dropping there through applications. And I do think that the defense follows the attack. And as such, we start seeing as operators, we start seeing a lot of presence of EDR on Linux. And so what is EDR? Endpoint detection response, right? And we as operators are supposed to kind of respond to that by stress testing them and seeing what they can do. So it's a story, right? It's a story of us getting onto the Linux box time and time again and being caught. Fifteen minutes, ten minutes. What happened? Two, three years ago it wasn't the case. We knew exactly what we were doing there. Now there's this fancy thing called EDR. But we can't really define what it is. Is it a pure play EDR product? Is it a side gig for whitelisting applications? Is it a DLP? Perhaps it's maybe some homegrown scripts, right, that catch us or some form of other manual or tool assisted, uh, threat hunting. And so when we drop to the box, we do not know what it is. On top of that, we have to address initial foothold. Let's say our exploit worked, we got there, but so what do we do? How do we maintain presence there? Our activities may be logged, supervised, right? We need to stay there for a while. It's not a fifteen minute job to establish a foothold and basically compromise anything else in that network. We have to persist. While we're doing it, we're supposed to evade automation that is definitely watching over our actions. And maybe even deflect the artifacts that we brought in into that environment. On top of that, we may be in a position that we are in quiet boxes and defense actually knows what they run. White listed binaries, processes are quiet, right? So we are the anomaly. There are two sort of ways of, uh, tackling our issues strategically, right? It's an operational evasion where we shut down the EDR, blind it in a way, you know, maybe we're confusing it from the operational perspective. And you guys really need to check out the talk that Timson and Ruth Killa has done this morning for that. Here we're gonna take a look at the behavioral evasion, right? So what does that mean? We are gonna try to take the execution of our programs and we're gonna confuse EDRs from that standpoint. We're gonna try to bypass them from the behavior of our, uh, cradle, payload, bootstrap, whatever the case may be that we're gonna talk about. And then we're also going to try to deflect that artifact discovery that we've been talking about. Alright, so what are the objectives strategically? Well, we know we need to, uh, we need to evade detection at runtime. That's, that's a given, right? Somehow we need to serve their payload, our payloads in such a way that they're either undetectable or maybe easily sort of, um, you know, they're, they're created in such a way that EDR doesn't know what to do with it. Strategically there are three choices. We can drop our tools right on the box, but that may not work because they may detect our, our, our programs, our malicious payloads right there. We can start developing offensive tools right on the box, but then we have to make sure that we have the development facilities. We have to have compilers. Maybe we can have some tools on the box themselves to, to compile all that. Also not ideal. And the third choice is fully living off the land. Utilization, right? We take what we're given and try to work with it, but then again, we do not know where we are, how quiet the box is, what is whitelisted, are we going to find what we can rely on to extend and maintain our foothold? And so maybe there is a way to do an assemble attack, right? It's a blended approach that has a couple of ideas. The first idea maybe we can bring in small malware cradles that are not malicious in nature. They're just bootstrap code that gets loaded with malicious code at runtime as it runs. And so EDRs, they're building the story of consistent execution of a program is not going to be able to do that. Or maybe we can interject into that story and then build the iterative capabilities by loading our cradle with a malware. The second idea is probably more powerful, depends on where you are, is to take the whitelisted binaries and essentially turn them into Trojan horses, turn them into decoys of our own actions. The reason why it's powerful is because the whitelisted binaries are there, they're supposed to be, they're trusted. So the story that EDR builds, we're attacking the trust, right? And that's more powerful. And in this talk we're going to talk about both of these ideas how they can actually progress in parallel. So in the first stage, we're going to see how we can actually work with what ingredients do we have to build that cake, you know, to cook it, to bake it rather. And we're going to heavily rely on preloader in Linux operating system for that. We're going to see how we can chain our preloading and then maybe hide some things from the EDR. And last but not least, we're going to talk about the concept of rapid prototyping which is really important. Because of the constraints that we cannot bring our own tools and we have to somehow try to build them on site, rapid tooling prototype is really important for us. In the second stage, we're going to try to weaponize and operationalize the offensive capabilities that we've built. We're going to look at mimicry and decoys in operating system for our own actions and benefit. And we're going to see some other things that will help us persist. So stage number one, let's take a quick trip, you know, down the memory lane into the dynamic linking and loading. Just like in other operating systems, your linker is a tool, set of tools, a framework that allows you to basically assemble your executable with dynamic libraries, static libraries, whatever the case may be, essentially present a consistent view of that binary, right? The loader and linker, they see two different execution views, they have, or two different memory footprint views, right? There is a linker view and there is an execution view, segments versus sections. And linker basically says, okay, well, I'm going to find your dynamic library if you are looking for it at runtime and I'm going to patch it into the executable, I'm going to run relocation of the memory and I'm going to hand it off to the actual execution. In practice, if you're the operator or any user of the Linux system, it looks very simple. When your executable is compiled with dependencies on a dynamic library, if it runs and it doesn't find the dependency, it bombs out and you're given an error pointing to the actual library that is missing. Once the dependency is found and you can do that by various tools available on a Linux machine, you can actually launch it back and everything is going to be fine if your library path is set up right and your dependency is found. And also the other concept is, um, is, uh, elf hooking, right? Used everywhere for malicious and non-malicious purposes to introspect binaries to change its behavior to hot patch a binary. Essentially what it does is you can use the, you can use the preloader to actually find a library that is supposed to be loaded into the memory space of the executable with the feature and functionality that you can introduce into it that is foreign to the execution of that binary itself. And so you can basically say, okay, well, I can take a functionality, I can reroute it. We're breaking the API contract here by rerouting our execution to, to the libraries that we bring in. But there is a problem with that. The problem is that you need to know the API. If library is, C library is known very well, there are main pages for it, the contracts are known, the APIs are known. For example for F open case, F open, uh, API, you know exactly what it returns, what it takes, and how that works. And so when you're preloading the binary with a known F open API, you know how to interject that, right? You can reroute it and interject it. But unfortunately in the black box scenario that we're working in, when we're dropping in the box and we do not know what we are trying to preload, that presents a problem. But for first need to understand what that binary does, we need to trace it, maybe reverse engineer it a little bit, we cannot do it most of the time on the box itself. So what if we are going to be a little bit more agnostic as to the specifics of the API we're trying to hook? What if we are not going to the actual subversion of the target? We're not going to rewrite functionality in the library that we're preloading. But we're still going to compel it to execute our code. How do we do this? Let's look at the relationship that the processes have on Linux, parent and child process. If you're the parent of a process, you likely, let's just say, own the bootstrap process of it. You can introspect it and you can have some formal relationship between the two. And so we can try and deliver the payload generically in a known way by abusing this relationship and trust. And then, you know, the world is your oyster. You can do other things with it. Let's see how that works. But first is just the viability check. Why do we need to do this? Well, if we're taking the two paths, the clean preload cradles, right? And the second path is using the binaries that you find on the disk. You can time the loading of the modules and you can actually work towards blinding EDRs that way. The EDRs may not be able to fully trace your execution if you're taking care of splitting your payload into different libraries using the preloads. And you can abuse the parent-child relationship on Linux and attain your goals that way. What we want is we want to take a target process and turn it into this monstrosity instrumented with our payload, our malicious payload, and also trigger that payload or parts of it when we want to. So let's walk through that process. In order for us to do this, let's turn our attention back into the ELF format. But in this case, we're going to look at it from the offensive standpoint. We're going to take the sections of the ELF and we're going to try to introduce malicious code in it. Well, in the case of a cradle that we're bringing in, it's really easy because we can compile things into those sections. And our compiler, our friendly compiler, is helping us with that by using sections like init array or finny or maybe even as a pre-nit array. Essentially, we can supersede the understanding of the execution by injecting code into the sections that will be executed before your main, right? And so the one curious thing or side effect of loading and linking, I guess, in this case, is that control is given to that shared object that you're introducing through loading before transferring control to the main. So you see what we're doing here? We're basically trying to preload the executable and interject and control its execution before it even starts. Pairing child relationship, maybe. The other thing is we can take a look at things past ELF format. We can look at the library, libc library in Linux operating system. We can actually hook libc start main. The reason why that's useful is because libc start main is everywhere. It sets up the memory, you know, hooks up different things, sets up execution contacts for executables on Linux, at least in many cases. And we can do that, right? By basically hooking libc start main and then looking for a dynamic next function that goes into the original main. By using the dlc and dl open. But that's not optimal. Why is this not optimal? Well, let's go back, actually. The reason why it's not optimal is because EDRs can actually look for dlc and dl open and basically deny your execution. It's very easy to trace and see what dlc is being used and just say, no, you guys cannot load any libraries into this process. Okay. Well, if you, if you, the EDR do not like us that way, what we're going to do, we're going to use a facility called weak symbols. What weak symbols mean is that if you are trying to load a binary with a library of your choosing and you define a function, maybe a global function or some variable that you're exporting from that library. Normally, as we've seen before, when you cannot find a feature or function that you're looking for, your destination bombs out. It basically says, no, I can't continue. I can't find that code. Well, what weak symbols are doing for you is it says, okay, well, if it's not present, just skip it. Maybe it's loaded down the line, but we don't care about that. So if we are dropping in a sandbox and we're seeing, okay, well, do we have a library sitting next to our executable or otherwise found through the library path, we can find it, we'll load it. If it's not there on the sandbox, if we did not, if some, if, for example, incident response has taken our library, but not, has taken our binary cradle, but not the library, then we're not going to launch it. And so this story unravels, right? You can chain preloads and libraries through the weak symbols. You can say if it's present, launch it into memory, it's not, then skip it. That's called controlled weak graphs. There's also foreign weak graphs. Did you know that almost every binary on Linux contains weak symbols? And did you know that you can actually hook them from the library preloading them? CXA finalizing GMO start is a good example. There are others, especially in the, in solutions that deal with, for example, Java virtual machine. So essentially what that gives us is if we're not able to bring our cradles, we can find weak symbols in libraries or executables on the box itself because they're given to us and we're going to take advantage of that. And also I talked about the chain weak graphs. You can actually split the execution of your payload or the payload itself across a chain of dynamic libraries. So when the EDR gets one library, it doesn't see the full picture. That's what we want. Next up is the construction, right? The constructors are very useful when you're coding C or C++ application. You have a way to say, okay, well that's my constructor, you know, so it's a virtual memory for dependencies and all that good stuff. We can take advantage of that. How do we, how do we do this? Well, what we do is we preload a binary with a library that defines a constructor for that execution. So essentially before it gets to the main, we're saying, oops, that's an object. Don't do execution of a main. Instead, run the constructor before you hand it off to main. And the same thing with destructor. Before the binary is, you know, ends its execution, just execute whatever we're given in a destructor. Destructors are powerful that way because you can time the execution of your malware. Nothing tells you to, if you're preloading slash bin slash ls, bin slash, your malware has to run at the outset of that execution. You can run for hours and then when the, well, bin ls is not a good idea but maybe some, some long running process, right? And when you kill it, maybe sending a signal to it or whatever the case may be, this is where you trigger the execution of your malware, right? So now with the constructors, we can do it in a target agnostic manner. We can take any executable on Linux and basically start preloading it in a generic way. And if EDR technology actually knows about that trick and they say, okay, well, we'll interject and we'll just give you a constructor, a default constructor, turns out there are priorities on the constructors. And so if they load at a default priority of 200, what we can do is we basically load it that's at the priority higher than that at one on one, right? And the same thing with the destructor, we will basically patch a different priority to a constructor to override the defense. The other thing that we can do to break that story that EDR kind of builds by saying, okay, well, indicators of compromise are there, you know, are they building a story? Is it a malicious executable? Is it not? Am I going to kill it? Am I not going to kill it? Is to trigger that malware loading through out of bed signals? Not only regular signals, but even exception handling, right? Nothing tells us that we cannot instrument our cradle or preload the the decoy library decoy decoy binary on the system. And then basically divide by zero. That's not a recoverable event in most cases, but we can implement the handler. So what EDR sees as a completely disastrous event and stops looking, we recover from it and we continue running, right? Tips and tricks like that. So you can self trigger your own execution there. And we're actually going to see that coupled with other things later on. And then obviously if you're bringing in your libraries, you can start building user land root kits on it. You can clean your LD preload from your own environment. So if EDRs are looking at your memory space and says, hey, where is the payload? And if they're relying on environmental variables, they're not going to be able to find it. All that good stuff can go in their obfuscation of your loaders, right? Runtime situational checks. Possibly even foregoing the main itself. Maybe you're doing some assembly tricks to basically saying, okay, if EDR is looking for main, I'm not going to have it, or I can rename main to something else, something innocuous. And you can even substitute the actual loader LD.SO on Linux to have your own into the interpreter section. So if EDRs are instrumenting in some way the LD.SO, they're not going to see it executing. Okay, so now we have some primitives to work with, some recipes, some tips. How do we progress further? How do we expand and scale our presence there, right? That's important because we have to have almost all a cart set of tools and primitives in order to bypass different versions of EDRs because we do not know what it is, right? It could be whitelisting technology that we know about. It could be something else. Okay, well, we mentioned LD.SO as a default linker and loader for Linux operating system. What about system libraries and binaries that run other binaries on systems? Well, LD.SO not only runs programs that, you know, that it finds or Lipsy start patches it in, but it can also run directly your payloads, right? And if your EDRs are watching over the regular expressions like what is your process name, right? I'm not going to allow some things that I do not like and I can only do things a certain way. That known good story, that trust has been broken if you are able to preload the actual loader with chained execution of other system binaries on a system that you can find them, right? And that goes into the whole idea of, you know, who gets there first, right? Like are you watching for Busybox? Are you watching for LD.SO? Are you watching for VI launching into the memory, switching TTYs and basically executing your code? Are you doing all that EDR? If you're not doing all of that, then obviously you're going to miss that. But from our perspective, from the operating perspective, that's too chatty, right? Because that assumes that the defense can analyze our command line, right? And so it's also all that, you know, it may be really easily defeated. Okay. Well, we need to devise some other things. Maybe we can up our anti- invasion capabilities. Maybe we can bring in, interpret the languages into the mix, right? So we can prototype easily once we drop in the box. And so before we actually get to interpret languages, we can even talk about highly reflected pieces of code that are encoded into the shared libraries. Nothing to say that you have to create your shared libraries out of a C or C plus plus, right? You can actually use form function interface and run things out of Python or maybe compile things with the C go. And by the way, what does it give us? It gives us as an attacker a privilege of 256 functions highly reflective before the defense can actually find our main and figure out how we're executing. So just by shimming, it, shimming out of the consistent, consistent execution of C language into some other stacks, for example, interpret language or VMs or other things that are very highly reflective, the EDR loses our trail and therefore it cannot build a consistent story to be able to determine if we are malicious or not. And the same thing with interpret languages, you can actually run some things in it, for example, you can preload things with Lua. That's a completely different execution and it gives you different memory footprint if EDRs are not watching for it. And you can, with Cheney, you can mix and match all these things. So see how many, it's a death by a thousand cuts in a menu of respects as far as EDR building that story. That's what we're after. We're basically trying to abstract it to the point where we're persistent, you know, if, if it's not a known good and if it's not a known bad, because EDRs are running on, you know, most EDRs run on performance and they cannot consume too much CPU time or, or analysis time, they'll say, okay, fine, I'll let you go. And so right now we know that those primitives that we're trying to build are not that primitive, right? But stage two is how do we package this whole thing? How do we make this rapid prototyping actionable? How do we make it maybe even more defensible for us? So start thinking about preloader, preloaders. Let's start thinking how do we expand the functionality and make them more flexible, I should say. In this example, if we're taking slash bin slash ls and we're preloading it with our malware execution chain, right, any arguments that we're passing in into the preloader are not going to end up being used because they're eaten by the ls. Well, you know, what can we do with this? How can we make our loader even more expanded? We can start moving back on the command line with environmental variables that are being consumed by the preloader, right? And mind you, in this case, the preloader is only a dynamic library. It's not an executable. It is loaded as a constructor into slash bin slash ls. And so in this case, we are saying, hey, you know, take that bin ls, preloaded with libctx.so, by the way, go into the background, by the way, rename itself in the process table as SMTP process.  And by the way, pass arguments to those chain, to the chain or to those libraries that were preloading. That's one way of doing it. And those chains can use all the things that we talked about. They can be highly reflective. They can escape into, into interpretive languages. They can even switch on different IPCs, right? They can run over pipes or they can source their payloads over various facilities that the operating system has. Now, and obviously they can clean up after themselves, right? They can remove all the things that they've loaded, ld preload, all the environmental variables. So if you're there first, you'll probably see that. If you're not, you won't.  The loader that we're trying to do, the preloader chain that we're trying to launch, at least one of them is a file, right? A file, ld.so tries to load first. And as such, it's on disk, it's scannable, admins can find it, whatever the case may be. Yes, we know about EDR identity crisis. Yes, we know not everything is being watched, but there is a chance. So we want flexibility. Can we work with memory? Can we load things over memory? Well, loading modules into the memory is a really interesting thing. It's very common, right? Mapping memory and stuff like that. So your operating system is going to love you for that. There are facilities. But as soon as you start trying to execute something from memory, your operating system will not like it at all. So, historical has been, there have been many different ways of operating shared memory on Linux. Dev SHM, right? You can stuff some things in there, but again, EDRs may know about that, they watch it. Naked memory mapping of files is also something that is being watched by EDRs because you can put permissions on it, you can change permissions, you can create, read write, execute sections in there, and then, you know, obviously that's detectable. And most of the time, you can't really obtain execution from memory location because of that because you cannot mark your memory executable at some time, you know, sometimes you just can't do that. As kernel 317 rolls in, we're gaining a specific separate system call, which is MMFD create. That's not a new technique to load things into memory from MMFD create. But if you want to do this, here's the API to do this, MMFD create, you allocate memory, and then you basically pass it to F exec VE, or maybe you emulate execution, but the point that it works, you basically have a way to execute things over memory, right? Essentially, it is the relaxed, the operating system relaxes rules on execution when you use that specific system call. But that's not what we're after. It is going to hell, but we're not after that. A curious side effect of running MMFD create is that it exposes a file descriptor like any other Linux process in a proc, right? And that MMFD creates a proc FD, in this case, you know, 2, descriptor number 2, for example, or 3, whatever the case may be. That's what we're after, and let's review what we can do with this. Well, if we're breaking the story of EDR, and we're splitting payloads across libraries, we can split payloads across memory spaces of processes. We can say we can have, we can line up 10 cradles, launch them up into the memory, and those 10 cradles are going to be separate processes that may host a part of the payload. How do we reach out to those processes and ask them, hey, give me your part, give me one tenth of a payload so I can execute it. This is what we can do with MMFD create. Instead of if we're taking the preloader and instead of executing and loading the module from a disk, we can ask a different process to give us a descriptor that maintains or contains the library or a payload in such a way that we can execute it. So we're gaining, we're reaching out to a process ID, 564117 and saying, hey, give me an exposed file descriptor. The only problem here is while we're actually doing execution and loading from memory, what is 564117? And if we're not in the relationship with that process, if we're not the parent-child relationship or we're not super user, then we're not going to be able to see that, you know, that process descriptor because of the Linux security model. So let's work on 564117. And before we do that, we have to look at the nature, which is really brutal at allocating resources and very efficient. And there are things in nature that you can learn from, right, we can learn from. One of these things is a phenomenon of a virus that infects a specific ant colony, right? And once the ant is infected, the virus doesn't kill the ant. What it does, it basically turns it into a zombie by saying, okay, ant, I'm going to control your muscles instead of nervous system.  At this point, the spores mature and then they rain down on other ants and the story continues, the cycle of life, right? The interesting part from this is the fact that we're controlling the muscle system of an ant without killing it. And so a zombie ant farm is designed to do exactly that. It is an out of target process store of payloads. It's a broker and a dealer of the payload that is somewhere in the memory that the preloaders that we're looking at can ask it to release payloads for their consumption. So it is a broker that reaches over the cross process memory for a payload. Without going into details on how it actually does that in terms of what features it has, defensive capabilities and what not, let's first think how it works conceptually. Conceptually, this ZEV essentially it loads things into the memory. It asks the operator to load payloads directly from the URL into its memory and then expose the payload that was loaded from the URL into the memory, into the operating system, into the file system, through the proc. Right? And then your uber preload basically goes out and says, retrieve it. And because I can actually launch my parent child relationship with the preload, then I gain access to the payloader's memory space. This is how that looks, right? Your payload chain, because we're operating on the same user ID so we can introspect processes. We're saying, go give me a payload out of somebody else's memory space. And by the way, do it in the proc. And by the way, do it from the memory. And by the way, I don't care about your ADR. Right? And so in this case, 564117 that we've seen before, it acts as a broker and a dealer for the payloads for us. Conceptually, you know, the big picture is how that works, right? You have facilities and primitives where you create this monster target process that you can instrument with different, you know, code running through sections or compilers or loaders, wherever the case may be. Your loader asks Zaaf to basically give him the payload or features or functionality. And it loads the target executable with them. So what the ADR sees, now it needs to connect the dots and see the full story across memory processes of the entire, you know, maybe 10 or 20 different mechanisms. The IPC, the sockets, the URL retrieval, you know, two different processes that are involved or three different processes that are involved. And if it gets the real cradle or a clean executable, it's not going to see any of that. So that's where we're after. So the pipeline is getting stronger here. Okay, well, one other problem that Zaaf itself is a, is an executable. How do we, it's a catch 22, right? Like how do we get executable that doesn't drop on disk? So we can get the library payload that doesn't drop on disk by using Zaaf. But how does Zaaf get there? Right? And so we're returning our attention back into MMFD create, but only doing this from the interpreted language. For example, Python. Right? Through common function interface, you can call up the Linux operating system sys calls, right? You can say, hey, MMFD create from Linux or from Python, execute itself and give me whatever you're going to give me. Well, Python is just a string of text, right? You're not dropping executables on a disk anymore. What you're doing is just running a script in the Python. So now you're extending that story for EDR all the way out into just a string of text that loads, that executes the, the URL retrieval of Zaaf itself and launches it in the memory through the interpretation, through interpreted language. Py preload is what I called it, right? It reaches out to the URL endpoint to web server, fetches things and launches them into the memory by using decoys. So for example, when EDR or your threat hunters are looking at the process table, what they see is a bash, for example, that launches bin ls, but they do not see the relationship of the Python code basically getting things out from elsewhere and unraveling that chain. So again, we're trying to blind the EDR from the behavioral standpoint so it doesn't build, doesn't have a chance to build that story. And along the way we're basically trying to, to prevent EDR from having, to latch on any kind of trust that we're doing. Okay. And so, you know, conceptually it's really easy now, right? Like a Python script that is very small, it's a text, you drop it in, it gets a Zaaf, Zaaf launches into the memory, Zaaf itself has facilities to interface with. So we're having a shell script go out to its socket and say, hey, load all of your payloads from all these other locations, be it file system or, you know, external network interface or URL, whatever the case may be. Store it in your own memory space and delve it out as needed, as asked. And a whole, you know, if we were to have a visual of this whole thing it looks like this, right? Number one is your PyPryload driver that gets the Zaaf out of the external location. In memory execution of a process for Zaaf, Zaaf presents a driver sort of socket that says, okay, well, here's your, you know, Jason, go get me something from external, expose me some, some payloads and I'm going to use the Uber preloader pipeline to go get the payloads from it and I'm going to instrument the process that I want slash bin slash alas or whatever the case may be to do the bidding on our end. So all that is we're going to, we're going to go into a demo and this demo is going to show if we can do that. Okay, so that's zombie and farm, right? First we're going to fetch a remote binary and execute it from memory as we talked. And so we have a, we watch the file system just to make sure we're not dropping anything on disk, right? And then we're launching a HTTP server to serve the payloads and in this case there's going to be a malicious alas command for example that comes out of that URL and pipe preloader is a python script that says, okay, that's a binary go fetch it, execute it and load it from a specific file descriptory. We have a way to do this and yet we're seeing that nothing has been dumped on disk, right? Nothing is there. The second thing that we're doing is we're actually, you know, fetching the preloader library if we want to. Exactly the same thing, executing it without preloader, seeing that it works, right? Then we're watching the file system making sure it's not dropping anything on disk starting the HTTP server. And then essentially telling the preloader that what we're loading is a shared object out of somewhere in the URL, executing it in the bin alas and by the way, you know, that bin alas is not going to describe something on a box. So both bin alas and the preloader runs in memory with, you know, loaded malicious code here, okay? Then let's fetch Zaf. Let's do exactly the same thing to it as we did previously to the alas. So let's basically break that story even more. Same thing, watching the file system launch in Zaf, saying that it's running as bash, executing loading it into the memory as a process 12, 8, 2, to 4. Zaf itself opens up a management socket that we can send commands to and basically saying okay well Zaf now load the same alas from external location as a module in its own memory space. And let's make sure that we can actually see that module loaded in there, right? File descriptor 6. We had forced the last one. Let's see where it loaded, right? So MMFD is a ephemeral descriptor that is executing in Zaf memory space and then we can just go directly for execution of that alas. Instead of doing a path on disk, we're doing a path in the memory catching a file descriptor 6 from Zaf, right? And that's a regular executable that we fetched. Pretty powerful. And then, you know, we basically just keep doing this. We can, you know, create preloader chains and those things. Doing exactly the same thing here, right? We have our previous module that we have loaded, but instead of loading executable we're going to load a library for preloading and it should end up being on file descriptor 7, which is true. And then instead of executing out of proc we preload alas with exploit that comes out of its, you know, Zaf's memory, right? The module is still there. You can destage it however you want. But the point here is that we're now splitting execution of payloads and delivery into two memory processes. Okay. Other things, other research to break that story that is going on right now, it's not fully complete but I kind of wanted to talk about that a little bit, is if we are owning our code crave, or code cave, essentially we can randomize, we can remove ASLR from the process by creating a personality trick, right? We're basically forking executable, we're changing the personality and we're executing it without the memory space, with memory space that is not randomized anymore. And then we write or read into the memory process, into the process memory, our exploit. So our exploit no longer needs to come from a library that you preload, it can come from a text, right? How do we do this? Well, we essentially, like I was saying, we fork then address the randomized, put a flag on the personality adjustment of a process that we're launching, because we're parent and child relationship, we're able to do that, and we're releasing it for execution. And then if we have a destination process that has a code cave that we can stuff our exploit in, we're able to do that in an address, in a user-to-user address space by writing a process VM, write a V. So we're working on this. Summary, preloading is a really viable path to evasion. Grab the executable from Linux, preload it, do it in memory. Out of process payload delivery works. And in my view, it's going to continue to extend into more attacks, and we're going to do more research on it. From the red team perspective, do not use, you know, all of that on one engagement at the same time, because it's going to burn your payloads and mechanisms of delivery, choose things wisely. C forward and function interface is important to interface and to escape from EDR story by basically switching the stacks, the technical stacks, and then use those source of assemble attack, splitting, scattering and then assembling things on a box as you choose to, it depends on which EDR you're going against and what the consequences may be. The code for both zombie and all these examples is released. You guys can download it, play with it, send bugs, add to it, it's open. Defense, optics into proc, optics into IPC, optics into process loader, optics in MMFD create must clearly define what EDRs do for you in the scope of your threat model, what it can and cannot do, and start implementing Linux capabilities. There's no reason why BNLS should run a socket code, right? And obviously last but not least is start thinking about the protective context, quiescing your boxes, making sure you know what runs and how you're protecting your stuff. Thank you.


And another protest in a dough state where youths took to the busy Beniz-Apelle road over the continuous neglect of the failed portion of the road. The visibly angry protest has converged on a section of the deplorable portion around the bypass calling on relevant authorities to intervene. We have all the mineral resources to see that this country, I mean, they compete with international standard. But no, some individuals have decided to sign for, keep our money, our God-blessed resources within their pockets and they're proficient in the less privileged. Enough is enough, we are... We cannot get government. We cannot get government. We cannot get government. This is a policy we cannot get government. We cannot be like this. I cannot mention one benefit that we are getting from this country as a citizen of Nigeria. There is none. We fight for road, we fight for light. We go to healthcare to buy drugs ourselves. There is nothing you can be proud of, say, I'm a citizen of Nigeria. There is no government present in our country. Whatever we enjoy today is what we are giving ourselves with our own sweat. So now we have come out peacefully to demand what is due us and until that is until we achieve that, we are not leaving. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


In the last video I showed Whippersnapper our IoT no-code platform with the Adafruit Funhouse and I configured three different buttons and if you press them they show the status of the button. Now we're going to visualize it with an Adafruit IO dashboard. Each component on an Adafruit IO Whippersnapper device is a feed on Adafruit IO. So if we add a new block to the dashboard, let's say a gauge block and we scroll down to where the Funhouse is and we click the select button next step and it's only going from zero to one because it's a digital component and we make the block nice and wide. We'll click create block and we'll move it up, make it a little bit larger and then whenever I press the button the gauges value will change and it will also be reflected on the device.


Is cold calling transformative or troublesome in our classrooms? Now, one of the most popular blogs that I've published this academic term is a summary of a piece of research about cold calling and if the evidence suggests, does it improve engagement in class? So, you know, what if we re-evaluated this technique? I was a big fan of it for many years in my classroom. I guess the critical questions are, is it a fair approach? Is it effective? Is it inclusive in our classrooms? We want all our children engaged in our classrooms, not just passive learning. We need every voice heard, not just a few. More importantly, we must check for understanding, not kind of promote uncertainty. So cold calling, often like a jigsaw puzzle, fits into some of our classrooms but it's mismatched in others and as ever, context is key. Without proper use, cold calling might miss the mark and I think for the term ahead, leaving students disengaged or overlooked as we approach the exam season, must be something we need to consider if it's something that's promoted in your school. Cold calling in class does improve engagement. I guess the challenge for us all is how does it line up with the recommendations on cognitive load? How does it work in early years and does it work at the start or end of a lesson? I guess all these details require more unpicking but as ever, nuance is recommended with all teaching ideas.