Everyone knows that being 40 years old or over means being over the hill. In other words, your prime years are behind you. Maybe you've come to this conclusion yourself. You have some nagging joint pain. You don't recover from hard workouts like you used to. You seem to gain body fat easier than ever and building any strength or muscle feels impossible. I guess you should just give it up, right? Wrong. Look, here's the truth that every good fitness trainer and coach knows about training people who are over 40. They have more life responsibilities. Look, you have a career, you pay rent or mortgage and you have a family to care for. You also have had the time to accumulate injuries over the years. All of this poses new challenges, but it does not mean your body is all of a sudden not capable of incredible physical change. It simply means you need to change your strategy. How do I know this? Well, I've trained people just like you for over two decades. I'm also familiar with the data on strength, fat loss and physical performance. And the truth is, you can get in some of the best shape of your life so long as you approach your training lifestyle the right way. This is why we created Maps 40+. We understand how to program workouts to take into consideration life stressors that can affect hormone levels and recovery. We know what exercises and what kind of workout programming takes common joint pain into consideration. We know what gets the over 40 year old crowd into amazing shape.  You will work with your body and not feel like you're battling against it. With Maps 40+, you will see and feel strength, performance and muscle gains like never before.  This program isn't just a workout. It also includes lifestyle habits that will balance hormones and turn back to clock. By the way, I've personally been working out since I was a teenager. And now that I'm deep into my 40s, I also use the principles in this program. And I feel and look as good as I did in my 20s. Maps 40+, is what your body needs to feel strong, healthy and vibrant. By the way, Maps 40+, also comes with a 30 day money back guarantee. So you can sign up, follow the program for a full month. And if it doesn't deliver, if it doesn't blow your mind, if you don't feel younger, stronger and healthier, return it for a full refund. So there's nothing to wait for. Get started now. Click on the link to do this. All right, we're launching a brand new program. It's called Maps 40+. We actually wrote a program specifically for people over the age of 40. This is also the first workout program that includes lifestyle programming, so not just your workout, but lifestyle programming. And we also include dietary and supplement guidelines. And so that's what we're going to talk about in today's episode, special considerations when you turn over 40, exercises, workouts, you know, what kinds of things you do in the morning and the evening to help bring back those youthful level of hormones. Now, because it's a brand new program and it's a brand new launch, it's going to be on sale. Okay. So if you are interested, you go to Maps 40+, dot com 40 is the number 40. So Maps the number 40 and then PLUS.com and use the code 40 launch.  One of them is the health babes guide to balancing hormones. And the other one is the four phase histamine reset plan. These are both incredible, incredible books from Dr. Becky Campbell and her team. By the way, this sale and this offer ends Sunday, December 24th. So if you're interested in the $80 off and the free ebooks, you got to get this program before the 24th. Today's giveaway is the super bundle. That's a lot of free programs. Here's how you can win it. Leave a comment below this video on the first 24 hours that we drop it. Subscribe to this channel and turn on notifications. If you win, we'll let you know in the comments section. They call turning 40 over the hill. I guess that's because after you turn 40, everything goes downhill. You're not as strong. You're getting body fat a lot easier. It's harder to build muscle. You just don't feel the same. Now when I was younger, I used to scoff at that. That's not true. I think it's just because you're not living the way you used to. But then I turned 40 and I did notice some differences myself. So in today's episode, we're going to talk about the unique challenges that are posed to people who turn 40, why they may be in those challenges, why it's harder to build muscle. Fine joint pain, more common hormone changes. Should they work out like everyone else? That's what we're going to talk about in today's episode. So this particular topic is funny because I've been training people for a long time. I started training people as a kid and I would always hear people, clients say to me, you just wait. You just wait to get older. Just wait and see. You'll see what I'm talking about. Just going to catch up. And now to be honest, a lot of that had to do with their lifestyle. So that's for sure. There's definitely, well, I don't think I need to make the argument, but your lifestyle, how you exercise, sleep, eat, I mean, has a massive impact on how you feel your performance, body fat, muscle, that whole thing. But age also plays a role for sure when all those things are equal. And I experienced this myself. Right around, I would say, as it got to like 37, 38, it did start noticing a few things. And so this became a lot more personal. So you know, having, talking about this and creating a program specifically for people in this age group, interesting, it was a lot of fun because I don't think I would have done this or been able to do this, you know, 15 years ago. Well, yeah, you couldn't. You wouldn't have the experience. Yeah. Wrong perspective going in. Do you still, I mean, I still think it has very little to do with the number and the age and still a lot to do with the behaviors or lack of habits that we had in our early years. So like, even though we would all consider ourselves healthy, 20, 30 year olds, like we exercised, we lifted weights, you know, hit your protein intake. For the most part, we probably had relatively good diets. But I think there's a lot of things that we probably did chronically that was not good for us as far as addressing sleep, mobility, recovery.  So, you know, I still would make the argument that most of it has to do with just behavior, behaviors or poor choices that have accumulated over time. That's a big part now affected because I'm all like those things. I don't think I thought were affecting me because at that time in my life when I'm 25 and I made that decision, your body was so resilient, you bounce back. And I just think that over years and years and years, it's compiled. And now in the forties, I feel all the physiological changes that my body has happened. And now a lot of the things that I ignored or I didn't think were that important have now become very important. Yeah, I think too, and even from my own perspective, but also a lot of the clients I trained, it was a lot of the mentality of sprinting. Like we could we could tackle a lot of this at once and sort of resolve some of these things we knew that were probably weren't benefiting us very often or we fell off a bit of the training or the nutrition got a little bit out of hand. But you know what, I'll just kind of tackle that before summer or you know, I'll try and get everything kind of back in order. And each time you do that, like year after year gets harder, harder, more difficult. And it just wasn't like a repeated lifestyle habit of I'm continuously making the right decisions, making the right behaviors. It was more of a I'm going to make up for this when it's beneficial to me. Look, look, OK, in a nutshell, every decade, things do change with how your body responds, your hormones, how your body recuperates and adapts. And there's a reason why people talk about the age of 40 being over the hill, right, that term, because that's when things, especially if you don't do the right things, that's when you really start to notice. Now, I notice with my peers, right? So, you know, I've been, all of us have been working out for years and years and years, and there was a difference between myself and my peers who didn't do those things. I could see a difference, I could feel a difference. But man, when we hit 30, the difference got bigger. When we hit 40, the difference now looks massive. Like my 40 year old peers that don't do the things that I do, there's such a vast massive difference between our health and our function, not to mention just how we look, but all the other important stuff. So, in a nutshell, here's really what this is. Yes, your body's different when you're 40 and older. Yes. But here's the other part to it. There's a lot of stuff you can do that'll counteract a lot of these negative things that you'll notice right around that age. And we've talked about this on the show many times.  You should mold it around the context of your life, and that includes your age. In other words, what is going to keep you healthy and fit at 20 is not the same as what's going to keep you healthy and fit when you're 40. And that's not going to be the same as when you're 70 or 80, okay? Now, the general guidelines are the same. What does that mean? Well, you want to move, right? You don't want to overeat. You want to make sure you get good sleep and you're adequately hydrated. You don't have nutrient deficiencies. Like that's all generally true, but when you boil it down, there's some big differences in the considerations that you have. And so all of our programs really are designed for specific avatars. Some are more for beginners. Others more for advanced, some are for power lifters. You know, some are more for athletes. And then you can modify them and individualize them based off of your goals and how you feel and that stuff. But this is really the first time that we've really tackled the age thing. Like, what are the considerations that we generally see with people that are 40 years old and older? One of them are, and we'll start, well, let's talk about some of these, right? One of them is hormones.  If you were to look at them at 20 and then you looked at them again at 40, all things being equal, you'll see differences. You will see some differences. Women tend to have a larger change right around that time. But men do as well. I don't know, man's testosterone levels start to decline, especially if they don't do anything to offset it.  But if you don't, right? If you don't use the tools at your disposal, then your hormone levels start to change quite a bit. Now, what does this feel like? Well, it feels like, here's a big one that people notice as they get older. Well, OK, we'll get to the obvious ones because you named one low energy. Obviously, here's an interesting one. How about the way you store body fat? OK, if you're listening or watching this podcast, you may notice this, that when I gained 10 pounds now versus 15 years ago, it doesn't seem to go to the same places. If you're a woman, you may notice more belly fat, whereas before it used to go to your hips and thighs.  What's that?  Now I'm gaining it in kind of these different areas. Well, that we know through studies is related to changes in hormones. That's a very unique and interesting one. Now, you mentioned, of course, energy levels. That's a big one. Labido. Labido is another massive one. You can have a very youthful labido, but oftentimes people in the stage group notice they don't. And it's a, now there's a lot of things that go into labido. Or worse, sometimes they think they're normal or there's nothing wrong because they've been that way for decades now. Right. I mean, more often than not, when I have trained somebody that's over 40 and I ask questions around their labido or drive or their testosterone level. And if they haven't tested, many times they'll be like, I'm fine. I'm good.  They just didn't know. Well, what's that old saying?  But if you put it in warm or cool water and slowly boil it, it'll die. It won't jump out because it took time to get to that point. What you're talking about, Adam, is not this drastic because you would know, right? If you went from like youthful hormone levels one day and then in two days you went to this like really bad hormone problem, you know, like, oh my God, something's wrong with me. You go to the doctor. But if it's like a gradual, slow change.  Yeah. And you're throwing band-aids on top of it. A little more coffee in the morning. You know, okay, here's some sedatives at night. Oh, I need an anti-anxiety medication. Oh, here's throwing SSRI on top of that. Here, let's do this thing. Let's do that thing. Not realizing that your hormones went from what are called considered optimal to terrible because it was this step approach that probably started right around your early to mid 30s and you didn't start to like really notice until you get to your mid 40s and something's off. Oh man, and it's funny because sleep is one of those things hormone-wise that, you know, if you're getting really good sleep, your ability to, you know, keep things somewhat balanced is so much greater than when you get older, you notice when you don't get good sleep, you don't just bounce back. Like these are things that like my entire day, sometimes my week is affected by like a couple nights of poor sleep or it becomes your new default. It becomes I only get four hours of sleep just because my body just wants to get up. And then now I'm just making this a routine. And so it just kind of, it's one of those things that gets away from you and then now, you know, trying to correct it makes it even crazier. There's a silver lining in that point. And probably the part that I think excited me the most about putting together this program because we attacked lifestyle and it was first time ever like an age group is that all those things that you now notice, so the negative things that you notice that you've gotten older, the silver lining in that is when you make these adjustments, right?  Dramatically. Dramatically, where I felt like in my 20s, if you messed with some of these, you turned some of these knobs, I would give you the like, yeah, maybe kind of feel it. We're with clients now that are over 40, if I get someone to dial in their hormones or dial in their sleep, dial in some of these things, holy crap. What did you know? So I'll bring up an interesting study I read years ago on this. Now, this is within healthy ranges that I'm referring to, okay? So if you're outside of this, then this might not make a big difference. But for men, what they found with healthy men, so healthy active men, healthy active men will have testosterone levels that are healthy, right? So the hormones reflect your health typically. So if they're healthy, testosterone levels are gonna be pretty good. But what they found when they compared like men in their 20s to men in their 30s, 40s and 50s was even though they were healthy, there still was a little bit of a difference in testosterone. It was still a little less as the men got older, not a lot less, but a little less. Here's what they found though, that the healthy active older man had a more concentrated amount of androgen receptors. They had better androgen receptor density, okay? So for people that don't know what that means, the androgen receptors are what testosterone attached to, okay? The more receptors you have, the more active or powerful whatever amount of testosterone you have is. So as men get older, if they're healthy and they do the right things, even if testosterone does start to decline a little bit, your androgen receptor density gets better. You know what that means? That means it doesn't matter, your testosterone went down a little bit. In fact, there's other studies that show that within a healthy, optimal range, right? So we're not talking about extremes here. So I wanna be clear. Within a range that's considered healthy and yet somewhat optimal, it was not the testosterone levels that dictated how much muscle the men built. It was the androgen receptors, how dense they were. So this is a silver lining if you're a man listening right now and that if we can, you know, and we'll talk about some of the stuff that we put together, but as you start to work with your body and get your hormones to look more youthful, right? Or to get to those youthful profiles, you'll probably respond better than if you were in your 20s and you were doing some of this stuff. Now I don't know of any studies on women in this particular case, but I would surmise that it's similar. Women also have androgen receptors. Believe it or not, a lot of people don't, you know, think that testosterone is the male hormone. Testosterone is extremely important for women as well. Just as important as it is for men. The difference is the ratios. When a woman has low testosterone, she has the same side effects or effects that a man will. So I would surmise that it would be something very similar. And also just to kind of point in this direction, when you look at top-level strength sports like powerlifting and you look at the records that people set in their 20s, 30s and 40s, many world records are set when people are in their late 30s or early 40s, okay? So these are world records, okay? So what's my point with what I'm saying is that although age does play a role, if you know how to change your lifestyle and work out and diet accordingly, then it's not gonna play a huge role. It plays a huge role because your lifestyle hasn't changed even though your age has changed. So what does that look like, right? So think about this, right? You take your 28-year-old versus let's say your 45-year-old. So we'll have an age gap there. Typically, who has more responsibilities, right? The 45-year-old is gonna have more responsibilities. You're probably dealing with kids, a career. Fully in your career. You got way more to lose, like all of us, the three of us are all entrepreneurs, okay? We all have wives and children now. Changing your business and starting a new business, it's a lot scarier now than it was before you had kids and you were younger, nobody's dependent. So you've got that on top of you. You're also, your time has spread out a little bit differently. Because of those responsibilities, I got things to do that have nothing to do with what I wanna do just for me. I gotta do things for other people. I gotta do things for my kids. I gotta do things for my business. I have responsibilities. I do things for my wife.   You go do a lot of stuff in the gym. I could go spend two and a half hours, doesn't matter what I'm doing in there. You know, most people over 40, just even if they wanted to, they couldn't. Even if we put together the perfect workout that was two and a half hours long, they'd laugh because they were like, well who's got two and a half hours? Right, right. So that's another big challenge that we need to, you have to tackle. Another one is joint issues.  Like, that doesn't, you don't start to notice age-related joint issues that have specifically to do with your age until you're much older. Typically what it is after 40s and 50s is that if you've been moving in ways that are suboptimally, you've just been doing it for longer. So if you're 25 and you've been running not great or you've been squatting not the best or you've been sitting down for a long time, in your 45, you've just been doing it for 20 more years. Now it's gonna start to show up. And so the workout has to consider that. You can't just throw the same workout at somebody who's 45 and 25 without considering that. You know, the silver lining in this again is forcing you to make better choices around your exercise selection, the amount of time that you spend on the working out, the intensity level that you train at. It has to be balanced with stress though. All these things that I think initially when you start to age, you start thinking as like, these are all these negative things. These are all, oh my joints now or oh I only have this much time or oh I've got all this other stress. But really what it ends up doing is it forces you to really nail down what is ideal for me and how does that compliment the rest of my life which ultimately leads you to this like better way of living anyways. Give you more efficient and more effective with everything you do. It just takes more attention. And I think that's the biggest takeaway I've found about like, you know, getting older is just like, again, yeah, you have more responsibility, you have less time to just really burn. And so I wanna only stick with things that are actually gonna move things forward for me the most. And two, along with age comes wisdom. And so you go through a lot of that process. Hopefully you get to a point where you realize, okay, this really works well with my body and this is what I need to stick with and create that consistency. That's why this is my favorite part about being 40 plus and going through all this and figuring this out is like, I've cut out all the fat. I've cut out all the other.  And I wasn't in- Because what else were you in? I wasn't in better shape than what I am today. Like I was literally spinning my wheels most of the time. And a lot of stuff was overtraining and overdoing stuff and way more than I need to or doing a lot of things that were way less effective than other things or neglecting the stuff that was gonna move the needle more with my overall health. Where now if piece that together where it's like, man, the stuff that I do in the gym now is way less but elicits a lot more results for me and compliments my life. And I think that's the silver lining in all of this stuff that, oh, these are all these challenges that we have as we get older. But really all it's done is forced me to focus on, okay, what are the big rocks that in my lifestyle and in my training and in my nutrition that I need to hone in on. And I feel like that's probably the funnest part about putting this all together was piecing that together on the same way that we would with a client. Well, obviously, we'll start with workout. We talk about that all the time on the show. Now, all exercises have value, okay? Some are more valuable for some things and others more valuable for other things. But ultimately the best exercise for you is gonna be the one that you can perform with the best technique and the best form that allows you to accomplish the goal that you're trying to accomplish. With that in mind, you have to consider when I'm training somebody or working with somebody that's over 40, I have to consider certain things. A couple of things that are quite common are core stability, hip movement and mobility, shoulder mobility and then knee and ankle type stuff, but knee being the big one.   Period end of story because they're more appropriate. There's just gonna be exercises that are gonna be more effective when you consider those things. I'll use a silly example but this is a tool that I used as a trainer, which I used more of as a trainer that I personally discovered the value of by using it on myself. Just one silly example which is a sled. The rate of injury and how it moves the joints is so much friendlier than any other lower body exercise that would be in the same category of muscle building, strength building and fat burning. There's a lot of safe, there's a lot of, I don't wanna say safe because all exercises are safe if you do them right, but there's a lot of lower risk, lower body exercises but the trade off is always this. It's not gonna build muscle as much.  The sled is interesting because the sled is a high performance producing, if you do it right and you program it right tool that's up there with the barbell squat, barbell lunges, Bulgarian squat, that kind of stuff. It's up there but it's also, it's one of the few exercises or I should say tools that's simultaneously in the same category as safe, correctional type exercises, okay? It's rare to find by anybody who's a very rare, if you're a trainer or a coach, strength coach, you know this, you got your categories of exercises. If you tell a strength coach and you say, pick, give me the top four lower body muscle building, power building, fat burning exercises and also pick me the top four correctional exercise, safest, lowest risk of injury and pain exercises, none of them are gonna match except for the ones you can do with the sled, okay? That's what's so rare about it but there are other movements like that for the rest of the body and there are ways that you can program them so when creating a workout for someone who's over 40, this is a very strong consideration. What exercises are we gonna use that kind of fit both categories?  We will not settle for trading results, like okay, you're gonna get less results but you know, you're older so you have to do this thing over here and I know that there's cases where that's true but the whole point here was, can we do this with both? Can we do both? Can we make this feel good on your body but also kick-ass results? Yeah, you still want the results. But considering some of those other factors of higher risk in terms of joint impact and there are exercises that will require a bit more of that joint stability and strength and if we're already in a position where we have a little bit of joint dysfunction, we're addressing it with mobility practices, we're trying to kind of reintegrate that and make sure that all that is in order, meanwhile I wanna build strength and I wanna keep my muscles built and developed, we can incorporate things like the sled to accomplish that very effectively and also too, it's just one of those things that it carries over and translates towards functional activity. So things around the house, being active, being strong, active and energetic in your everyday life is gonna benefit your interactions with other people, your family, your work, all these other things to consider. So it's just adding all that up and assessing what has the most value now in terms of efficiency and effectiveness from each exercise is something to consider. I really thought of it like this or think of it like this. You know, when we wrote Maps and Aboled, Maps Performance, Maps Aesthetic, when you add all those up there, it's about nine months worth of programming so there's still like three months left. If I've got a client that I'm training that's over 40, I feel like this is something that comes in annually every year. So every year, and then say they love those programs, right? Anapolik's been great for them. They saw great results, performance, they love the love aesthetic, they love training that way. And this is somebody who's over 40. I'm cycling this in as their fourth program. It just makes total sense that we always have this to balance them out and to keep them feeling good forever. I see it like that. Yeah, well, look, just to give another example of what I'm talking about. Okay, if you listen to the show for longer than a week, you've heard us talk about the value of the barbell squat. Phenomenal exercise, one of the best movements you can do, one of the best muscle builders, if you perform it right, it's gonna improve the health of every joint that's involved, which is pretty much most of the body. It's extremely functional. There's a lot of carryover. It's just, they call it the king of all exercises for a reason, but it is a high-skill exercise in comparison to others when you have to have good mobility, good control, good stability, because if you don't do it right, then it can become something that can cause pain and injury. Okay, so you could take a barbell squat and you could change one little thing about it that pretty much doesn't take away any of the results you get from the squat, but does dramatically reduce the potential risk that comes from the squat when your form isn't just right. And that is to eliminate the need to change directions as you're doing the squat itself. In other words, when you're put, let's say you put 100 pounds on your back and you're squatting down, when you change directions to come back up in a split second, you're actually squatting more than 100 pounds. There's momentum is involved, okay? And that's typically when people cause problems, either chronic issues or acute issues. Chronic in the sense that over time they're like, my knee bothers me or whatever or acutely like, yeah, I got to the bottom, tried to come up strain and I got hurt. Well, a box squat.   So that's just one simple, very simple example of what I'm talking about. Now there's a lot more that goes into programming to work out like sets and reps and when you do lower reps or when you do higher reps and when you combine them and when you include things that are more plyometric, you might think to yourself, what does plyometrics have to do with working out over 40?  Jump off a truck. Yeah, yeah, yeah, yeah.  It's because you've lost that skill cause you stopped practicing it. In this program, we also included ways of redeveloping that skill. Why do you need that skill? Cause life is not controlled.  This is when people tend to hurt themselves, but there's a proper way to program that. Now that's just the workout portion of kind of what we had to put together. The real considerations though, the ones that were, where we really sat down and spent a lot of time was in the lifestyle, this is the first program we've ever created. This is the part I'm most excited about. This is the fun part. This is the first program where we give you lifestyle programming and we have dietary guidelines and advice as well. First program we've ever done that. So this is why I think this will forever become my annual tune up program. And the way, and I'm gonna do this one right now. So the way that I think I'm going to approach this, and you just kind of went over just some basic concepts in the programming of the training, which I'm excited to do, but I'm more excited about the lifestyle stuff because of all the things like we're gonna address the morning stuff, the evening stuff, the diet, all these things and really what I'm looking for in all these lifestyle goals that we have or the things that we set as far as like the hacks and stuff is when I apply them, the things that I notice as far as a return and like where have I been missing big time, right? And so that's why I like it is like this annual reminder. Cause it's not like there's things that I have included in here that we've never talked about before or I've never done before. But the question is like, oh, how consistent have I been with that? And if I am applying those things, which one's giving me the biggest return? And so I love the idea of this program being this annual tune-up on the exercise side and then also like an annual check-in with myself on the lifestyle side. So I think of like exercise tune-up, lifestyle check-in is like the way I'm looking at the way I'm going to approach this. Right, cause if you can ritualize this, like what a benefit that's gonna provide you with everything else you're pursuing especially physically. And two, to get on track with your diet and to get on track with your sleep and all these other factors that we know move the needle so much in terms of overall recovery. So you try any of these other programs too. I love that as like a sort of a check-in to see where we're at and where we can improve. Well, here's the main considerations with the lifestyle guidelines that we included in this program. So number one, we looked at what are things? Well, here are some of the problems we need to deal with. One, insulin resistance starts to become an issue right around now. This is when your body isn't responding to the same amounts of insulin as it used to. And this is a big problem, okay? Insulin resistance is connected to, I don't think you can find a chronic health issue that doesn't have this as a component or as a root cause.  These are the, what they would refer to as the powerhouses of cells. So we looked at, okay, how do we, we want to improve insulin sensitivity. Obviously the workout does a lot of that, strength training, one of the best things you could do. But what are the other things that we could do that improve insulin sensitivity? Here's the second one, cortisol. Uh-oh, everybody hears cortisol, they think that's a terrible hormone, stress hormone, get rid of it. No, no, no, cortisol is an essential hormone in the body. If you had no cortisol, you'd be terribly unhealthy, would not be a good thing, okay? So everybody talks about crushing cortisol, lowering cortisol. That's actually not accurate. What really needs to happen is you need to have appropriate cortisol levels in the morning and in the evening. This is the way cortisol's supposed to look. You wake up and cortisol goes up.  Then it starts to taper off and come down in the evening. That's when you're starting to relax and rest and then you want to go to sleep. What happens when people's cortisol levels are all kind of all over the place, is they either, A, get this inverted cortisol pattern where cortisol doesn't want to go up in the morning, so give me big coffee to kind of give me this artificial energy, then because of their body's inability to deal with stress because they're not in good health, because they don't exercise right or they don't eat right or have good sleep or lots of other reasons, the cortisol starts to respond later in the day and then they find themselves, how many times have you heard this from a client like this that we're talking about? We're like, I have no energy all day long and then when it's time to go to bed, I can't sleep. It's like I'm exhausted at lunchtime, we have a meeting at work, I could barely keep my eyes open. I think to myself, I can't wait to go to bed tonight, go home, deal with the kids, do the thing, put the kids down, try to go to sleep. Why am I tossing and turning?  So that inverted cortisol ratio is what a lot of people are dealing with or you get this cortisol level that's kind of high all the time. By the way, you could start to develop a resistance to most hormones, cortisol being one of them, meaning your body stops responding to it and so your body needs to make more and more cortisol. So now you're in kind of this higher state of stress.  So you may notice like, oh, I'm storing more body fat. Like I gained 10 pounds, I've gained 10 pounds before, but why is it all in my belly now? The hell I never had a belly before could be connected to something like that. We're also looking at optimizing the hormones testosterone, estrogen and progesterone and having them be youthful and appropriate. And then the final one is growth hormone. Growth hormone is the youth hormone. You'll see, you'll hear about celebrities taking human growth hormone to make themselves fully younger and all that kind of stuff. So that was one consideration. The second consideration was what are the things that people can do to make their bodies more resilient to stress? Because you're gonna be more stressed out when you're older just cause you have more responsibilities, okay? If you're 45 years old and you don't have any responsibilities, go find another podcast because you need some help. But most of us at that point you've got some big responsibilities and that's a good thing. But what are the things you could do in your lifestyle to help you deal with those things? And then here's the third consideration with the lifestyle guidelines and programming. Is it gonna give you a big bang for your buck and is it something people can do? Right? So if I read a study that said, you have to swim in salt water at 3 a.m. for 15 minutes and then like, I'm not gonna advertise. Who's gonna do that? No one's gonna do that. Who's gonna follow that? For how long? So what we did is we picked the ones that gave you the most bang for your buck, the ones that help regulate cortisol, the ones that help your body adapt stress. By the way, that means you're gonna build more muscle, burn more body fat, cause those are both adaptations. And the ones that are doable. The ones that are doable, that where you're gonna look at these and you're not gonna say to yourself like, oh, that's great. Now you just added 15 more chores to my day that I'm not gonna be able to apply. And then what we did is we put it together in a way to where the goal is not to be perfect. Nobody's perfect. The goal is to simply move through the phases and get a little better each time. That's what's pretty awesome about the way we set it up. Well, my recommendation would be to actually print off the checklist, right? So there's morning, evening, lifestyle hack and there's like check boxes that I know that we've created within the program. Right, because I'm so glad you said that, Adam, because there are things you can do in the morning to help optimize hormone levels that you want in the morning. And also optimize how you feel because you're about to get your day started. Then there are different things that you do in the evening to help bring cortisol down, to help with insulin sensitivity and then help growth hormone come up when you go to sleep because that's when you want the growth hormone to come up. So there's morning things and evening things. And then we have general health guidelines that we included. But then we also included dietary guidelines which we usually typically don't touch but we wanted to include these in here because you're probably a wiser consumer at this point. And so I said, hey, let's throw in some dietary guidelines because we think this will give them a lot of what they're looking at. We also threw in some supplement guidelines. I don't think, have we ever added supplement guidelines? No, no. I feel like this is like for you too. I feel like you've attracted so many other supplement nuts that want to know what you're taking, why you take it and it's like, okay, let's look at all the common things that people are deficient in, especially things that are more common as we age. What are some basic recommendations around that and things that we would, and again, back to your point of, it's not like we threw the whole gamut of every supplement out there. It was like, what are the ones that are the common offenders? What are the ones that are gonna move the needle the most and which ones would you recommend in that order? And that's what made it to the, made it to the pro. 100% Go ahead. Yeah, no. And the actual lifestyle, like checklist. I mean, we're just trying to like find those things that we know, you stack these dominoes together, it's gonna get you closer to those natural rhythms and it's about getting your body sort of back in sync with sort of that optimal setup. So we do have that bit of a spike in the morning and then we sort of are able to calm down. And it doesn't just happen, is the point of all of this is like, you just have to be a little bit more intentional, you know, as we go forward in age and this is just one of those things that just helps you to really be intentional with your everyday behaviors. And if you could just do one of them consistently, that's a win. And then now we build off of that. I'll give a couple of examples. I'll give you more than a couple of examples. One we've talked about before, but I like to bring this up because it makes a big difference. This makes a very big difference in your health, your hormones, your, how your body responds to exercise, stuff like that. And we've talked about this before, but this is one of the things that we recommend that you do both in the morning and at night. And that is to go to bed and wake up at the same time every single day.  And the reason for this is because we've talked about this before on the show. When you go to bed later on a Friday night, feeling like you're gonna sleep in Saturday and you do that again Saturday night, by the time Monday comes around, it's time to go to work, you've given yourself jet lag. Okay, you've actually changed your circadian rhythm by two or three hours and it takes about two days to readjust. So now Monday sucks, Tuesday and then Wednesday you're back to normal. Now you think to yourself like, well, I could deal with that, drink a little more coffee or whatever.  Profound impacts. So it sounds silly, but the reason why we put that one in there is because of the impact that that will have on all the things that we've been talking about. Fat loss, muscle gain, energy, libido. Go to bed, wake up at the same time. All right, here's one that's unique for the morning. And we put on here just kind of some guidelines that kind of walk you through, but you will be using cold water in the morning as part of your shower. Okay, now why would you do that in the morning? What's the big deal with that? Well, we talked about cortisol. We want your cortisol to learn to be higher in the morning. Well, it's gonna help raise that and give you some of that energy. It's also gonna help your body or make your body produce more of what are known as catecholamines, epinephrine, nor epinephrine. These are energy producing chemicals. Why do you want to do that in the morning? Because unless you're gonna wake up and go back to bed, you got stuff to do. This is when you want those things.  All right, what about when you go to bed? Well, here's two things that we included in there. There's a lot of things, by the way, that we included in there, but here's two that maybe not so obvious that when you look at the data, we actually have some pretty profound effects on all the stuff that we talked about. One of them is to box-breathe before or when you're in bed. Box-breathing, now what does that do? That kicks your parasympathetic into gear because without realizing, especially if you live in this state, you might not realize that your body is in this sympathetic central nervous system state. So sympathetic fight or flight, parasympathetic, rest and digest. Box-breathing, especially when you schedule it, program it and do it the way that we explain it, kicks in the parasympathetic. Now, why do you want that? Well, you get better sleep. Okay, that's good, I sleep better, but what else does it do? You make more growth hormone.   Another thing, again, this sounds silly, but when you look at the data, and that's what we did, this was a simple thing that has a big impact is to write down a few things that you're grateful for. Oh, that sounds so woo and silly or whatever. No, it has an impact on a person's consistency. For mindset. Yes, on their consistency and their workouts, again on how the rest and digest part happens while they sleep, those are just a few, but there's a lot in there that we've listed that you can work through and build upon along with the program workout, along with the dietary guidelines. And again, it's all specifically for, and like I said, I actually didn't say this on air, I said this before we started recording, the most personal program that we've ever created because it's like, I'm in there, I'm in the mid-40s now, so I didn't just turn 40. This is all the good stuff. I'm in there, so this is all the stuff that I've pieced together, that I used to do with my clients, but that I really see the value in because I do them with myself. By the way, this program we're launching right now, and because we're just launching it, it's gonna be on sale, so it's discounted. We're gonna take $80 off the price, okay? So it's maps 40 plus, so maps40plus.com, use the code 40launch, so that's 40launch, and you'll get $80 off, and there's gonna be some free stuff that we include with that as well. That offer will expire Sunday, December 24th. Also, if you like the show, head over to mindpumpfree.com and check out some of our free guides. We have free guides that can help you with many fitness goals. You can also find all of us on social media. Justin can be found on Instagram at Mind Pump Justin. You can find me at Mind Pump DeStefano and Adam at Mind Pump Adam.


Hi everyone, Joe for jazby's casebreaks.com. Happy Friday coming at you with the 2019-2020 Panini Clearly Donnerous basketball four box, random team break number two, Sean popped open for late last night and I'm about to do four right now. One spot gets you five teams in that four box break. So there you go. So there's six spots sold, two, three, four, five. So that should be 30 if I did that correctly and then there's all the 30 teams right here. Let's roll it, let's randomize names and teams five times, three and a two, one. There we go, perfect. Two, three, four, and fifth and final time. After five, we've got Mike Weiss down to Kevin Hull. Guys remember Walt Weiss? Three and a two, five times for the teams. One, two, three, five. Who remembers Walt Weiss? Maybe Mike and Walt are related. Washington down to the Pelicans, interesting. Okay, so here's what we got. Mike with the wizards, Kevin with the trailblazers, Jay with the Bulls, Tongue. Well, you got the Raptors and the Mavs, Brad with the Suns, Mike with the Sixers, Jay with the Clippers and Hawks, Mike with my Lakers, Tongue with the Heat, Jay with the Nuggets, Brad with the Warriors, Jay with the Rockets, Mike with the Kings, Tongue with the Knicks, Brad with the Pacers, Jay with the Celtics, Magic for Brad, and the OKC Thunder, Kevin, Cavs, and Hornets. Jay with the Spurs and the Pistons, Kevin with the Nets, Mike with the Bucks, Tongue with the Jazz, Jay with the Grizzlies, and Timberwolves and Kevin. Look at that, Pelicans for you. So let's get all this on one screen here. Let's sort by column B by team, let's box this up. And when we come back, I'm gonna pause the video. When we come back, we're gonna see if there's any trades and they'll have the break, stick around. All right, welcome back, folks. Here is the final list, hot off the presses, no trades. It's all good, four box, random team two. Thanks everyone for getting in, really appreciate it. I'll post another one in the store after this break. I remember Sean marked these with Xs so we know they're all from the same case. It's a debut edition. We're looking for clearly rated rookie autographs and now there's only just a few autographs, I think per entire case. So the autographs are gonna be few and far between but that's what we're looking for. This product's mostly about the parallels and I was surprised at how well this did on the secondary market. Usually it's kind of hit or miss with acetate products that visually look great but sometimes people don't like them as much in the secondary market but I think these have been doing pretty well. So good luck, everybody. Yeah, and all cards, I think that's what we did when this first release, right? I think everything gets penny sleeved. All card ship. So I'm just gonna take care of the main guys like Luka Donchich and the top rookies. Everything else will be taken care of by our sorting and shipping team. Here's a Luka Donchich and we've got our first autograph, Alan Samaliich, Warriors. That's gonna go to Brad in Golden State. Ben Simmons, gold. I think he had a pretty good game today. It's Cameron Johnson, he's pretty good too. Sons, that'll be for Brad. Oh, another autograph? Yes, PJ Washington, this time out of 10. Charlotte, that's gonna be for Kevin Hull. Another Luka Donchich, he's second year Luka Donchich has actually been doing pretty well on the secondary market, Tong with Dallas. Gold Anthony Davis, Trey Young ended up with 43 according to Sean. Kind of took it easy in the fourth quarter. There's Zion and there's John Morant, nice. So we've got a defying gravity, Zion Williamson insert. That'll be for Kevin and the Pelicans. Nice, that looks pretty sharp. And there's the rated rookie, John Morant. And that'll be for Jay and the Grizzlies. Nice, a couple more to go. Another Luka Donchich, that's Purple Foil right there. And a numbered Paul George, Ty Jerome, bull, bull. So the Purple Foil Luka Donchich is pretty nice. Tong and the Mavs, that's pretty nice. And the Paul George was numbered in 99. That's for the Clippers, Jay. All right, final box. Let's slide against each other here. There's Kendrick Nunn, the Heat. We've got Trey Young right here to 25. You can see the Green Foil, 21 out of 25. It's for Jay in Atlanta. And a Zion Williamson for the Pelicans, nice. And an autograph for the Bulls, Daniel Gafford. That's gonna go to Jay Goins. And there you go, Kevin Hall. Zion Williamson, no parallel or anything, but it looks pretty nice. Doesn't look like any of the foil is rubbing off, which I think some of the issues here, so pretty sharp. Nice. Got a Purple Brandon Ingram, Clay, Nasir Liddle, and Cam Reddish back here. And there you go, boys and girls. I'm Joe for jaskiescasebreaks.com. That was a quick little four box break, random team two of 2019, 2020, Panini Clearly Donner's Hoops. We'll see you next time for the next break. Bye-bye.


There are spaces which were created by people who never uttered a word. This is a small hillock. Then somebody told me there are caves there. You know, I could clearly see that person who was lying there more than two thousand years ago, a left leg was missing from knee down. There are spaces which were created by people who never uttered a word. You know, there are any number of spaces like this. This happened very dramatically for us when other Tamil people, Karur, you know Karur? Near Karur, there's a place called Vellai Dupalli. This is a small hillock. Almost twenty years ago I was teaching a program there. Then somebody told me there are caves there where some nineteen hundred years ago some Jain monks came and stayed there. Then I said okay let's go and see. So this is a small cave where about eight-ten people could lie down. Just about five-five-and-a-half feet in height you have to go and it's like a bird's nest. Find your way. So we went there and it was not kept in any cleanliness or properly. Obviously people were using it for various purposes. There were a lot of empty bottles, cigarette packets and playing cards and always you know somebody writes PKT loves SKP and you never know who these people are but you see inscriptions everywhere. So I went and sat there about four other people that were there with me, four or five people. You sit there and suddenly your whole system is on in a different way. I said wow this is something you know this is a place where somebody stayed over two thousand years ago and it's still alive like it's day before yesterday and you know I could clearly see that person who was lying there more than two thousand years ago he didn't have a leg a left leg was missing from knee down and it's like he was lying there just the previous night it has a life as that. Ever since then all kinds of people have walked on it animals have walked on it people have sat there and had drinks and played cards and I know what else but it's like that man was there yesterday it's that alive. Since those two thousand years how many kings rich people smart people strong men all kinds of people must have passed that land done all kinds of smart things no trace of them. I'm sure there must have been lots of teachers too no trace of them but this Langara man still lives strong strong absolutely strong. So you can either work if you work with your physical body what you do today tomorrow if you use your mind and do something it may last a little longer if you use your physical energies and do something it may last a little longer but if you use the very source of creation within you and act through that it just lives forever. So consecration essentially means this kind of action which will live forever exist which are not even on the map. These are considered like secret villages I could clearly see that person who was lying there more than two thousand years ago a left leg was missing from need out. There is one being in the Himalayan region who has had three enlightened lifetimes this is his final one. Enlightenment does not mean everybody becomes one way there are people of various issues


Thank you to everyone that showed up at 10am on Sunday morning, so give yourself kind of a round of applause because you're not completely obliterated. You're not still dropping from Thursday, like many of us are. So kind of to start off, we're going to explain what OP4 is and what that even means. A little bit of my background, not to go too much, I was a former U.S. Army Warrant Officer. I dealt with what's called OP4, okay, or opposing forces. I used to help train teams that would deploy prior to their deployment to help them prepare for the battlefield. So being a forensics investigator, I thought what better way to get better at forensic investigations than to work with my quote unquote enemy, which happens to be Tim, who's also a member of the spider labs, who is a pentester. So then the same way on the battlefield, how we would train infantry and artillery, we train ourselves within spider labs so that he understands indicators of compromise that he leaves behind by, you know, conducting his attacks. And I see real world forensic indicators of compromise from attacks that he launches. And just as kind of a side note, right, I'm not a proponent of any one forensic utility. I know when people say, oh, forensics, I use NCASE. That's not forensics. That's understanding a piece of software, right? Knowing how to use NCASE or FTK, no more makes you a forensic investigator. Then knowing how to use Microsoft Word makes you Stephen King, okay? It's just a tool and it just does whatever you tell it to. So forensics is truly being an independent finder of the facts and understanding how those facts are laid out and then how to interpret them, right? So again, opposing forces is really something that we've stolen from the military and have kind of used internally to get better at what we do and to truly understand what indicators of compromise are left behind in real world attacks, right? And it works both ways. When Tim sees what indicators of compromise his attacks leave behind, he can go, wow, that was a really freaking noisy attack. Is there a better way for me to accomplish the same goal? Not necessarily with the same tools and maybe he's got to write a different tool, but his end result, right, will be the same with less indicators of compromise left behind, which may or may not be important to our clients, but at least we give them the opportunity, right? And it's bringing that mentality in to the attack and defense communities and it's an evolving cycle. It's not something we do one time and go, hey, we're great, we're done, right? It's something you're constantly doing. There's always new attacks. There's always new vulnerabilities. There's always new things that we need to see so that we can get better at what we do, right? So here's our plan of attack. We're going to talk about something called sniper forensics. And it's kind of something that we've developed in the spider labs over the last few years in opposition to shotgun forensics. And we'll give kind of some background in that. And then with some real-world pen testing events and examples, we'll do a proof of concept. We'll show how it actually works. Write no live demos. I don't want to get anyone all excited about live demos. It's 10 in the morning for us, too, and we're kind of vaguest out, too. So we took the screen shot. And then what some of the post-mortem activities and stuff are. So state of the industry right now. Incident response in forensics has traditionally not been about live analysis. It's been about dead box forensics.  It's 20-year-old methodology, and it was really cool in cutting edge 20 years ago, and it's not anymore, right? How many people in here have some kind of smart device? Smart phones, iPods, iPads, droid tablets, something like that. There any spinny drives in there? No. It's going to be all cloud-based, right? So looking at the direction technology's moving, we're not going to be dealing with spinny hard drives anymore. You're not going to be able to pull those out, stick them in a right locker, image them, and do post-mortem analysis. You're going to be imaging the cloud. So good luck with that. Let me know how that goes. So you're going to be doing log analysis. You're going to be doing RAM analysis. You're going to be doing volatile data analysis. That is where technology's moving. So instead of being stuck in the quagmire of 20-year-old technology, we need to move forward and look at the direction things are going. And that's really what we're working on. So I'm going to pass over to Tim now. So good morning, Dufkahn. I'm Tim, and from my point of view, the current state of penetration testing has some issues. I think, first of all, that we are exploit-happy. And what I mean by that is that we're focused on exploits that involve memory corruption bugs. And I want to re-appropriate the terminology there. So I think if you look at how people talk about this stuff in the industry right now, when people use the word exploit, they're really just talking about the kinds of attacks that involve throwing shell-coded at stuff. But think about the real-world use of that term and all the other things that exploits encompass.   And then, more importantly though, I think that the penetration testing community is losing focus with or the connection to real attack patterns, how attacks actually occur in the wild. And so I think if we look at how we scope penetration tests, how we perform them, and how we document them, those are all, I think we are, in each of those cases, drifting away from real attack patterns. And I want to switch things around back to what I'm calling real-world penetration testing. And so, more of that later. But next, Chris is going to give us an intro of Sniper Forensics. Okay, so some of you may have seen, if you're in the forensic community, you may have seen or heard of Sniper Forensics. I actually wrote it on a plane. So it's kind of like staying right and messaging a bottle in the back of a bus. So I kind of wrote it in the back of a plane, but it makes sense. And just a little bit of background. Comic nerds and computer nerds kind of flock together and are kind of some of the same people. So one of my best friends is a comic book artist. So I wanted to give him a shout-out for drawing this for me. This is the official Sniper Forensics logo written by a gentleman named Dan Christensen, who's a fantastic comic artist. So if you're a comic nerd, please check out Gen-Z and stuff. Shameless plug, done. Okay, so Sniper Forensics is, again, it's the concept of going after the data that's necessary. And we use the term indicators of compromise for that.  You don't need full disk images to see what's happening in memory. You don't need full disk images to create a forensic timeline. You have to know what the data is that you're going after and why you need it. And this is why I don't like point-and-click monkey forensics is because you don't know what's happening in the background. You load it in an case, you click sweet case, and you ask, what did that just do? Well, I'm generating output. That's awesome. What kind of output are you generating and why are you generating it and how is it doing it? I don't know. So open source tools, in my opinion, are so much better because I get what's happening with the ones in zeroes. And I'm making that decision, not a developer for a software company that a sales guy told me I needed. It's me as the engineer going, here's what I want to see. So we have, you hear about the APT and that's awesome marketing by Mandiant. So if anyone hears from Mandiant, great marketing for APT. And I think that was born out of the AFOSI, actually. So anyways, we have the OPT, the organic persistent threat, because attackers don't attack something and go, damn, that didn't work, and then walk away, right? It's a constantly evolving attack surface and the attackers are constantly going after stuff and if it doesn't work, they're not packing up shop and walking away. They're trying new things, trying new exploits and Microsoft is certainly helping that by having so many, you know, vulnerabilities embedded within their code with applications as well. So it's constantly moving organic threat. They're highly motivated, highly funded and organized. The days of bad guys being kids down the street, like y'all, I'm from Oklahoma, so if I say y'all, it's okay, I'm allowed. You know, like y'all or someone doing it, tagging for the heck of it to say, oh, look what I did, it's not the case anymore. The majority of cases that we work with both local state and federal law enforcement are dealing with organized crime. Hacking has become a high dollar crime. It's a syndicate. There's components to it. There's moving parts just like any business model and they really understand return on investment and they're really good at it, right? Not necessarily the cleanest attacks in the world, but the end result is the accomplishment of something that can be extracted and monetized and we see it all the time. I think last year it was a $250 billion industry just in credit card theft, right? Not to count, you know, the theft of PHI or PII or other types of information that has no kidding, like drugs, it has street value. So it's really pretty cool to see how that moves. Additionally, it's a laser versus a big rock, right?  It's effective, right? It does its job. Versus, if I shoot you with a laser beam from space, you're still going to be dead, but the methods that I used and how clean and efficient it is are exponentially greater, right? So that's kind of another analogy I like for Sniper forensics and target selection, right? I can look at whatever data, right? I think the bad guys are going to go after, right? And you all know as pen testers, you don't pen test for the sake of pen testing, right? When I was a pen tester, my customers would give me a target and say, go get this. See if you can get to that data over there. And they'd put me, you know, seven miles away, three different subnets away, and you have to jump and pivot, but that was the end goal. So who cares how I went through it because the end goal was I extracted that data that I could then monetize. So that's where we start. And then we move outwards because that's the logical sequence of an attack, right? So, and then you get the best return on the investment, both for the attackers and for us as investigators. And then obviously pivot attacks lead to deeper, you know, penetrations, which is just fun to say, right? So advanced attacks need an equally advanced investigation approach, and that's what Sniper forensics is, right? We don't image everything, right? I've been on cases, no kidding, both when I was in the military and as a civilian, where the, you know, the lead case agent comes in and says, okay, image everything. Like, what is everything? He said, any server, any system, image them all. I've been on cases where I've taken over 250 forensic images.  I'm going to load them into NK, so I'm going to cross my fingers and hope to find evil, right? No, it's a terrible idea, right? That's old school, and it relies on something we call autopilot forensics. Click, open book, start reading, right? Again, that's a horrible way of conducting an investigation. And in the real world, you would never see a police officer come into a crime scene and conduct an investigation like that, okay? It just doesn't work. And an additional component that I was talking to a police officer friend of mine saying, look, what about tools that are court, you know, are court certified or vetted in court? People always say, well, in cases, court certified. Well, it's not. Tools cannot be certified. Investigators can perform and do certification, right? Because that's the one doing the investigation, not the tool. And saying that one tool is court certified versus another is like saying, if you take crime scene photos with a Nikon, those are accepted. If you use a Canon, no, we can't accept that, right? It doesn't make any sense. So Sniper Forensics uses logic, go figure. Most of us in this room are kind of outside the box, stamp on it, burn the ashes, thinkers, anyways. But we're all logical, right? There's a logical path of progression in the way our thought process works. So applying sound logic using low cards exchange principle, Occam's razor, and something we've dubbed the election principle are really how we go at that data, right? We extract only what needs to be extracted. I don't take 250 images because that's not where the target data resides, right? I go after the target. I allow the data to provide answers. I can't tell you how many investigations I've worked on where before any evidence is analyzed, the investigator walks in and he's got an idea of what he thinks happened. So all the evidence that he gets, he crams into this box of what he think took place and ignores everything that doesn't fit his idea of what happened. And again, that's terrible science, right? That's not how we conduct experimentations or investigations. We report on what was done, and like math class, right? You show your work and you provide your answers. So the way we've broken this down to non-technical audiences, which I know you're not, but just hear me out because it'll give you a solid understanding of how we approach an investigation, right? There's three components we call them the breach triad. Think of a bank robbery, right?  You've got the bank robbery. He's got to do three things. He's got to break into the bank. He's got to get his white bag with the dollar sign on it, right? Stuff all the money in it, throw it over his shoulder, make his getaway. It seems pretty easy, right? Infiltration, aggregation, exfiltration. Cyber attacks are no different. You've got to gain access to the target network. You've got to identify the data of value and aggregated somehow, and you've got to get it from a system controlled by the target to a system controlled by the attacker. Very simple. So when we approach an investigation, that's how we approach. How did the bad guys get in? What did they jack? How did they get out? Very simple. So the guiding principles, if you don't know, are low cards exchange principle. Everyone's seen CSI, right? Everyone's heard Gil Grissom talk about low cards exchange principle. Occam's razor was by William of Occam, and a gentleman named Michael Leckshew who I used to work for when I was with the X-Force at ISS developed this, but he never documented it. So I asked him if I could document it, and he said yes, so that's where that came from. So basically, Edmund Lowcard was the founder of the feast in our world. He was kind of the father of the modern forensic sciences. And he said, look, use deductive reasoning, right? It's very simple. There's answers for things, and you just have to follow logically those paths. So low cards exchange principle kind of boiled down. Is anyone ever seen the glitter test, right?  No one's ever seen that?  So that's kind of the concept. If I touch your shirt, I have fibers from your shirt on my hand. You have oil from my hand on your shirt. Okay? So think about how that applies to computers. If you long in interactively through the shell, you leave a type 10 login in the windows and met logs, right? Or if you log in through the command shell, is it a different type of indicator of compromise? Well, yes. If you launch a program, do you leave residual traces behind? Yes. Okay, there is no way around it. You can reduce the amount that you leave behind, but it's always going to be there, right? So that's low cards exchange principle. The other one's Occam's razor, right? In the army, we called this the kiss principle. Anyone ever heard that? Keep it simple, stupid, right? The answer with the least number of assumptions is probably correct. So you having crappy passwords and getting owned or someone writing ODA code on the fly, which is probably more likely. Well, bad passwords requires less assumptions, right? So that's kind of Occam's razor in a nutshell. Now, the election principle is really pretty cool. And in my case notes, when we conduct investigations, we actually have this broken down. So what question are you trying to answer? You're there for a reason. You're conducting an investigation for a reason. Why? What data is the customer afraid was extracted or what happened to the victim? What data do you need to answer that question? I don't need a mail server image to determine if credit card data was stolen from a database server. So why would I take an image of a mail server? It makes no sense. So that's not the data I need. How do I extract and analyze that data? Running sweep case on it is not going to tell me if there's credit card data on it. It's not going to tell me if a SQL injection took place. It's not going to tell me if RFI was present. PHP shells were present. I'm doing what makes sense, right? And then what is the data tell you? Very simple.  First, what I mean by real world is, well, we have to remember that a penetration test is a model of something else. And its value is related to how close or far away that thing is from reality. So by real world, I don't mean like pen testing like the real pen testers do it. I mean pen testing like the real attackers do it. So let's think for a bit about how black hats go about choosing their methods. Well, first let's think about how white hats do it because, you know, the assumption here is we're white hats. So how do we choose exploits? Well, we put metrics on stuff. We look at vulnerabilities and we measure them according to various things. There's been a number of standards over the years. Different vendors, different industries have come up with lots of systems of measuring, you know, risk of vulnerabilities. But, you know, we've come a long way. We've all grown up and now there's one standard to rule them all, CVSS, Common Vulnerability Scoring System, which I'm sure you're all familiar with, but basically you've got measurements of things like is the vulnerability remote or local? Is it simple or complicated? Does it require authentication? And what kind of impact does it have to the target system? Right? But by looking at kind of an exercise I conducted with my teammates over the last couple years looking at the kind of attacks we use in penetration tests and which ones are most successful, which ones give us the best bang for the buck. And then kind of integrating into that some, you know, what I see, what's going on in the real world from the incident response community in terms of what attackers are really doing. Kind of look at that data and I think that these values kind of bubble up to the top of, you know, if I were a black hat these were the things I'd be focused on. Safety, meaning is this attack safe to the target? I conduct it in such a way that I'm not going to knock the target over. That gives me stealth because if you knock the target over that's going to ring alarms. But just as importantly it gives me re-usability. I can attack the same target over and over again. So that's, I think, crucial.  Invisibility is simply stealth. Again, we want to get in and out and not get caught. And frequency, meaning we want to spend our time attacking commonly found systems. We're a vulnerability that's common in the wild and not some strange one-off system. So one thing to notice, though, if you look at these metrics is they don't, none of these appear in any form in CVSS. So that was one of the things that struck me when I put this data together first was just that there seems to be this disconnect between how as an attacker I go about choosing exploits and how defenders go about choosing which things to defend against. It seems like we would want those things to line up. So to reiterate, the whitehead metrics are based on vulnerabilities and the blackhead methods are based on attacks. It's kind of which your mindset is attack or defense. I think, though, there's, again, another language thing going on here. If you spend a lot of time in CVE data, I think you can get warped into this view that a vulnerability is equivalent to something that can be patched. But this is kind of related to what I was talking about with exploits and exploits. I think that there's lots of vulnerabilities out there that can't be patched. Here's a trivial example. You can't patch stupidity. You can exploit stupidity, so therefore there's vulnerabilities out there that can't be patched. I think another difference when you contrast these things is if you look at CVE and stuff that's scored in CVSS, it seems well attuned to public-facing vulnerabilities and the stuff that's public-facing is scored a lot higher for kind of obvious reasons, but I think it tends to push internal-only vulnerabilities kind of down the stack. I think that's wrong. And even more importantly though, the White Hat metrics are atomic. They're kind of atomic by definition. If you go into, like, read the rules on how to do CVSS scoring, you can't put two different vulnerabilities together and give it a CVSS score that's just not built to support that.  Just a quick sidebar here. I think CVSS needs some work. It's actually undergoing a process right now to get to CVSS version three. But here's some things I think it needs to better support. So it needs to, the basis of CVSS and CVE data needs to, you know, look at stuff that's obviously vulnerabilities that's not being scored. So just to give you a trivial example, ARP cash poisoning. That's one of my favorite vulnerabilities. I use it, you know, every fricking day and it's not, it doesn't have a CVE. It's been a CVE candidate since 1999 but it's never advanced past that. So that's an example of a vulnerability that's in the big bubble. It's not in the little bubble. Why is that? I think the most critical attack surface is internal so I want to see scoring that kind of prioritize that and brings attention to that. And I want to see a scoring system that allows us to put vulnerabilities together and, you know, put a conglom, some kind of conglomerate score on it so we actually line up where attackers are going with what defenders react to. So just to quickly move through the stuff so we can get to more of the meat, I think our new goals are going to be based on stealth and safety. If your focus is stealth, you kind of get safety for free and I think that's cool. And the demonstration of multi-step attacks. I don't necessarily mean, I kind of think the classic, what you probably, your mind's going to like pivoting. Well pivoting's cool and yeah, it's important sometimes but I think it's somewhat blown out of proportion. I'm talking though about simply using multiple vulnerabilities in succession to achieve greater exploitation. And then less importantly, blended methods, the demonstration of blended methods, the demonstration of data exfiltration and potentially even the use of black hat tools and methods. So just to summarize, here's the old goal. Here's the new goal. So black hats don't heart shells, I don't think. I think they heart, well, RSA, secrets and product designs and credit card numbers and things that can be monetized. So one of the things that you get when you focus on the data, where the money is and instead of how many shells you can pop is, I mean, you're going to be more efficient. You're going to do less stuff to get more data. So by having this safety first, stealth first focus, you're going to put the focus on the data where I think it belongs. You're going to give, if you're doing joint exercises with an incident responders, you're going to give them realistic data to analyze. And as a kind of work-a-day penetration tester, most important for me is if I can focus on safety first and I can convince my clients about the principle of safety first, I can actually set realistic scopes on my tests and not be restricted from looking at certain systems or restricted from looking at certain network layers and all that kind of shit.  But I think we can fix that. So let me just quickly cover, you know, I'm not the first person to talk about trying to push pen testing to more real-world methods. I mean, I've been heavily influenced by a lot of folks, not the least of which are these guys here, HD Valsmith and others going back to DEF CON 15 if not earlier. I'm not going to kind of summarize what they talked about but, you know, go find these presentations if you're not familiar with them, read the white papers. And here's some more recent stuff. If you look at kind of this history of dialogue around real-world penetration testing, there seems to be a focus on things like binary exploit versus other kinds of exploits, which I referred to earlier. So, you know, the importance of zero days. Are they critical? Are they irrelevant? Well, that's all kind of interesting but what I want to highlight is kind of the fundamental focus around real-world penetration testing is the focus on stealth and safety. So let's take a quick look at what someone who's not applying these methods looks like. So we're going to run a couple of scenarios past you. We've got the lazy pen tester and then the real-world pen tester will look at things first real quickly from kind of a network point of view and then Chris is going to take a deeper dive from a host-level analysis.   So here's, you know, kind of trivial example, net map and of course, net map is going to trigger a bunch of alerts. You'll hear me say later, I'm kind of down on the whole port scanning thing and this is one reason why. Trigging alerts, yes, but also if you've been doing this for a long time, I'm sure you've run into systems that actually fall over when they get scanned. And why? I mean, why are you doing that? Well, so here's another one.  And, you know, it's just a low-level alerts, but it's going to potentially trigger a lot. Another example, password brute forcing, trying to guess, you know, weak passwords in this case against SMB again. In this case, you're not going to potentially see a lot of alerts, but password failure alerts tend to get high severity. So a few alerts, but they're regged. Again, not what you want. And then here's a sploit, right? Classic example, metasploit, MSO8.067. And again, lots of red events, so I don't like these. So what's it look like from the other? Right, okay, so what we're going to look at now is what the lazy pen tester is going to leave behind. Now, understand the caveat of this was a lab, right? I knew what Tim was, well, I knew when he was going to attack, so there's a certain degree of unrealisticism going into this, but you should get what we're trying to infer. So the first thing I used was a tool called Winalysis. Everyone would use Winalysis.  It's a quick and dirty way to find out what happened quickly. So as you can see, I've got some pretty big numbers there. I've got some red stuff and some squares, right? So basically what that means is all of those are changes to the system, right? So Tim did what he did and I've got 180 critical registry warnings. I've got some activity on file systems and I've got some activity to users. So immediately I can start looking at what he did and how noisy his attack was. I don't know if that works on my system, not yours.  But what that is, is I'm able to show that that is RDP being enabled, right? I see through, this is from a forensic timeline and if you're not familiar with them, there's a really great tool called Log the Timeline by Kristin Gunderson that will allow you to take master file table, event logs, registry last right times, throw them all into one big body file, create a forensic timeline with that and then it will allow you to perform different types of searches, chronological searches, keyword searches, it's a really, really great way for us to look at data in mass in a really tight, compact way. Additionally, it kind of throws time stomping out the window. I wrote a blog post called Time Stomping is for Suckers. So if you really want to know how easy it is to detect timeline modification, go read my blog post on the digital standard and I explained it in depth, so I'm not going to go into it here. I'm just going to show you that RDP has been enabled.  So I did not draw that with a crayon just in case you're wondering. That's a tool called Zoom-In. It's pretty cool for presentations, but I circled some additional activity. So I see the Samhive being modified and I see a new entry being created on the Samhive within the Windows registry. So for all the windowsy people, new user. Wow, that's awesome. Good job, hacker. Thanks for creating me a new user. And you called it Hacker, H-A-X-0-R, which is kind of easy to spot. Now, I have never actually seen a user ID called Hacker in the Wild. What they're usually named when an attacker tries to create himself a backdoor is like a system account. The Internet user account. Something that looks kind of cool because we know all end users are what? They're stupid, right? And so unfortunately, they don't catch something like that. And realistically, how many end users know how to parse the Samhive, look at the last write times in the registry and see when a file was created. Probably not many. So we do see this user activity being created from the registry hives. And we can see that through the forensic timeline, I know exactly when this took place. So now we call this the window of intrusion. So now through my timeline and through my analysis, instead of looking at it, I've got about a oh, I don't know, 5-minute period that the attack actually took place. I'm not taking massive forensic images. I'm not looking at images and images and images and massive amounts of data. I'm looking through a timeline and then through my volatile data at about a 10-minute period. And I was able to do all that very, very quickly. So one of the things I did is in my forensic timeline, I knew I had a user ID called Hacker. And so what I did is I grep through that forensic timeline and I did a grep dash what did I do? I did a grep dash I for Hacker and then I piped that to word count minus L to get a full listing of how many files actually had that thing on it. And there was 406. So through Tim's creation of that user ID, Windows then created or made 406 modifications to existing files or created new files. I got that to only look for files that had been born. It's an attribute, a MacB attribute so an NTFS file system that B is birth new files on the system. 133 new files from the creation of a single user ID. Very, very noisy. Very easy for us to pick up on. So if you're trying to employ stealth, not the way to do it. Because it leaves behind over 530 residual trace data elements. Pretty cool. Okay, so the other thing I can see through my forensic timeline, remember I said there's different ways to search through this data. There's keyword searching, which if I have keywords to go off of, okay. What's better that I like more is chronological searches. When I have a window of intrusion that I'm looking for now I can look at all activity in that window. I can add registry last write times. I can add event logs and really in log to timeline what's cool is there's like 30 different supported log file elements and you can email Kristen if you find one that's not there and he'll add it for you. So it's a really, really great tool. So I can add all of this log data and then say show me everything that took place in this 10 minute time frame. And I can look at all the activity. So I see this download of IP scan Win32-3.0-beta6.exe. Does everyone know what that is? Angry IP scanner. Again, not necessarily the downloading of the IP scanner is noisy, but the download of a utility onto the system is going to leave residual trace data. Not only in the internet access logs that's going to show that taking place, but if it were FTP. Let's say he didn't use the web, he used the internet. HTTP, he uses FTP. What's that going to create? The execution of FTP.exe is going to create a prefetch file. So I know that he executed FTP prior to the file that was invoked and a file appearing on the system with a new birth date.  So I can see that that file was downloaded and then I can grep through that and I can see file execution as well.  Prefetch, right? I can parse out prefetch data. I can see the last time that file was executed, it really gives me a great deal of information. So by him being sloppy, kind of intentionally, but to show what can take place and what kind of residual data elements you leave behind by not employing stealth, maybe as a pen tester now, you can say to yourself, wow, I didn't know I created that much data behind what I was doing. Maybe I can employ a better method that's not going to leave gobs and gobs and gobs of data behind. Or we can all look at that and go, wow, I didn't know that much data was left behind. That gives me something to look at when I'm forming my window of intrusion on a specific investigation. So we got a new one. Okay, so let's reset and run the scenario again from the perspective with the real world pen tester at the controls. So like I said, in my view of real world pen testing, port scanning is passe, or it's like not cool. So what are you going to do instead? Well, the first thing you're going to do is total passive network analysis. This screen here is just an example of how to do that. This is a Metasplay module called PIG. It was written by a colleague, Ryan Lin, who presented on this DEF CON 19. And it's just a way of monitoring broadcast traffic, multicast traffic, and if it's got a protocol parser for it, it will suck that data in and populate elements of the Metasplay database so that you could potentially take these things up into next layers or next stages of the attack. But you're identifying hosts on the network, right? And maybe what kind of hosts they are. And you're not generating any packets at all, so of course you're leaving no trace. That reminds me of a sidebar discussion we could have later in Q&A about detecting promiscuous mode. That's really a red herring. So if we wanted to take that to the next level, we could start getting a little bit active. We can get active at layer two, and we can do our cache poisoning and start middling traffic on the local network. And we can tie that into the kind of analysis that we could do through PIG, and now we're learning new things because we're not just looking at broadcast traffic, we're looking at unicast traffic that's destined to other people that we are intercepting. And so now we're learning more stuff about the network. Who else is on it? What kind of protocols are flowing over it? This couple of slides or the screenshot here, the stuff below is DTEX from ARP Alert, just to give you an example of what it might look like if there happened to be some sensor on the network paying attention to ARP traffic. You know, really in the real world, I've maybe seen ARP defenses in maybe two percent of the clients I've worked with. The tool at the top is part of a spider labs utility called ThickNet. VAMP is the part that actually does the ARP spoofing, but there's the ThickNet module is what you would actually use to intercept and take over in particular Oracle and Microsoft SQL server database transactions so that you can inject your own commands into the database streams and take over databases, and it's really cool. So that's one way we could kind of take it to the next level and start getting active at layers above layer two is, you know, take over sessions. Another way to do it is through NetBios name service response spoofing. So this is just a quick little video.  The top third shows Wireshark filtering on UDP-137. The middle window shows where I'm going to be launching Metasploit and running the modules to actually do the response spoofing. And the bottom third is Windows Explorer and basically someone's going to go and enter an address that doesn't resolve into the address bar. And I think I can manage to click play here somewhere. So once Metasploit launches the victim in Windows Explorer is going to start entering an address and as soon as they're going to hit whack whack foo bar, when they hit the third whack you're immediately going to see the request come through Wireshark in the top so there's foo bar getting entered, the final whack boomer request boomer hash. I mean that's how fast it happens. And the user didn't even hit enter they didn't even go to some bogus site. Maybe they see the typo and they correct it and they're none the wiser. At this point though you have hashes. One of the easiest ways you can acquire a hash and the import there is that now you can go native and that's the goal. You want to as quickly as possible impersonate real user traffic on the network because then everything you leave behind is going to be really hard to distinguish from everything else on the normal network. So for example you can start querying other servers with those credentials you have and finding all kinds of useful data about the rest of the network or you can interact and run arbitrary commands maybe you can run GSEC dump and grab hashes or that might be dangerous. You're going to want to figure out whether antivirus is on the target first and do some analysis of that but what I like to do is first grab net stat data from the targets I've compromised and again without the use of port scanning I'm now building up a very detailed profile of everything that's on the network what kind of services are employed and go from there. Okay, so we're going to smoke through this last example because we've got about seven minutes to get off the stage. Okay, so in the next example Tim used a stealthy approach. He was able to execute WinEXE which is kind of like PSXAC didn't leave any residual traces on the target system except for prefetch files which he went from creating over 500 files to still accomplishing the same goal just using a different methodology and using a different tool to execute commands on the native system and leave me two prefetch files to look at which was awesome versus 530 additional files. The other thing that this did is it did create entries in the event logs so provided that it's awesome enough that we have event logs in investigation which any investigator would tell you is about a third of the time we do see the service entering the running state and we see the stop control. So going from over 500 entries to like less than 10. Okay, really good. Additionally I can see that the end user.dat file was accessed when he executed the command as the remote user. Yes that is Sterling Archer in case you were wondering. We see host being executed for the prefetch which enabled WinEXE to be executed and then GSD.EXE dump was kicked off, I see the prefetch for that and there goes my hashes. Tim just went native that fast. So in conclusion, attack number one touched more than 400 files, created 433 new ones and showed indicators of compromise indicating downloads and program execution. Very noisy, very sloppy, very easy to find. Attack number two, single system access of a single user ID and only creating two prefetch files and a few entries in event logs but not a whole lot. His attack surface for me to investigate was so much smaller that he still accomplished the same goal through an exponentially better attack. Okay, so I'm going to... So to summarize what I've been saying about real world pen testing, here's my top five ways to get caught. Number five, create new user accounts. I don't see the point in that. Don't do it. Number four, use password group forcers. Number five, lock accounts and otherwise trigger or announce your presence. Number three, push shellcode or port scan past a network monitor or in general use port scanning. Number two, let any virus see your password dumper. Don't do that. Number one, crash your target. Didn't give a demo of that but that's a common problem. So in summary, do the least stuff that you can do to make it better. Now, what we've really been demoing here is what you can think of as infosec mashup. We've got these different domains. We're trying to put them together to train each other and make ourselves better. So we've got the space in the middle. We want to grow it. So what other ways can we think of to do that? So predominantly, right, so JTF missions, right, joint task force missions, what do they actually look like? What do exploits really look like in memory? What do they really look like on a disk system? You're not going to find that with N-case. You're not going to find it with FTK. You're only going to find it by doing analysis real time with labs with your friends in the pentest community. And then MREs, everyone's had those. They're delicious. Meals ready to eat. 15,000 calories bind you up for four days. Great stuff. So we have incidents ready to eat. We can virtual machine that he can attack. It's got all of my detection tools built into it. It's got the tools that he needs to conduct his exploits. So we can kind of do that, extract the data and analyze what it's going to look like. Then we can take that information and move it outwards. And then future projects, right, further analysis of common penetration of the few. Actually, I was referring to where we've actually shipped these virtual training labs out to customers. So we can build a training lab for folks that want incident response training. And give them a pre-hacked virtual lab to work in. Other future projects, we need to do further analysis of common methods. And we need to develop stealthier attacks. And then that pushes the bar for the other side of the community to develop better response capabilities and detection capabilities. And I have some places that I want to go in terms of pentest research, but I'm not ready to share those yet. But that's there's some things I'm thinking about along those lines. And that's all we have time for today. And we thank you very much for being here at 10 a.m.