Let's face it. Respect is one of the fundamentals in any relationship if you want to have successful relationship because without respect, how can you really value a person? How can you really care for that person if you, let's face it, disrespect a person. And yet sadly today in the dating marketplace we are seeing a significant amount of disrespect when it comes to how to treat one another. So today I thought I'd lean into the conversation but let me just also say this. This isn't about how men respect women. This is about human beings respecting each other. Let me repeat that, human beings respecting each other. And I'd much rather have a conversation that leans towards human behavior and some of the fundamental problems we're seeing in human relationships these days. In fact, it's interesting this morning I was making notes to myself about something that I wanted to lean into before we get into the full dynamics of this conversation. And I want to share it with you and I'd like to get your perspective on this as well. So I call it the state of affairs, the state of affairs. And part of the reason why I created this is because I have a beef with a lot of dating advice out there. That's right. I have a beef with a lot of dating advice because a lot of dating advice is centered around manipulative game playing tactics that temporarily might, and I say might, cause you to be attracted to a person. But at the end of the day, when we look at the numbers why is it all this attraction doesn't seem to last the long run? So let's look at some of these numbers for a moment. First off, and by the way, this is just merely an opinion what I'm about to share but approximately 50% of first marriages end in divorce and most likely half of the balance of people in those marriages are miserable. 60 to 75% of second and third marriages end in divorce. These days, there's a decline in marriages and a huge rise in short lived relationships. That's right, a huge rise in short lived relationships. Casual relationship make up the larger percentage of couples than serious committed relationships. Think about that. Casual relationships make up more the greater number than the serious committed relationships. Hooking up has become the main purpose for those who are actively dating. Think about that for a second. Hooking up is where the predominant number of people are in the dating marketplace. Now this I made up myself but less than 30% of couples are truly happy after one year of being in relationship. Couples therapist offices are seeing a surge of patients seeking support, married or otherwise. Most therapists state that the majority of couples that come into their office or even their patients blame the other person in their relationship as being the problem. The single population, those not in any relationship is at an all-time high and many of them claim to be unhappy being unmated. And lastly, depression and loneliness amongst humans are at record numbers. So if the all the above is fairly accurate, what advice would you give to somebody entering the dating marketplace? I want you to ponder that for a second. What advice would you give to someone who's dating the, is entering the dating marketplace? Let's say they came out of a divorce. Let's say they came out of a significant relationship. Knowing all this information and by the way, if you're watching this now, it is in your consciousness. You now know this information.  What advice would you give? Well, first and foremost, instead of, there, these are my notes. Instead of focusing on romance and chemistry when dating, spend time determining compatibility and emotional maturity before exploring a relationship with someone. Those of you who follow my channel know my emotional maturity relationship skills chart. This is not a fact merely an opinion, but I believe 20% of the population has clinical issues. Sadly, I was watching the show last night dating a psycho and believe me, there are people with clinical issues out there. And while I say 20% of the population has good relationship skills and emotional maturity, the vast majority of human beings are dysfunctional. In fact, did you know that therapists claim that 85% of their patients have come from dysfunctional families? Dysfunctional families. Think of how that would weigh on a person. I want you to think about this. Has anybody been watching the Dahmer story on Netflix? I've been watching it lately and I've been watching the beginning about how he was raised and the trauma he experienced in childhood. And while thankfully the majority of the population doesn't have that kind of sociopathic clinical issues that causes someone to behave that way. If we've come from a dysfunctional family, it's going to wear on us emotionally in our relationship skills. So it's incredibly naive to expect human beings to be good at this process. This is why folks, I continually recommend both men and women to read the book, the Hoffman process, the Hoffman process. This is a deep dive into healing childhood wounds and traumas and adult traumas that cause emotionally constipated human beings that have weak relationship skills. By the way, there's a link below to get all the books I recommend. Why am I recommending this? If you are entering the dating marketplace naive to look at, I was at, when I went through a divorce, we actually had to go to the divorce court and I'm sitting in divorce court listening to other couples complain about their relationships. And it occurred to me, wouldn't it be better before getting married to look at what causes all the divorces and maybe headed off at the pass? That's right, headed off before, look for the potential potholes ahead of time. And I'm going to be covering some of this in a few moments when I talk about those three critical things that make a man respect you. And quite frankly, as I said before, whether this is true that you're going to respect him or he's going to respect you, okay? Because without these three things, and I'm going to give you a bonus one as well, it's going to be difficult to lean into the deep roots of trust, as I said earlier, the importance of respect in a relationship. But again, coming back to the beginning, what I shared, understanding what causes relationship breakups will prepare you.  In fact, if you're not familiar with my relationship iceberg, here's another chart. See above the waterline says chemistry, excuse the lighting. See that's attraction. We often hyper focus on chemistry instead of the more important things of compatibility, which is shared values, blendable lifestyles, and as I've been repeating over and over again, emotional maturity. Sadly, without emotional maturity, it doesn't matter how attracted you are, it doesn't matter how magically in love you are with each other, because without the skills to resolve conflicts. And this is what one of the key fundamentals in a healthy happy relationship is your ability to resolve conflicts, your chances for relationship success. Even if you found what you believe to be the love of your life and what I mean is someone you're incredibly attracted to.  You know, if most of you've been watching me lately, I've been binge watching shows like Love is Blind, Married at First Sight. We even watched The Other Night, Dating of Psycho. I watched them, first off, I think reality TV is junk. I think it's trash. Most importantly, I think it's scripted. I don't think it's necessarily healthy. What I'm fascinated is with human behavior. And what I'm particularly fascinated with is the idea that you put people in a blender very quickly, this incubator, if you will. They, because these couples have to live together to really determine if they're compatible with one another, because true compatibility can't be seen until you actually live with someone. Think about that for a moment. But think of our current dating process. People will see each other a couple of times a week over the course of years, a couple of times a week over the course of years, and they really don't know who they're with. I once got a call from a woman who had been in a long distance relationship with someone for over three years. They'd been going back and forth for three years. They decided to, they decided to get married. She, by the way, they had a couple of hundred miles of distance. She uprooted her family, uprooted her children, got into a custody battle with her children, and she eventually was able to move her children in with this guy. And within six months, the relationship imploded, and she moved back to be with next to her ex-husband because it was better for her children.  I'm not suggesting that this is even possible. I'm just throwing it out as a, imagine if we could learn about people in a much shorter period of time. In fact, my private coaching, by the way, there's a link below right here, the schedule of discovery call with me. My job as a coach is to help you narrow down who is that person that's more compatible with you by teaching you what questions to ask based on your personality, what questions to ask to determine his emotional maturity. So you are better prepared to not invest in someone who's not capable of being in a long-term relationship with you. Is this sinking in? Is this resonating? Please let me know. Please hit that like button. Please share this video. Please subscribe to my channel. All right, I'm sure you've all been waiting for me to jump into men over 40, deeply respect women who apply these three rules. There's my notes. Let's jump into it. So one thing I observe habitually is women give their power away to men in relationship. That's right. Women give their power away to men in relationship.  He will just claim you and men are the leaders of the relationship because men are hunters. By the way, just so you know, that notion that men are hunters, what do you think men are hunting? Do you think men are hunting this? I want a relationship. I want a relationship. I want a fully committed relationship. And I want to give up all of my sovereignty. Do you think that's what men are hunting? Or is it possible men are hunting sex? Whenever you hear men are the ones to take charge, you are setting yourself up for failure. You are in charge of your relationship, destiny, not a man. In fact, if I could be there on a first date for you, I'm your big brother. I would have the shotgun out pointed at the guy's face and say, what's your intentions with my sister? If you watch my live stream the other day, I talked about what men need to be in a committed relationship. They need to be committed to the idea of commitment. Okay? So women give their power away and quite frankly, men will disrespect them. So one of the first rules you need to imply is to respect yourself and not give your power to a man. And yet I habitually see this because sadly here in the United States, we are suckling on the nipple of, I need you to love me so I can feel good about myself. I need you to validate me so I can feel good about myself. I need you to text me 42 times a day so I can feel good about myself. We are suckling on the nipple of the need for constant validation and someone else loving us for us to feel good about ourselves.  It's very challenging because when you meet a stranger, the minute you have some chemistry, you feel in a sense of affinity with them. And yet you could be with a psycho like I talked about before. It takes time to really develop a fully, first off, I'm not so certain we shouldn't do background checks on everyone before we meet. We investigate their social media presence. We find out friends of their friends. I think, listen, when you think of arranged marriages, I changed, I just did a squirrel here. You think of arranged marriages. One of the reasons why they tend to be more successful is because the family has vetted this person on your behalf and the family is fully invested in the success of the relationship. Here in the United States, we're just randomly haphazardly. We're just swiping away on people, just hoping to find the one. The dating apps has bastardized the process of meeting people and it's created a false sense of hope. I think for men, it's created, by the way, I think the dating apps for men over 40 in particular, totally favor men because women feel a sense of scarcity out there. So they'll attach themselves to any guy that gives them attention and the guy can just basically use you, spend time with you and he can be on swiping away on the next person. Now, a lot of men will say that the women have all the advantage because they're getting all the swipes. That might be true, but as we age, I see the shift turning. Younger women get all the attention and as we age, that begins to shift. So this is why it's critically important to operate from the rules that I apply for my clients is radical honesty and pre-qualifying your prospect. And if you wanna learn about it, schedule that call with me, okay? Because ultimately, and I said a moment ago, a man will deeply respect a woman who respects themselves. This isn't just men respecting, you won't respect a man who's a doormat. You won't respect a man who is riddled with insecurities. You won't respect a man who's a habitually needy in relationship. So respecting for themselves is critically important. Number two, this is something I learned from my girlfriend. One, I call number two, a man will deeper respect a woman who's vulnerable, authentic and transparent. Vulnerable, authentic and transparent. Why I'm sharing this is one of the things I so appreciate about my partner. And listen, I know I haven't told her name yet. I know some of you are asking about it. She, I'm preparing my, by the way, I'm doing this in my bedroom, our bedroom, I should say. I'm preparing my studio for upstairs. And when it's fully prepared, I promise I will bring her out and I'll introduce her to the world. But in the meantime, one of the things I appreciate about her is her capacity to be vulnerable, authentic and transparent. So much so that we had a very difficult conversation to give you an example right from our, from one of our very early meetings. Turns out when I picked her up at the airport, I'd been doing some work around the house. I had a T-shirt that was a little bit sweaty. And when we're sitting down and chatting with me, she openly shared something. She said, Jonathan, I have to share something that's very uncomfortable. I said, what's that? She goes, I don't think your deodorant works too well. And I gave you the backstory of what happened. Now, I got to tell you, I got a little defensive for a second because it was very uncomfortable to be told you have BO. But I appreciate her vulnerability, her authenticity and her transparency. When we shared about our past relationships, I appreciated her absolute transparency. And while I can't validate everything, and what I mean to say is I don't know for certain she was telling the truth, I get the sense that she was. And it's one of the things I most appreciate about her is that capacity to be vulnerable, authentic and transparent. I respect her for that. Ladies, I'm gonna assume that you appreciate a man will respect a man who's vulnerable, authentic and transparent with you. And I'm encouraging human beings to be more vulnerable, authentic and transparent in the early stage of dating.  It's time to get radically honest with one another, to lay our cards on the table so we don't waste time with the wrong person and actually based on chemistry. And maybe, and I say maybe, choose that partner who's right for you. Now, before I share the fourth or the third one, I wanna say that I'm a big proponent of personal development, self-help and spiritual work. Folks, this is why I wrote a book called What the Heck is Self-Love Anyway. It's a journey of personal development, self-help and spiritual work. Again, the link in the description below to get all the books I recommend. Why do I recommend my book? Folks, I didn't become this, I'm by no means do I suggest myself overly conscious, over and awakened, but I do believe that I have a capacity with what I'm about to share next that's happened through all the personal development, self-help and spiritual work. And why I wanna recommend my book is I wanna show you this chapter. It's all the teachings, the readings, the teachers, the workshop I attended. And this is two pages worth of content and this is only a fraction of what I've done. But I invite you all to do the inner work like the Hoffman process. Maybe reading this amazing book. Has anyone read the book, The Untethered Soul by Michael Singer? I highly recommend checking this out. This is a deep dive. This is such a beautiful book to help you learn to talk to the voices in your head because as I said before, and this is the third rule that men will deeply respect is women who are in victor consciousness and not victim consciousness. Sadly, here in the United States, we are suckling on the nipple of victim consciousness. That's right. We see this habitual sense of operating as a victim maybe to get sympathy, but more importantly to deflect personal responsibility. Folks, men and women alike, respect people who take ownership in their life. They're not victims, they're victors. In fact, we see this in the dating realm, particularly when people talk about their past relationships. Whenever you hear someone throw their previous partner under the bus, whatever they claim was the problem with their other, the partner and take no ownership on their part, they are operating most likely in victim consciousness and victim consciousness usually means that you're gonna be the next person that they complain about when this relationship ends. It is more important to choose people who have done the personal development, self-help and spiritual work that have the capacity to lean into the tougher conversations that are required to actually build a healthy, happy relationship. Is this sinking in? Is this resonating with you? Please let me know. Now I'm gonna give you a bonus rule and that is if you're not familiar with the work of John Gottman and John and Julie Gottman, I highly recommend, I'm gonna recommend today the book, The Seven Principles for Making Marriage Work. Here's a copy of it, Seven Principles for Making Marriage Work. Why I wanna recommend this is the Gottmans talk about something called the Four Horsemen to the Apocalypse, the Four Horsemen, the Apocalypse. And Leslie says, communication is key, that's it. The Four Horsemen, the Apocalypse in relationship are, criticism, contempt, defensiveness and stonewalling. Criticism, contempt, defensiveness and stonewalling. This is one of the, remember I said earlier, if you reverse engineer why most relationships end, we could say fail, why we have a 50% divorce rate, a 60 to 75% divorce rate for people married 60, or excuse me, married a second or third time. Why we see a decline in marriages and a complete rise in short-lived relationships that are one month, three months, six months, nine months, two years, five years. Those are short-lived relationships. Why are we seeing the rise? Because human beings don't know how to communicate in a healthy, happy way. This is why I continually recommend reading the book. Nonviolent communication by Marshall Rosenberg. I know you're tired of me referring to book after book after book. Why am I doing this? Listen, you can have a mediocre relationship that's based on chemistry and attraction. Or you can have a relationship like the one I'm experiencing right now with my sweetheart, with my beloved, because we have set up a foundation of unpacking our lives in a therapeutic way through healthy communication with one another. This is why you may want to also check out this book by Michael Sorensen, I Hear You, the surprisingly simple skills behind extraordinary relationship. These are the tools I use in my relationship to help forge that foundation of concrete and not quicksand. And yet sadly, many of you experience relationships on quicksand. And what's gonna happen when you walk on quicksand? Need I say more? Men deeply respect women who know these three rules. Men, women deeply respect men who know these three roles. Respect themselves who are vulnerable, authentic and transparent, who have victor consciousness, not victim consciousness and also recognize the pitfalls of criticism, contempt, defensiveness and stonewalling. Is this sinking in? Is this resonating? Please let me know. Post a comment below. Post a comment in the chat box. Give me a thumbs up, share this video, subscribe to my channel. All right, those who know my format know that this is time for our Q and A. If you have a question to ask me right now for those on the live stream, you can simply write the word question, then post the question there after or you can purchase a super stick or super chat. All the monies for the super stick or super chat go to the scholarship fund in the name of my son, Connor Asley. He's the one who's passed away a few years ago. And in his honor, I've started a scholarship fund to help defray the cost of personal development for folks. I recently gave one to Connor's friends. I invited him to Insight seminars and donated the cost of that. And also if you purchase, there's a little dollar sign in the chat box or you can purchase this super thanks if you're watching the replay. Again, if you have a question, write the word question or post the question there after. So does anyone have anything to say? By the way, my cup says salty vibes. My son Connor's nickname was salty. So that's where that comes from. All right, let's see what we have here. Jay Cole says untethered soul is a fantastic and quite a thinker. I agree. Diana says untethered soul, exactly. Jennifer says, I did connect with a guy on a dating app who read eight dates, which is cool. He has done work on himself, folks. She's talking about this book, Eight Dates by Drs. John and Julie Gottman. This is an incredible book to pre-prepare yourself. So you know which questions to ask a guy and you have to read chapter one about trust and commitment. So I highly recommend that book. All right, if you have a question, write the word question and post the question there after. Oh, here we go. Stay well strong, says question. When a man says he doesn't deserve you, should I worry? I think when a man says he doesn't deserve you, look it, I feel incredibly grateful to my girlfriend. I think she's an amazing human being. I think she's just beyond anyone I've ever experienced. I don't feel that she's better than me or less than me, but what I do continually say is I appreciate you, I'm grateful for you. Why I'm sharing that with you is that's a healthy way to delineate your appreciation of someone's amazing qualities. When a man says he doesn't deserve you, should you worry?  And he's gonna say you're better than him. He's in a crappy place, so he has to move on. I'm sorry, but that's what's happening. Say, well, thank you for that question. Jeneca says, Janka says, question, what are, what is some of the first things to chat when first calling? Here's the good thing to start. How's your day going? Did you have a good day? I hope you had a good day. Did you have a good day? Look, go deeper than the surface. I, everyone, you know I like the meme that says this meme. Here, you're gonna like this.   I like people with depth who speak with emotion from a twisted mind. I don't wanna know what's up.  You can print that up for yourself. That's plenty enough to keep you busy on that first, when you're first calling with someone. All right. Heather says, not a question, but I'm being raised by a mother with 100% victim mindset is almost ingrained and it's difficult to get rid of, but being aware is the first step. She is exactly right. Being aware is the first step to actually healing oneself. So it's great to be, that's why I highly recommend doing the Hoffman process to do a deep dive into healing when childhood wounds and traumas. So you can actually work on those issues that have been ingrained from childhood. So thank you, Heather, I appreciate that. I wanna thank Samantha for the $3 Super Sticker for the Connor Ozzie Scholarship Fund. Thank you so much, I appreciate it. All right. Lee says, question. I slept with a man on the second date. I regret it. He's been very respectful, but it is wrong to, but is it wrong to rescind sex until I feel more comfortable? How would I go about doing this? That's a great question. I think, as I said in my broadcast, the three rules, be vulnerable, be authentic, be transparent. James, I just want you to know that I really appreciated our opportunity to connect at an intimate level. And I want you to know I had a fantastic time. As I sit back, I realized that I wasn't ready to fully engage in a physical intimate relationship with someone without getting to know them better, without experiencing trust, without experiencing some level of understanding of what we both want out of a relationship. Because trust to me isn't just being faithful in a relationship, trust to me is being in a position where I know the other person cares about my feelings as much as I do. So at this moment, I'd love to get to know you better. I'd love to be able to explore doing things together. In a relationship. And it's gonna take me a little more time to be physical. And I'll understand if that doesn't work for you. I understand that a lot of men, that doesn't work for them. That's what works for me. And if you genuinely wanna get to know me at a deeper level, I invite you to explore me beyond the sexual. And then when we're both ready, I think it'd be a great time to explore our physical relationship. Lee, that's my suggestion. Watch this video again, rewind it. Use what feels right for you, okay? Thank you so much for the, by the way, does anyone agree with what I just shared? If you did say, Jonathan, I agree with that speech you gave. All right, thank you so much. Jeneca says, thank you. I appreciate that. Let's see. Oh, Jeneca just gave me a $5 super sticker. Thank you so much. Jennifer said, this goes back to the deserve you. She goes, I had an old boyfriend who said that to me on a first date. He said, why would you wanna date me? You are too good for me. It should have been a red flag. No, that to me is a deal breaker. But a red flag merely means ask more questions. But these days I would run if someone had said that to me. All right, Virginia, question. Could you elaborate on what it means to be vulnerable? Does it mean you speak your mind without fear? No, I think it's quite the opposite. I think being vulnerable is leaning into your fear and sharing what a fear would be. So let me give you an example of being vulnerable. I'll share with our audience and everyone. I have what's known as an anxious attachment style. If you're not familiar with the book attached by Amir Levine and Rachel Heller, I highly recommend checking this out. There are three primary attachment styles. There's anxious, avoidant, and secure. And there's variations between those. Anxious means being needy. And I have a capacity to be a bit needy in relationship. Now I'm aware of this. First off, I'm sharing this publicly. When I began dating my sweetheart, I shared that I have an anxious attachment style. I have a capacity to act needy when I feel like my partner is pulling away. I'm aware of this and I'm working on it. I shared that very early on. Most dating coaches would tell you to never, ever, ever, ever be vulnerable. And you know what it did? It caused her to lean into me instead of run away. If you lean in with your vulnerability, the right man will appreciate you and the wrong man will probably run away. If you remember my book, I've talked about this multiple times, chapter nine in my book, if it's sincere and from the heart, you can't say or do the wrong thing with the right person. Being vulnerable, being authentic and transparent is the foundation for building a healthy, happy relationship with someone. I just messed up my camera, everyone, so I can fix it first. Oh, that's a bummer. I can fix it this way. All right, so everyone gets the gist of that. Virginia, thank you so much for your question. I really appreciate it. I hope that helped. So thank you so much. Our next question, Samantha writes, I have a mental health diagnosis. I'm single and divorced. How should I approach relationships now? Well, I think I would need more information about what is your mental health diagnosis and how, so the way I would approach it is what is your mental health diagnosis and how would this affect someone else in relationship? Remember, Pete, that I would be aware of how that would affect someone else. And if it does affect someone else, then I would be most likely vulnerable, authentic and transparent with someone if it could, because another person may not have the capacity to support you in that. And so it's better to have an honest conversation. And again, if it's sincere and from the heart, you can't really say the wrong thing to the right person. So first, identify what the mental health is and how could this affect someone else in relationship would be the way I would approach this going forward. So Virginia, thank you so much. Or Samantha, thank you so much for that question. Again, thank you for the $5 Super Sticker. I want to thank Lee for the $5 Super Sticker as well. She says, I'm amazing. Thank you so much. Virginia, thank you for the $5 Super Sticker. Oh gosh, there we go. Lee, thank you so much. I appreciate it. Connor Asley appreciates it as well. All right, let's go back up here. Let's go swim in. Let's keep swimming. Lisa says, that's what I do. We got to be friends first and have mutual love and trust. I agree. Patty says, where can you go to meet good men? I'm 67. I would like to meet a nice man in person. Good men are everywhere. I'm going to tell you something. And by the way, folks, if you have a question for me, write the word question first. Everyone acts like, when that question, where do I go meet them? It's like saying that all the good people, where do I? OK, I'm going to ask you this question, Patty. Where do all the quality women hang out? Tell me the one location quality women hang out. Because I want to tell all my guy friends to go there. That's the same place to meet guys. So that's my invitation for you. Folks, good people are everywhere. It's funny. My girlfriend and I had a deep dive conversation this morning. I run by a lot of the questions that come in to get her female perspective, woman's perspective. And we're talking about some of the men she met in the last couple of years after her most significant relationship ended. And she said, most of the men she met were really good human beings, really nice guys. There was chemistry with some of them. They were good, genuine people. There was just a slight misalignment. It wasn't the right timing. I know for her and I, it ended up being about timing that made all the difference in our relationship. But ultimately, maybe it was a misalignment timing. But she met men through online dating sites. She met men at restaurants. She met men on cruise ships. By the way, someone asked where she did a number of singles cruises. You can just Google singles cruises. Great place to meet people. So good men and women are everywhere. They're not hiding in one location. They're not at, you know, around the corner on Torrance and Crenshaw Boulevard, OK? So anyway, that's my answer to your question. Thank you so much. Leslie says, how do you stop the hot and cold game with your partner, especially if they are scared of getting close? I'm pretty consistent and not hot and cold. He isn't, and we have been together for a while. Couples therapy. Folks, start going to couples. You know what? I was having a conversation with a client earlier today. By the way, I am so blessed. My clients, I get calls every single week. Jonathan, I met a great guy. Jonathan, I met a great guy. Jonathan, I met a great guy. And they know the difference. And what I mean to say is I've got clients getting engaged, moving in with partners. I'm so blessed. And one of the things I was sharing with a client today was it's interesting because one of her most important questions she asks a man is what kind of therapy he does. And if he'd be hoping to doing couples therapy and workshops right from the get-go of beginning a relationship together. And I thought, I really appreciated that she leaned into a very tough conversation. And she had this amazing conversation with a man.  And she actually believes she has a viable prospect right now. And if they have chemistry, then they have a better chance for relationship success because she asks the tougher questions right from the get-go. She followed my proprietary coaching program. That's what my clients do. They follow this proprietary program that I created to help them put the odds in their favor. Many of you guys are just winging it. You're winging it. You're winging it. And what's the definition of insanity? Doing the same thing over and over again, expecting different results. And many of you are operating from that victim consciousness. And it's no wonder you're suffering in the dating marketplace. I know you don't like hearing this, but I'm just being blunt from what I see. So anyway, what was your question? I know I did one of my squirrels. So well, my suggestion, go to couples therapy together. Thank you so much. Didi says question, how much does a woman's income matter to a man? Well, I'm going to say this is the way I think most men view it, for the most part. I believe roughly 80% of the US population lives paycheck to paycheck and makes less than $125,000 a year. And it needs basically two incomes are needed to survive.  So what a man seeks is, so long as he can provide for himself, he's mostly looking for a woman who can provide for herself, especially the over 40 category. Unless he's rich or he's in the top, he makes in that $200, $300, $400,000 range, which is a very small percentage of the population. So he's looking for a woman who can take care of herself. And think about it, two incomes are better than one. I think of my girlfriend and I, we pulled our resources together. We have four cruises planned in the next year. That amazing New Year's Eve cruise plan, I splurged, I covered the cost of the upgraded cabin. I mean the concierge level cabin. But because we pull our resources together, two operate better than one. So yes, it does matter. So long as you can take care of yourself, I think that's what matters most. All right, DD, thank you so much for that question. I really appreciate it. Heather Wright, question.  That's a great question. Here's the challenge. With a younger demographic, it's easier to know who's most likely single and eligible. And what I mean to say is the younger the person is, the higher probability they are single and eligible. The tougher part for the older demographic is, listen, first off, I haven't been to a park in, God, I can't even think of the last time I went to a park. And I lived around the corner from one, number one. Number two, when I go to the grocery store, I'm focused on my groceries. Now, occasionally I see someone who's attractive prior to meeting my beloved, but I don't like to walk up to strangers based on looks, unless there is some chance happening. And here's the problem with that. Back in the day when it was grocery stores or park, we used to live in smaller communities. We didn't have the internet. We didn't have highways and freeways and such. We lived in smaller towns, so it was easier to connect with someone who most likely knew your family and friends. So from that premise, I'm not a big fan of it. What I am a big fan is doing social activities that put you around as many single eligible people as possible.  On Monday night, they used to have, actually there was a two-fold blessing with her going to a bar. It was a bar that was raffling off these $1,000 Manola Blancos that I pronounce it properly, shoes. And she went there sometimes with a girlfriend, sometimes her own. She set the bar, ordered a drink and guys would walk up to her, offer a drink. Now what she did in the year and a half that she tried to win these damn shoes and she never won them, was she began to read male behavior because men were hitting on her. Now, not necessarily the best place to meet someone, but her girlfriend coincidentally that she'd go with met a guy at last call. He said something very intriguing to her at the end of the evening. She agreed to meet him for a date and they'd been together for six years now and to hear their story, to hear what they had to go through and it happened at a bar. Now, one of the benefits is it was a bar that they lived close by. So they were locals to that area. They had mutual friends that lived in the area. One of the benefits of socializing in places which is part of your community is that if you're part of a community and they're part of a community and there's some overlap, you have a greater chance of building the deep roots of trust that is needed to sustain a healthy, happy relationship. That's right, the deep roots of trust. Those include emotional connection, economic agreement, social activities, hobbies, mutual interest, spending time with family and friends and intimacy, both physical and emotional intimacy. When you have roots, it's easy. When you have those roots of trust built, especially through social activities, hobbies, mutual interests and family and friends, you have a greater chance of relationship success. So, do I see it happening at parks and grocery stores? No. Yeah, there's one in a million, one in every 100,000. But when you put yourself in an environment where there's more single eligible people, you have a greater chance for success. Heather, thank you so much for that question. I really appreciate it. Let's see. Chrissy says, I love watching your videos. I've learned quite a bit. Still learning, always learning. Thank you, Chrissy, for that. I really appreciate it. Jennifer says, I agree with that speech. Well said, thank you so much. I appreciate it. Leif says, I agree with you, Jonathan. Pam says, I agree. Thank you so much. What's better if he calls me dear or babe? I call my girlfriend both those. I think they're great names. Sweet terms of endearment. All right, what questions do we have? Oh, let's see. Let's go swimming. Let's go, oh my gosh, we got a ways to go. Heather says, joint clubs based on interest, exactly. Quality women hang out in healthy communities, so cool that you have a girlfriend and now you can bounce these ideas off or two. Thank you, Gretchen, I appreciate that. Jeneca says, hope I pronounced your name properly, did I? Is it normal for men to feel that they have to prove themselves and talk so highly about themselves?  And sometimes I boast, sometimes I have peacock feathers, sometimes I brag about myself and such. I think it's natural for men to peacock because here's the bottom line. And it's interesting, she did her own version of peacocking in a way because human beings wanna be liked. Human beings wanna be liked, they wanna be loved. One of the number one emotional health issues most human beings feel is I'm not good enough, I'm not lovable and I'm not likable. So yes, this happens. That doesn't make them narcissistic, doesn't make them necessarily self-centric, doesn't necessarily make them narcissistic or self-centric, it makes them human. Humans are riddled with flaws. Sadly, here in the United States, we are suckling on the nipple of perfectionism. Does anyone remember the movie Harry Met Sally? You know, Sally was a unique character, especially when she ordered food. She was rather neurotic, okay? She was rather neurotic. I'd like to have the meatloaf, but it has gravy, I'd like to have the gravy on the side, I'd like to have the Caesar salad, but if it has croutons, I'd like to have the croutons on the side, I'd like to have the apple pie, all in mode, but if the ice cream is too warm, I'd like to have cherry pie, and Harry Lixiner goes, oh my God, she is a nut job. She's neurotic. Here's the thing. At the end of the day, at the end of the movie, he says, I love it that it takes you an hour and a half to order a ham sandwich. I love it that you think 71 degrees is cold. I love it that your nose crinkles every time you get stressed out. I love it that you're the first person I think of when I wake up in the morning, the last person I think of when I go to bed. My point is, is he didn't fall in love with her good qualities. He fell in love with her idiosyncrasies. Folks, we human beings are flawed. This is why I recommend book after book after book after book. Is there another book I can recommend? I think I've recommended a lot. I recommend this because to heal oneself, to heal the wounds, maybe those bragging wounds, and I still got them. When you can learn to appreciate, my girlfriend says, but let me just say this. One of her first things she said to me after our third or fourth time together, she goes, you are absolutely exhausting. You wanna unpack everything and process everything. But I think it's one of the things she appreciates most about me. So all I'm saying is we are human beings riddled with flaws, and one of them might be to try to sell ourselves. Doesn't make us bad people, it just makes us human. Ah, all right, I think I'll just take one more question. Let's see. Christie says, question. I like a man who's in his fifties. I'm in my thirties. I noticed that his handshake, I noticed that his handshakes when I'm nearby him, he reads all my texts and says, wait, he reads all my texts that I send them, but he rarely replies. Is he shy? Well, my first thought was he might have what's known as benign tremors if his handshakes. I know a lot of people that have what's called familiar or benign tremors, but yeah, he could be shy. That's why spend less time texting and more time face to face folks, just like I shared earlier. I would prefer we all put ourselves in a blender and spend a considerable amount of time together in a short period of time to see if we're aligned in our values and in our lifestyles and our emotional maturity, because without it, if your entire relationship is on this device, it's not a relationship. It's a relationship with your phone. Stop shifting from the phone, shift from the telephone, spend more face to face time because that's your proximity makes all the difference. Spend more time face to face instead of texting and telephone calls. All right, I think you get the gist of where I'm going today. Again, my studio will be built out hopefully in the next month or so, so I'll be shooting videos from our bedroom for right now. And I just wanna remind you those four men deeply respect women who apply these three rules, excuse me. And that is they respect themselves. They are vulnerable, authentic and transparent. They have victor consciousness, not victim consciousness. And I also wanna thank, by the way, I appreciate all the super stickers, super chats. I wanna thank, wait, we got one, we gotta scroll. I wanna thank Terri. By the way, before we wrap up today, please donate to the columnar as a scholarship fund if you can with the super sticker or if you're watching the live stream of super chat or super thanks. And we're gonna wrap up this video as we always do. First off, I've given myself a big, gigantic Johnathan Barrack of self love. I'm gonna reach into the camera and give you a hug of love if that's okay. I'm asking you to turn to someone, a pet, a teddy bear pillow and give Iter them a hug of love because hugs are a great source of love. And let's face it, we could all use more love in our lives. I wanna thank Terri and Leslie and Holly and Jay Cole and Lisa and Chrissy and Claire. And did I say Holly, Jenica, let's see, I am baby 51. All right, Debbie, hey Debbie's in the house.  I think that covers it all. Everyone, big hugs. Thank you so much. Have a great evening. Bye now.


So, coming up next is Vitsa and he is a new speaker, so. Lovely, good morning everyone. Welcome, you made it to the final day of DefCon. I'm here to kick off track three this morning, and I'll be talking about DLL hijacking and how you can make that even more fun with environment variables. So, I'll quickly introduce myself. So, my name is Vitsa, that's a Dutch name, but I currently live in London, in the UK, where I work for CrowdStrike as part of the Overwatch elite team as a senior threat hunter. I have previously presented at some of the conferences before, amongst other things about DLL hijacking, and yeah, as I was saying, today I will be talking about how you can do that with environment variables. So, in order to get there, I'm gonna give a quick recap of DLL hijacking and the variants you may be familiar with, then I'll give a quick intro on environment variables, and then later on we're gonna bring them together and do some really cool stuff. So, let's crack on. DLL hijacking. There's a couple of different definitions for that, so I thought before I start, I might give you mine, so we're all clear what I mean by that. So, to me, DLL hijacking is the tricking of a legitimate or trusted assigned executable into loading an arbitrary DLL. So, there are multiple ways of doing that, but in essence, as you can see here on the diagram, you have a trusted program. It normally loads your libraries, the DLLs, and somehow you trick that into loading an evil DLL, right? So, from an offensive perspective, that is great because you don't have to run your own executable. You can leverage the reputation of the trusted program, and that allows you to, if you have a really dumb AV to get away with it, or if you have EDR to make it look a lot more legitimate than it actually is. As I was saying, there's multiple variants, and these are the most common ones. I think most of you may be familiar with DLL sideloading. That is very simple one. You basically have a vulnerable executable that loads DLLs in an unspecified way. It doesn't specify the full path, but a relative path. If you then move the vulnerable executable to an attacker writable folder, you put it next to a malicious DLL, and you execute it, it will allow you to run your malicious code via this trusted program. So, yeah, DLL sideloading, I think, is by far the most common one. Another one is DLL search order hijacking. I think these two are often confused, to be honest. They both leverage the search order, but to me, DLL search order hijacking is when you leave the executable in its original place, program files, just in 32, but if it is vulnerable, it means that you can put a DLL in a location that is searched before the actual DLL, and that means you're literally hijacking the search order. These are much rarer, I think, than most people think there are. So, there's a couple of good candidates there, but there's way, way more DLL sideloading candidates. So, yeah, these are slightly, they're related, but distinct techniques, and I think these are often confused. DLL substitution is one you really shouldn't forget about. It's super simple, right? Just replace the legitimate DLL with a bad one. If you remember Stuxnet, this was literally part of the attacker path. They replaced a legitimate DLL in System32 with a malicious one, and a malicious one inserted extra commands for the industrial control system. So, it is DLL hijacking, right? Maybe not super novel, but you are hijacking a legitimate application. So, these are really common. I wanna quickly touch on three less common ones, which again are all types of DLL hijacking. You may have heard of phantom DLL hijacking. So, this is when an application tries to load a DLL that doesn't exist at all. So, in which case, you can just put the DLL anywhere on the search order, and it will load your DLL. So, that's a really simple one. And again, very few candidates, but if you have a good candidate, it can sometimes lead to privilege escalation or proper persistence. There's also something called Windows SXS hijacking, or Windows side by side hijacking. I think in the past, this was really confusing because it has the word side in it. So, people thought, oh, this is DLL side loading. I've only ever seen one documented case. Again, I don't think it's as prevalent as some people think it is. So, it's basically relying on a specific technique in Windows called Windows side by side, and hijacking it that way. But again, I've only ever seen one proper documented case. And finally, a wider class, input-based hijacking.  So, I think Firefox, for example, still has an executable, but if you run it and if you specify a custom path on the command line, it will just load DLLs from that folder. So, you get a trusted Mozilla executable, and it will load the malicious DLL. So, that's all great, right? So, six types of DLL hijacking. This has been around for a while now, for years, and there have been many great blogs and tools that can help you explain what it is, leverage it yourself, and as a result, we have very well documented techniques that are very well researched, but also very well detected. It just means that if you do this, again, you might trick really basic AV and EDR, but it's less and less likely that you will get away with it. So, that begs the question, if there is something we can do to still have DLL hijacking, right? To still leveraging the reputation of a trusted program, but do it in a better or more stealthy way. So, that is where environment variables come in, and as I said, before I go straight into the hijacking bit, a bit of background, so we're all on the same page as to what environment variables are and why we have them in the first place. Right, environment variables, you may have heard of them. If you use Linux or Unix-based systems, you probably will use them very often. It's basically a variable or a dynamic variable that can be used by running programs. So, as it was already alluding to on Linux and Unix-based systems, these are very prevalent in the shells, right? You may know in the shells on Linux, you get a dollar sign and then a variable name and that allows you in scripts in your terminal to set a variable once and then just leverage it in a script or elsewhere and it can just leverage that value. So, it's like a global variable, right? If you've ever done programming. In Windows, you've got this too. In the command prompt, you can set an environment variable and you leverage it using percentage sign. So, you've got percentage sign and var percentage sign to get the variable contents. What you would almost forget is that processes can also leverage it, right? So, you typically may use it just in a shell but any process can call, for example, from C, you can call the function getEnv with the variable name and it would give you the value that it will set in your environment because after all, environment is like your system, right? Or your shell. So, it's in the scope of your system. Again, it's quite an all-technique. I'll touch on that on the next slide but it's all stored as a string and typically an ASCII string even. So, you can put integers and booleans in there, of course, but you would have to convert them or cast them yourself. It's basically always a string. Right, so, I don't mean to turn this into a proper history lesson but just a bit of background to again understand why we have them and why we still have them in 2022 environment variables. So, the first mainstream OS to have them was Unix V7. So, they were the first mainstream OS to come up with this concept. So, they didn't have to bug programs, program users to ask every time, like, what is your username? What is your home path? Instead, you just define it once, you run a script or program and it would know what your username was. So, very simple. First time was in the late 70s and then only a few years later, PC-DOS 2.0 also included it, same technology in the shell, you could define variables. So, you could probably not see it at the very back but I got a little excerpt of the documentation which basically sums up what it does. So, it's basically saying it's a dynamic variable. It will be replaced in the script if you use it and you can use the set command to give it a name and then a value and then you can leverage that. Right, then early 90s, Windows 3.1 introduces the Windows registry. So, if you've ever used Windows, you will be familiar with it. It's like the central settings hive that you use in Windows. And I think this is quite a pivotal moment for environment variables because when you really think about it, environment variables are supposed to store information that programs can use. Windows registry does pretty much the same, right? It stores all sorts of system-level configuration settings as well as program-level configuration settings. And what we'll see later, environment variables nowadays live in the registry but I think it's really interesting because we still have environment variables but if you think about it, you could really only have the Windows registry and not need environment variables in Windows at all. Cool, then very quickly, end of the century, we had already lots of security vulnerability researches identifying issues with environment variables. Windows defines a couple of them out of the box and for example, the path environment variable which you may have heard of and it caused lots of trouble, lots of vulnerabilities there. So, the earliest I could find was from 1997 or some CIS admin complaining about it not implementing security properly and this person said, why would other application developers bother to support secure configurations if this is what they see coming out of Redmond? So, he was clearly not happy and well, we'll find out later what the people in Redmond did about this vulnerability. And then finally, at the end of the century as well, 1999, the first ever CVEs were issued and the first batch actually included, I think it's two, but at least one environment variable-based security issue that led to privilege escalation. All right, so this was like in one minute, the history of environment variables, but let's again now look at what that looks like in Windows. So, finally enough, you can define as many environment variables as you want but there is an upper limit of the combination of variable names and values. So, any environment variables you define are just stored in one massive concatenated string and this string should not exceed two to the power of 15 minus one characters in total. So, whilst I give you some room, like you can't put proper programs, space 64 encoded in there if you wanted to. As I already said, nowadays, the environment variables that you get when you start your computer are stored in the Windows registry. So, what happens if you start your computer? Windows, like the most parent process, basically when you start your computer, looks up the system-level environment variables in this registry key you see on screen. So, that leaves in HKEY local machine. These are the variables that apply to every user and all services and all service accounts. This is how your system is initialized. When you then log in, it looks up the user-specific environment variables which are stored in HKEY current user. There's also something called current session. I'm not really gonna talk about that today, but it also loads variables that are just defined just for the duration of your session. So, if you log in, you set an environment variable on that level, it will just live for that session and as soon as you log off, it just disappears. And then the final thing, which you would almost forget is that environment variables live on process level. So, you can define an environment variable that is only active within a single process, but not its parents, not its siblings, just one process. So, what normally happens in Windows, you start a new process. The environment variables that that new process has are the same as its parents' environment variables. So, it just keeps passing down the environment variables and because it's quite an all technology and most software doesn't really use it, not really, it just passes down the values unchanged. So, you will have very consistent environment variables across. So, if you know how processes work in Windows, you might be familiar with the process environment block. This contains all sorts of information on the process. So, if you look, for example, at the process parameter struct, you see lots of usual suspect, like information you would expect for a process like the command line, standard in and out handles, current path, but there's also a block for environment variables. And as you see here, this is from my demo lab, this is what you get out of the books when you install Windows. So, this is Windows 11. These are all default defined environment variables that programs might use to, for example, find out where your app data folder is or what your drive letter is. Normally, it's C, but you can change it in the settings and then your program might use that and change it accordingly. But the interesting thing, again, maybe you know it, but I didn't really click is that this exists on process level. Every process has this massive list of environment variables. You can change it on process level. So, if you look, for example, in the Windows API, this is one of the ways in which you can create a new process. You can see that you get the command line application name, but you can also optionally pass environment variables, custom environment variables. So, you can overwrite existing ones or add new ones and that allows you to, or allows the program to leverage them to, I don't know, find out a path or find out your username, whatnot. So, that begs the question again, like from a hacker's mindset, right, is there now a scope for tampering? We've looked at DLL hijacking. We've looked at environment variables. Is there a way in which we can combine these two concepts? Because if you know environment variables, there's a couple of really interesting ones that are used quite often and they link to paths that you normally don't control. If you've just got a foothold on a machine and you don't have admin permissions, you can't write to the C Windows folder, for example. So, the system route environment variable, which points to C slash Windows, is an interesting one. Is there a way in which on process level we could change this and maybe trick a vulnerable executable into loading something that lives in a folder that I control? So, it's the same with the system drive or the Windows directory, which is basically all the version of system route, and same with the program files folders. So, if there are still applications using environment variables, is there a scope for us to tamper with that? So, that's how I started. So, basic concept, you pick an application, you wanna test to see if it's vulnerable. You update one of these environment variables that I was just talking about, and instead of the original folder, you point it to a temp folder or, I don't know, some folder you control. You're gonna start the application, and using, for example, Procmon, you just check, right? Is this application now checking the folder I specified? Because I updated the environment variable, and then, well, hopefully, profit. So, if you look at the diagram over there, at the top, a normal run of this trusted program, it might try to load a DLL from a location using this variable called some variable, and normally, that would resolve to C slash legitimate path, and then the name of the DLL. What I'm proposing is manipulating that, right? On process level, we change the environment variable to, say, C slash evil path, and then, hopefully, if it runs, it will now load the DLL from my location instead.  So, this is a working example. This is an example that I found in the system 32.4 that you got an executable that is called hostname. It's a very simple one, it's very boring, it just prints the hostname, right? It just prints the name of your computer. But it turns out that if you run it, just without any command line arguments, just hostname, it will load, I think, three DLLs, one of which is the one you see here. So, it tries to load a DLL dynamically from the system root folder, and then system32 slash, what is it? Mswsoc.dll. So, normally, that means it will load it from C slash windows slash system32 slash at Mswsoc.dll. However, if I now change the environment variable with the PowerShell that you see there at the bottom of the screen, I can now alter the path and trick it into loading my DLL. So, it's a number of ways in which you can do this. This is a way of doing it in PowerShell. So, it uses CLR. So, very simply put, you define a new object, you point it to the original binary, right? We don't need to move hostname, we don't need to do anything special. We just say, this is the executable I want to run, I then remove the system root variable, I then add it again with a new path. So, the new path is now C slash temp slash evil, and then the remaining code is just getting the new object ready and starting the new process. Right, demo time.  So, I created a sub folder called system32 with the DLL in there. Now, based in the code I just described, hopefully, when I run it, it should give some sort of visual feedback, but also at the top, you see Procmon running. So, hopefully, that will also demonstrate that it loaded the DLL from my location, right? So, not from system32, but from my location. Well, you might not be able to see it, but it popped a window that said hello, Defcon. And of course, it popped Calc because otherwise you wouldn't know I did something bad. So, there's Calc. And in the Procmon window, you can now see, again, it might be a bit too small, but it's basically confirming that the executable is in the expected location, but it loaded my DLL from my temp location, the folder we just looked at. So, a bit of a recap, right? Because, okay, fine, I popped Calc, big deal. Why should we care? So, the great thing is, is that from an offensive point of view, you only need to bring the DLL, right? Because hostname is already on the machine. You just start a new process, you update a variable, and that means that you don't need to bring in your own executable, which is typically the case for DLL sideloading. There's also no special command lines involved. You don't need to, I don't know, suspend the process when you start it. It is, as you've seen, right? It's just a couple of lines in PowerShell. It's pretty straightforward. And one thing I really want to emphasize, right? Environment variables are defined in the registry, but what we just did, we didn't change the registry, right? We just started the process and told it to override the environment variables it was aware of. So that means there is no registry footprint. If anything, right, if I were to change the environment variable, like if I change system routes in the registry, it would break my entire system, right? Because so many programs use it, it would not find DLLs, it would just like make your computer unbootable. So we don't want that. We changed it on process level, and well, we've shown it worked. Also from an AV and EDR perspective, they can see environment variables on process level, but very rarely in my experience, they do actually hunt for it, right? Or you're able to write rules for it. So that means that you might get away with it because the really obvious things like command line and registry artifacts are not there. And yeah, as I said, this was an example with PowerShell, but actually you can also do it with Phoebe script or J script. You could literally write a macro that does this in a very stealthy way. And because you use legitimate processes, like with some DLL hijacking, you would have to run a process from a temple but you just run a process from system 32, right? Again, you might get away with that. You could of course also run it from an executable itself. You could write a C or some C code to launch a process with a different environment variable but that sort of defeats the whole point. So having these script languages support this makes it really powerful. So this is just a static screenshot of how you might do it in Phoebe script. You see the command prompt, which is just executing the Phoebe script file. On the right hand side, you see the code in Phoebe script. It's only four lines. You could actually do it in three if you group some stuff together. And then at the bottom, you see how it worked. So if you look at the Phoebe script code, it just asks for the process level variables. It updates it, system routes again, change it to a temp folder. And then in this case, it runs another executable SL UI. And then at the bottom, you see the evidence that it loaded not one, but actually three DLLs from my folder. You might also see that it actually loaded two, C script also loaded two DLLs from my folder. So that's something to be aware of. Some scripting languages, if you change the environment variable on process level, it will start using it itself too. So if C script needs a DLL and it relies on the same variable, it might actually break. There's a way of working around this, by the way, but I thought I do wanna point it out that it doesn't come without challenge, but it's funny how different languages implemented in a different way. Cool, so final recap for the technique itself. So I already alluded to most of these. DLL side loading, right? Need to bring executable, we don't need that. DLL search order hijacking. Again, I think there are fewer candidates than most people realize. There's only a few really obvious ones. So that means detection is easier. In this case, I will show shortly that are many candidates you can choose from. And same with DLL substitution or input-based DLL hijacking, right? It comes all with extra steps that just mean that you are more likely to be picked up. We don't have any of that. And there are a couple downsides, but I think the main footprint that you have with this technique is the planting of the DLL, right? At some point, you need to put that DLL in that folder that it's gonna load it from. But if you think about it, you're always gonna have that with DLL hijacking, right? You need to execute a DLL. It needs to live somewhere on disk. Again, if you compare it to the other DLL hijacking ones, this one is rather stealthy. Doesn't mean it's undetectable, but it's doing a better job, I think. Cool, so so far, I've only told you about one or two executables, which were a bit anecdotal, right? Like how do you find which ones are vulnerable? So again, we get into the hackest mindset. How would you turn this single observation into a systemic approach? So here's an idea, right? I defined a scope for the executables and DLLs I want to test. So in this case, I just looked at all the DLLs that live in the System32 folder. And what I did is create implants for each and every one of them, how I did that I'll show shortly, but basically every DLL gets its own clone, and whenever it's loaded, it would write a fingerprint file to disk. So a fingerprint file is literally just an empty text file, but the file name shows you which DLL was loaded and which process it was loaded by. So I will have an example of that in a bit, but basically it means that if my DLL was loaded successfully, I will have evidence in the form of a fingerprint file, which like 100% guarantees that my code was loaded and executed. So that's the prep. Then we go to the execution. So now I have thousands of DLLs, because in System32 there is a lot of DLLs. I now need to define the scope for the applications I need to test. So say again, we use System32, right? We just do a star search for all the executables in there. What I now would do is run each and every executable, just one by one, but with the updated environment variable, very similar to the PowerShell script I just showed you, right? In that case, I just ran one, but you just turn it into a for loop iterate over the executables, pointing it to the folder with all these thousands of implants. And then hopefully, if they work successfully, we can now just validate it by looking at the fingerprint files. These will tell me what executables worked and which DLLs were loaded, and that means we can use them in proper attacks. Right, so some of you may have actually done DLL hijacking before, right? Because it's very similar across these different variants. There are a couple of challenges there. So stability being the main one. If you just generate a dummy DLL that just has a DLL main and nothing else, it typically does not get loaded by the vulnerable application. Typically, applications rely on the exports, you know, the export table that tells you which functions you can call. So if those are not present, the executable might reject the file. It might actually become unstable or give some visual feedback. And again, that means you can't really use it for an attack. So a great way to overcome that is to use DLL proxying or function redirection. So the great thing about PE files is that you can define exports. So again, these are public-facing functions you can call. But the great thing is you can actually point these functions or these exports to external files. So through that, I can actually, in my implant, leverage the legitimate functionality. So the DLL would literally do the same thing as the genuine one, but still include my malicious code. So let me actually quickly show you how this works in the context of this attack. So here we have our legitimate application again. And imagine it is trying to load some DLL.dll, right? So that's the implant I created. And in this case, it is a clone of a DLL that has two exports, export A and export B. If I were now to generate an implant, I don't want to reverse engineer this DLL. That's gonna cost way too much time. And I already said there's thousands of DLLs that does not scale. So instead, what I do in my implant, I just say, well, I have an export A and I have an export B, but the functionality lives elsewhere. It's over here. And then you just point it to the legitimate location. So here you see, at the bottom right, you see my fake path again. And I say, well, if you call export A, please go to C slash windows slash some DLL. That's where you find it. And that means that the executable here, whenever it calls my DLL, it would load my code. But whenever it calls a function, it would go to a little legitimate DLL. So that is great because that means that the program is less likely to break. So it's more likely to accept my DLL. And therefore I can actually more reliably perform DLL hijacking. So there was one issue, the reliability. So with DLL proxying, you already cover most of that. But then some executables also leverage DLLs to get like image files or cursor files or like any sort of resources. You can embed these in PE files. So another issue is that if you don't have these, you're implant, that the executable might break. So again, to maximize the number of targets, I could find, I also implemented research cloning, meaning it literally just copies the resource section to the next DLL. And again, that further increases the number of executables that you can choose from. Great, so this is what it looks like. So this is a bash script. I'll be releasing it later today. It uses all sorts of open source tools. But basically it just looks at the legitimate DLL. It looks at the export table, it then copies it. It creates these redirection rules. It then copies the resource section as well. And then by the end, you have an implant DLL with your malicious code, with these function redirections, as well as the resources that have been cloned. So in my test here with the scope and everything we were just talking about, this is literally the main.dll file. As you see, it's nothing fancy. It basically says whenever I'm called and it's a process attached or a threat attached action, then just call generate fingerprint with the name of the executable that run it. And as I already said, that function is literally just creating a text file saying first the name of the DLL, then the name of the executable, and then if the file is there, then hopefully it's proof that it worked. This is then how you would run it, right? So I have now thousands of DLL files. This is the PowerShell script I was talking about. It's a modified version of the one we looked at in the demo. As I said, it's just a for loop, right? It just iterates over everything in the system32 folder. It then changes the environment variable, pointing it to the folder with all the DLL implants and then just runs them one by one. And then hopefully, if you run that, you get lots of these fingerprint files, right? So when I run it on the latest version of Windows 11 that I could get hold of, this what happened. So this is a folder. It's probably too small for the back, but again, you see, for example, a third rack loading a DLL from the system32 folder. And the fact that the file is here, right? It's just an empty text file, but that means that my code was loaded. It was successful. As you may be able to see from the scroll bar, there are quite a few text files in there. So that means there's quite a few options you have to get this to work. So what I'm releasing today is the code that I used. So you can use this for your own research. I've only focused on the system32 folder, but if you wanna leverage any of this yourself, which includes the function redirection and the resource cloning, you can find it on my GitHub page. That's live now. I've used it in Linux, but it uses mainW, so you should be able to use it on Windows as well. And yeah, I mean, let's now take a look at some of the results, right? So you saw these fingerprint files, but what does that really mean? So in the scope that I tested it on, system32 folder, Windows 11, I found 82 unique executables to load 91 unique DLLs. But because most executables load multiple DLLs, there's actually nearly 400 or 398 unique combinations there. So that's quite a few options there, right? So to my earlier point, with DLL search order hijacking, you can usually only choose from a couple, but here you've got 400 out of the box on Windows 11. Then I did some spot checking on other tools. So some other very common enterprise tools like Office, so I tested Word, PowerPoint, Excel. Again, all of these are vulnerable to this type of DLL hijacking. They load at least one, but usually like five or six DLLs. And if you change the system route variable, you can trick it into loading your malicious DLL. Same with some web browsers, I tried Edge, Chrome, Firefox. I tested communication software like Teams and Zoom. All of these are vulnerable. And to me that shows, right? So the number of 400 is great and it sounds really cool, but the overarching point is that it's not about these individual tools. It's a wider problem, right? Applications rely on the system route variable and some others and they don't properly test and that means that there are just many, many results. So this is a whole new class of DLL hijacking that we can now leverage. Cool, then before I go to the next section, some quick remarks on like, how can we take this further? So so far we've only looked at execution, right? Which is what you normally do anyway with DLL hijacking. But is there a way in which we can use this more persistently, for example? Well, that is a bit of a challenge because we need to start the process with the updated environment variables, right? And we already said, we don't wanna change the current user or local machine one because that would break everything. So how do you start a process in a way that it also keeps these overwritten environment variables? So that is quite tricky. To my knowledge, you can't do that with an L and K file, for example. You could of course just use the PowerShell script or VB script and run that persistently, but that is not really persistence, is it? It sort of like defies the whole point. You might as well then do the bad stuff in the script. What you could do, however, if you already admin, if you already have elevated privileges, you could change a service. So Windows Services is like a Daemon Linux, allows you to start stuff persistently. So the screen shell you see here is from the printer spooler, which is started by default on Windows 11 installations. There is a very underused or underutilized registry value, you can set, called environment. As you can guess, you can literally just specify environment variables in there that will be used in the scope of that service. So in this case, printer spooler, I just set system root once again. I pointed it to my folder with all my implants and well, yeah, what do you think is gonna happen if I restart the servers or reboot the machine? Luckily enough, it loaded one of my DLLs. It's the same one again, MSW SOC. The great thing, however, is that it now also runs it as system. Most Windows Services, not all of them, but most of them run either with a service account or system. So it's not really privileged escalation, of course, but if you are admin and you want to elevate yourself to system in a stealthier way, this is a cool way of doing it. Because you could argue, right, if you already have admin, you might as well just change the command of the service. But that is something that EDR and AV are typically pick up on, whereas this is maybe something that isn't really monitored. So, and again, if you do the DLL, if you implement the DLL properly, the printer spooler server would still work, right? It just also executes your malicious code. So there's less scope of breaking stuff and therefore it's stealthier. But yeah, coming back to privileged escalation, can you do real privileged escalation with this or even use your account control bypass? Now, this is where we come back to that earlier comment on the security and Microsoft design. So in the Windows API, you have generally two ways of spawning a new process. You've got create process and shell execute. The former cannot run programs that run with more privileges than yourself. So if you are medium integrity, you can't get it to run high integrity without doing something weird. Shell execute can, but whenever you do that, it does not take your process level environment variables. This seems to be a very conscious decision by Microsoft to limit the scope for privileged escalation. Any process that is run with a higher integrity level than the one it was spawned from will generally just reset the environment variables to the one defined on system level or use the level of that applies. This seems to be a reaction to that path environment variable thing that we mentioned at the very start. So that caused a lot of trouble in the past and Microsoft decided, no, we're gonna implement it this way and that means there is less scope for environment variable based privileged escalation. And you gotta give it to them because in this case it does work, right? It does hold us back. It means we can't do user account control bypass in the traditional way. What I will, however, say is that there are a couple of anecdotal instances where the executable that is spawned is known to override this behavior. So there's one or two that I've seen that even though they are spawned with higher integrity level, they still manually copy back the environment variables of the parent process, sort of overriding this behavior. So if that is the case, you could of course still use this technique for privileged escalation. Okay, right, some final remarks. What does this mean? We've now looked at new type of DLL hijacking. There's a couple of other ones. What does the future hold? I think the bottom line is what I'm really trying to say here is that DLL hijacking is not gonna go away. Even if we magically fixed all these issues, including the other variants, we would still have to deal with it because attackers could still bring in back these older versions, right? I could now copy these Windows 11 executables, bring it to a fully patched system and you would still have to deal with the program because they're still signed, they're still trusted and still vulnerable. So I think we need to learn to live with DLL hijacking and from an offensive point of view, it's all about making it stealthier. From a defensive point of view, it's all about limiting the scope. So in order to aid with that, in the last few months, I have tried to document all sorts of DLL hijacking types that I could find and centralize them in a curated repo. So as of this morning, you can now go to hijacklibs.net, you get a nice portal there and you can find not only the environment variable DLL hijacking ones I've been talking about so far, but also other ones, you can also find site loading, phantom DLL hijacking, search order hijacking. Yeah, as I said, I'm trying to make it more central. Again, all the entries there have public resources so it has been blogged about before, tweeted about before, but I'm trying to bring them together so we can get a better idea of the scope and see how you can use this all defend against it if that's what you're after. It's an open source project. I really hope that as a community, we can really keep adding stuff to it, to raise awareness for it, again, both for offensive and defensive because I think there's a lot we can learn from each other there. So very basically, how does it work? I've got a bit of a demo as well, but every vulnerable DLL that has its own entry, it breaks down the number of, it breaks down the types of DLL hijacking so it could be environment variable based, it could also be site loading. Sometimes it's both. It tells you where the DLL is normally located, it tells you where the executable is normally located and for the blue team side, you also get some very basic detection logic that you could leverage. So let's take a quick look. There we go. So on the front page, it lists a couple of new entries. You can also browse by vendor. In this case, I'm gonna look up a specific DLL I'm interested in. It tells me there are two types of DLL hijacking, search order hijacking and site loading. It gives me the resources. So if there's a blog or a tweet, it can be really useful. As I said, you can see the paths where you would normally see it and then it tells you what executables are vulnerable as well. Yeah, here you see some SIG my code. It's an open source format for defining detection rules. If I then say, for example, look for a specific vendor, so this is Trend Micro, I can see some other stuff as well. So this is a type of a phantom DLL hijacking that actually had a CVE and it tells you how you can use that for privilege escalation. Again, this is all public information that's all been talked about, but it just helps you understand what options you have. If you very quickly want to see everything, just type .exe, you get all the mappings between a DLL and the vulnerable executables that you could leverage for that. And yeah, that's the end of the demo. So as I was saying, about to wrap up. It's now live, hijacklips.net. It's an open source project. It's all on GitHub. It is hosted in GitHub as well. So if you have any new entries or if you want to improve or want to help this project, to keep this project going, please do contribute. If you go to the website, there is a link to the repo where you can find more. And that is what I had to share with you today. I really hope that was useful. If you have any feedback, obviously come find me afterwards here at the stage or follow me on Twitter. My DMs are open at Vita. And thank you very much for showing up on Sunday morning.


Can we sell on eBay UK as a foreigner? Sure. So if you guys want to start dropshipping on eBay, then you have the choice to drop you on eBay US, eBay UK, eBay Canada, eBay France, eBay Germany. Guys can start eBay seller accounts on any one of those marketplaces. Just like starting on eBay US, you're not, if you don't live in the US, there's still no problem to do it. Same thing for other regions. And I recommend to do this guys because when you're trying out different markets in different regions, then you'll notice that you'll start getting a lot more sales even on products that didn't sell well in the US. Because let's say it's saturated in one place. It won't be in another marketplace. So it's definitely a good time to check it out. But by the way, we're not leaving out the UK. The UK is a big market and we're definitely tapping into it. You can drop ship using eBay UK as a selling channel and auto DS and get everything automated. And you can use UK suppliers to import products.


We do not want them to travel, but to attain the World Cup and have the experience of the World Cup as a team. Speaking to Qatar TV, he explained that the early entry and exit of citizens and residents will not be affected by World Cup 2022. The official spokesperson for the Supreme Committee for Delivery and Legacy Khalid Annamam said that the rumor about the burn on entry to the country for the residents during the World Cup is not true. However, he specified and stressed that we do not want the residents and citizens to leave the country as we are preparing for the visitors to come into the country. It's better we all be together as a team and enjoy the spirit, the experience of the World Cup together. This came in response to a question will the entry of citizens and residents into the country during the tournament be restricted? With regard to the completion of the World Cup projects, he said that the scope of the work of the Supreme Committee for Delivery and Legacy is the World Cup stadium and this has been fully completed. Had in that Qatar, will shine during the tournament as it excelled in the previous sporting occasions. However, we do not want the citizens to travel but to attend the World Cup, to support their favorite sportsmen and also to enjoy the experience of the World Cup. The final preposition for the hosting the FIFA World Cup Qatar 2022 are close to 100%. Only the fun experience remains he added. On disruption of work in government departments during the tournament, he said that the work must continue. Thank you so much for coming back this channel and if it's your first time to come across this channel please consider hitting that subscribe button. By the way, do not forget to hit the notification button because it will be the only way that you will be updated whenever we upload a new video. And always the latest updates that we shall have around the group. Thank you so much for supporting this channel or it's makes from the makes creation TV.


Soon we will begin the season of Lent, those 40 days before Easter, those 40 days in which we focus upon our own inner being and how it is that we grow our relationship with our God to prepare for the celebration of the resurrection of Jesus the Christ. As we do that, frequently there are ways in which we engage missionally as well. And so the North Texas Conference wants to invite each of our churches to engage with us about a particular mission that is unique to our annual conference. And that is with the churches in the United Methodist Mission in the country of Honduras. I want to tell you that over the last two years not only have those clergy and other people in Honduras been dealing with the pandemic, but they had two hurricanes in the year 2020 that drastically affected their country. But one of the things of which I'm very proud is they have not only hung in there, but they've continued to be the pastor, the prophet, the teacher, and simply the person who is present on behalf of the church to people in these communities in Honduras. So you will be provided with videos, testimonies not only from Laity, but also clergy in Honduras who are doing good and faithful work on behalf of the United Methodist Church in a very difficult time. So we'd like to ask you and invite you to consider doing something else missionally. And that is to be very generous in terms of the Honduran mission. So our pastors make about $4,400 a year. They're bivocational and they serve in very challenging and difficult circumstances, but they do it with great joy. And so I would hope that each one of our congregations would be generous in terms of helping provide close to $85,000 to pay all of the salaries for one year for the clergy in Honduras. And you can simply do that very easily. Soon you'll be getting the materials, and that is the videos that you can use and worship or even your social media accounts about what is actually happening in the mission in Honduras. I'm very proud of these persons, men and women who are being very faithful and the way in which they care for each other and care for those in their congregation and even people they don't know. So hope that you'll be generous in terms of giving them some time to hear their stories but also think about how is it that we can be helpful to these faithful servants of God. I want to say thank you, God bless you, and again I appreciate you so very much and the kind of witness that you have in your own community. Let us get ready for Lent.