Hello, everybody. My name is John Hammond. Welcome back to the YouTube video. We're still looking at some more all-army cyberstakes and ACI CTF. I want to showcase this challenge. It's called The SQL Always Sucks. It's for 150 points in the Web Security Challenge. It says, if we discovered an application in our environment that's apparently under development, please identify the risk it poses. It says solutions to this problem are known to be sensitive to common latency. If your solution is working very slowly, you may be able to speed the process by running it from the competition's shell server. Okay, whatever. So let's fire this up. It's a web page and it says, the SQL Always Sucks. It says, SQL Retriever version 0.2, Dev Info Storage, first name. John, submit. Welcome, John. Thank you. Fantastic. That is apparently all that the web page does. If I view the source here, I'm going to zoom in. It says, the SQL Always Sucks is a title. Debug has display of none. That's interesting. Okay, I see that debug line down here. Last SQLite query, select name from users where first name equals John way down here. It says, Dev is only using SQLite. Bobby needs to fix this. Okay, so we know the backend database is SQLite. And seemingly, it shows us the query that's being ran. I don't know what more we could do with this, right? So we could tinker with it. If we go back or modify this first name, we could try a little or one equals one, and then some comments out there. It says, welcome or one equals one and Brantley. Hello, Brantley. I don't know if that lets us get more. Union select one, comma, comma. Union select no, what does that say? No unions. Is it not letting me use unions? Is that the page trolling me? It looks like it is. Okay. So truth be told, if you go take a look at the hints here, it says, Hey, sometimes it's useful to know what database is behind a web application. In this case, we know, okay, it's SQL SQLite. SQL injection doesn't always result in giving you raw database content sent directly back to you. Sometimes it's all about patience and timing. Ah, a timing attack. Okay, if we can't use union, maybe we could do some Boolean stuff with timing. Some attacks are just not practical to do by hand because they require precision and lots of repetition. Thankfully, tools like SQL map can automate much of this for you. Okay, so we could do this with SQL map potentially. Many tools like use unique user agent strings by default. Oh, so curl and SQL map don't appear to be working properly. You might look into whether you configure them to impersonate something else. Odd, maybe that page just does not respond to curl. If I were to simply curl, slap that guy in it says help I'm being hacked slash dead. Okay, so we probably need to grab what is my user agent. Thank you, Google. There's our user agent. We could do this with SQL map. And admittedly, I didn't. So maybe we could fire it up like let's let's just try that. Let's hop into a directory here.  Wow, typing. I don't need to W get anything. I just need to start to write a script. So I can save this in here. User bin environment Python. Let's just say user agent can equal this guy. And I should clear out some of the stuff from the leftover videos. But let's try to get SQL map going on this. First name seemed to be the argument that needs to be supplied. Yeah, so first name should be what we should use so we could use SQL map. tack you on this guy. Is he an opt? Yeah, he's an opt. Okay, SQL map dot pi tack you on that URL. It probably needs an HTTP reference, but I guess it figured it out. First name does not appear and the SQL map is just steaming right through it. Okay. We could tell it that it's SQL light because we know that. Let's actually specify that if you check out the help for SQL light, it should tell you that excuse me for for SQL map, it should tell you that you can specify tack tack dbms. Yep, to specify, this is what the back end database management system is. So let's try that with tack tack dbms SQL light. Maybe it'll try some stuff now first. Okay, it's recommended perform only basic union tests. Do you want to reduce the number requests? Yeah, that's fine. Oh, we don't get the user agent that we specified, right? Because we need to actually supply that. So let's use that user agent. We save that as a string here earlier just to take note of it. Pass it in. Maybe now we'll behave a little bit better. Yep. Well, you won't bother with the union tests. Okay, we can try like level five. Is that how it goes? Like level goes up to five and risk goes up to three, I think, right? So I let this run for a little bit of time. Whenever it would be connecting and it would be trying some attack, it would tell me just kind of as the description of the challenge said, it's getting some issues connecting back and forth. So it's doing some latency stuff. Given the kind of foresight from the hints that this is a timing attack, we could determine how can we do a timing attack within SQL light? And that might be able to give us some useful information if we were to try and do this by hand without using SQL map, I'd like to do something by hand and not try to bother with these SQL with SQL map. And I think there's a little bit more learning in that as well. So if you simply google SQL light timing attack, or like SQL light injection payloads or cheat sheets, there's some good stuff in here. Here's a SQL light SQL injection cheat sheet. One of those results here. And this has some good stuff. You could determine things for a concatenation. If you're trying to do things for comments, it gives you a basic syntax. And there is a time based data extraction. They have a condition set in here and they're saying and one equals this random blob, that will cause a time delay if the condition is true. So maybe we could do that. Let's keep track of this. And let's let our SQL map run in the background until it dies, which it may very well, but we can go ahead and get started with our own script. So let's import requests. Let's do r equals requests dot get if I could type my goodness, I've been doing this for too long, I've been recording too many videos. Let's grab the URL for this challenge, because I don't have that just yet. We can get the URL to equal this guy. We should specify headers to get our user agent in there. That can be simply user hyphen agent, and the user agent variable that we just created. So we could say URL, and headers equals headers. And params should be our database or dictionary, sorry, of what we want to actually try and inject. So params can equal that first name value with our SQL injection. So if I were to try that or one equals one trick with the hyphen hyphen little comment there, we could print out a r dot text. And let's see how that page looks. It needs HTTP colon slash slash as part of the schema in the URL. And there we go. Now we get our page back. I'll split this one more time, drag that output over there. And let's make that syntax in that page HTML. I'll zoom out a little bit so you can see that hopefully you can still kind of read the source code. But the sun is like coming down on me. I don't know if you can see that in the video. But Alrighty, now that we have our SQL injection, it says hey, welcome or one equals one. Oh, I forgot my equals. So that's why that didn't return to me. The little Bentley or that just hung. What happened there? That didn't return anything. A lot of white space. What does that say? There we go. Or one equals one Brantley, and then a lot of white space, for some reason, seemingly. So we know that that clearly works. We know that our Python script as a simple proof of concept will work for us. But let's play with that timing attack. We have a condition that we might need to specify and one equals one random blob, maybe that random blob is what will trigger the time difference for us and we can perform our timing attack. So if I did or one equals one, if I were to use an or zero equals one, that will obviously not retrieve much, seemingly. But we could use that or as a condition. And we can do a one equals one and our random blob. So we know that should work because our or will trigger this condition to work. This first condition one equals one is true. And our and will return from running this. So if I were to press Ctrl B on this, you can see that this window is taking a little bit of time to actually get the response back. So we know, okay, our random blob is actually working. That took a lot of time. So I'm actually going to remove one of the zeros in there and turn that down. That still had a little bit of delay, it wasn't as an instantaneous response as before. So we could kind of toggle this, right? Our or condition is letting us apply another SQL statement in there, and to get our timing attack in place. So that one equals one, we know it will take that long for it to return. And how about a false condition where that random blob does not trigger and we don't have that timing attack? Let's try that. That's a quick immediate response just about. So let's try and determine how quickly that's actually taking let's import time. What I'll do is I'll say a start can equal time dot time. And then I'll do an end equals time dot time. So I'm taking a snapshot of the current time like starting the stopwatch right before I send the request and right after I send the request to see how long it takes for the request to come through. Now what I can do is I can determine like the delta, I can say, okay, how long did it take the difference from when we stopped recording to when we started recording the time? Let's print out how long it took after we get a response. So with a false condition with something that does not start this random blob timing trigger, it takes about half a second or two tenths of a second that might jitter a little bit because we won't know for certain. That one took some time. That was an oddball. We could also just very well switch that trigger now to our one equals one. So we will pause just after our little random blob timing attack. So what we can determine is if it takes longer than maybe a half a second, we know we have a true condition, we know that we were able to actually trigger our timing. If it was a false condition, it will take less than half a second, usually pretty much, right? If we if our connection is good, and nothing's tweaking out on us. So with that, we could kind of start the structure to build a timing attack or some boolean attacks to potentially read out what we actually are looking for in the database. So let's try and determine that with some of our other payloads here. If we want to get the table name enumeration, we can select name from SQLite master where type equals table. And we want to be able to get the first string of that, don't we? Because we if we're doing some boolean stuff, it would be good to get like the very very first character one at a time. And they're actually going to end up using do they showcase it in here? They don't I don't think they do cast one as text I want to get a hex. I think hex is what it should be. I'll look at the payload all the things response and see what it can tell me here. Oh, they do some good stuff they do integer string base extract table name extract column name and boolean stuff count the number of tables enumerate the table name, they select the length here, extract info of the day they use they use hex and substring on the table name from SQLite master, or table name is not SQLite. That looks good. That looks like a condition we can use, because it's going to extract out the first character or whatever character we specify, based off of some hex character as well. So let's get that in place. I will use this condition. And I'll say if it's equal to the hex of some character. So table name is what we're returning from SQLite master to get the table name out of this, it's going to start at position one and go for a length of one. So we'll get the very very first letter out of this. And we'll determine if it is equal to one specific character, which we could kind of specify I'll use percent s and then like a letter C. Now we should really go ahead and start to brute force and determine, okay, what is the actual character that we could leak out with this technique. With that, I'll go ahead and import string. So I can do a for C in string dot printable. Let's include our parameter with testing the hexadecimal character of that character we're looking at. And we'll use our delta to determine if it was a true or false request. So if delta was less than 0.5, that's kind of our threshold, then we know, okay, that is a false condition, and we can continue to test and loop through it. If it is greater than 0.5, then we like, okay, no, now we have a true statement. Now we have a true condition where we've actually found the first character of that table name. So we got a hit, right, or whatever we want, and we can print out our letter or C. We can print trying C. And we can print out our delta with that. In the case we got a hit, let's break and just have a simple proof of concept to see if we can leak out the very, very first character that we're looking at. So let me move our build output back over here. And let's try and run our script. That seemed to fail unsupported format character hex 27. Why is that percent s? Can I just use a format? Maybe it doesn't like that sequel light one that's referring to us. Let's use format C run that guy. There we go. So now we're trying all of the different potential characters that could be returned to us. We could leak this out. It's going through numbers. It's going through letters, and we'll see if it ever gets a hit. Oh, there we go. Looks like we got a hit. Me knowing this challenge, I can tell you that's wrong. So that might be just our network connectivity fumbling. Again, as they say that it's probably a good idea to do this from the shell server. We could SSH and connect into that if we wanted to. But let me just rerun this so I can get our correct thing. And that's going to keep doing that. So let's pivot. And let's go to our shell server. Maybe we can go ahead and run these things just as easily. It does give us a shell over here, right? I can just SSH into this. Does that work? Can I do that? Did sequel map ever get anything? No, I just gave up. So I need a John Hammond as that is my account. Yep, that's totally fine. Enter your platform password. I will copy my password from last pass, slap it in there. Now we should be logged in. Fantastic. Okay. I wonder if it will let me do this with SCP or SFTP. Let me create a new window where I can SFTP over to that. And that's apparently my password. Thank you. Let's grab that cyber challenge link. Will that work? Trying to connect? Maybe not. Okay, that's fine. We'll just copy things in as needed then. Let's make our Python script vim ape dot pi slap that in there. And now let's Python three ape dot pi. There we go. Now he's going super duper quick. And even way too quick that our timing doesn't matter. But that tells us, okay, we have a condition where it is certainly true. And ones that aren't are maybe less than a second. So we can change our threshold to 0.1. How about that? We will need to now modify our script. Let's do an echo nothing into ape dot pi and then edit so I can slap that in really quickly and run it. There we go. So our hit is s. And now we could add that to our list of known characters. And we could slowly start to build out the flag or what we might be reading from that data. So let's do that. Let's do a while one. So we keep looping this. And let's keep track of our known data. I'll make that a list. And we'll start with s because we already know what that is. So we need to adjust what we're actually looking for in the index of our SQL statement, because it's starting from the very, very first position. But we want to be getting just it after the length of our known data. So we'll have to modify this to a formatted variable as well. So that will be supplied. And our hex character will also be supplied. So let's do length of our format or known data. And we'll add one to it because it is one base rather than zero based. And in the condition that we got a correct key, we'll go ahead and add that we'll simply say known data dot append C. And we'll start to actually display what we're seeing thus far. We'll say our join known data. And then trying that all out. Now let's try and run that code. So we're seeing everything that we're building thus far. We're adding to what we build once we know that we have a hit, and we break out of our for loop. So we start again now iterating to add and look for the next character. Let's try to Vim edit our script, slap that in there and run it. And now it's leaking out super secret data. And that's what's going to end up being that table name, which will have the potentially useful and worthwhile information that we might need. So we could go ahead and determine that let's say, table name is super secret data. Let's clear out our known data list. And let's go see how we could determine what might be in that schema. Select SQL from SQLite master where type equals table. So we want to search this guy and table name. Well, we could potentially group concat that could we not? Can we do a group concat? How did they do that? Previously, they just had a from where in there. So we don't need the select that we just SQL is what we're actually looking for. So SQL from SQLite master where type equals table limit one, that guy, maybe that will work for us. Let's try that way we can determine what columns are actually in that super secret data table. Run that guy. There we go. And this will leak out the actual SQLite database schema, how it's represented inside the database. So we'll be able to see this is the column name, this is the type that it's using, this is the data length that we would expect, etc. Thankfully, because we're on the shell server, this is cruising along pretty quickly. It looks like it's adding even new lines. So we're working for but we can see it growing and displaying out as we're working on. So we can tell there's an ID column. And there also seems to be a flag column. Great. That should be text. So let's start to leak out that flag. And now that we've determined the actual schema and what is in that database in that table name. Just paste that in here. So we want to select the substring of flag from super secret data. We don't need to do any where statements, but we're still going to limit one and offset zero. So we get all this good stuff. Let's go ahead and modify our script on the shell server and run that. So there we go. Now we are leaking out the flag using that timing attack and being able to actually determine what is in the database using some Boolean blind SQL injection technique, which is kind of cool. I hope you guys are kind of like that. I don't know if that was presented extremely well. But the resources that I think you guys should actually take away from that are of course payload all the things and absolutely some of that a SQL cheat sheet that we saw up here the unicorn as fuel SQLite SQLite cheat sheet. That gave me kind of the tools and what I needed in my arsenal to be able to go ahead and determine and do this timing attack with that random blob that seems to at least cause a delay and trigger and SQLite that I know I can use to actually leak out more information and that will help me build out this attack. So cool. That is it, everybody. That is all that I wanted to cover. I hope you guys learned something in this video. I know it was a little bit of a whirlwind, but some Python stuff in there, some SQL injection SQLite timing attack and some neat threshold determination between finding out when we're actually having a correct data value, a true condition and a false condition. So thank you guys so much for watching. I hope you guys enjoyed this video. If you did, please do press that like button. Love to see you guys maybe leave a comment, do some YouTube algorithm stuff, hit that subscribe button. I'm so so grateful. If you guys would like to support the channel or me or anything that I'm doing, there is a link to Patreon in the description, link to PayPal, link to Discord if you want to come hang out with everybody. And I'm honestly just so thankful for everything that you guys do. So I wouldn't be able to do these videos if you guys weren't out there watching. All right, that's it. That's the end. Good night. Take care. I love you, etc.


This is Dr. Sanjay Sanyal, the next episode of the dissection series, and the camera person is Mr. Doug McLaren.  The one on my left hand, this is the right lung of the patient, and this on my right hand is the left lung of the patient. Both of them have been retrieved from this cadaver here. The dead teach the living. So let me quickly describe some of the landmarks as we can see them on the outer surface of the lung as well as some of the landmarks that we can see them on the inner surface or the mediasional surface of the lung. So let's start with the right lung. So the first thing are the parts of the lung that we see here. What you see here is the apex of the lung. This is the anterior border of the lung, as you can see it's quite sharp, and this is the one which fits into the costo-mediasional recess. This sharp border that you see here, curvilinear, this is the inferior border, this is the one which fits into the costo-diaphragmatic recess. This concave surface is the one which fits into the right, onto the right dome of the diaphragm. This is the mediasional surface for the mediasurface of the lung, and this is the costo-surface of the lung which is the sternocostal surface of the lung which is in relation to the ribs and the sternum. As you can see the sternocostal surface goes all the way from the front to the back, and this is the posterior border of the lung. Having said that, now let me tell you a few important things that we can see in the right lung here. Straight forward, straight away we notice this fissure here. This is the fissure which is called the horizontal fissure, and this is the one which starts at the level of the fourth costal cartilage and runs along the fourth rib and meets with the next fissure here which is the oblique fissure. I will tell you the continuation of this horizontal fissure on the medial surface when I come to the medial surface. Now let's take the next fissure, the oblique fissure. This one starts, it cuts the inferior border of the lung at the level of the sixth costal cartilage, goes obliquely up and posteriorly, and it comes to the medial surface, again I will show it to you when I come to the medial surface. By dividing the right lung by means of these two fissures we have three lobes of the right lung, the superior lobe, the middle lobe, and the inferior lobe. If you notice the superior lobe and the middle lobe are related more to the front of the chest wall and the inferior lobe is related more to the back of the chest wall. This is of clinical importance. The next thing that we notice are certain shallow depressions on the surface of the lung, and I'm sure you would have already guessed it, these are the costal markings or the rib markings caused by the impressions of the ribs. So these are the salient features that we can see on the external surface of the lung, there's nothing more to explain. The lung normally is supposed to be pale pinkish in color and what you see is the visceral pleura covering the lung with a few blood vessels on top. Okay, having said that, now let's come to the medial, the medial-stenial surface or the medial surface of the lung because this has got several important landmarks. Anyway, let's continue with where we left off with oblique and the middle fissure. The middle fissure continues onto the medial surface and it meets this region of the lung on the medial surface which is known as the high lobe. It meets the high lobe from the anterior aspect. Here it is not so obvious but if we open the visceral pleura we should be able to see it here. Likewise, the oblique fissure, it meets the high lobe from two different places. It continues and meets the high lobe from the infrolateral aspect and, sorry, it meets the high lobe from the anterior inferior aspect and the same oblique fissure continues and cuts through the posterior margin of the lung and meets the high lobe from the posterior superior aspect. So this is the termination of the oblique fissure. So therefore again we can see that the inferior lobe of the lung is related most to the posterior chest wall and the anterior middle lobes are related to the anterior chest wall. Okay. Now let's come to the next important landmark that you can see here is this structure in front of you. This is the high lobe of the lung. What exactly do we mean by the high lobe of the lung? The high lobe refers to the place where the bronchovascular structures which enter or leave the lung from the medial standard. So here we have the, and this is also the place where the medistinal part of parietal pleura becomes continuous with the visceral pleura. So therefore the continuity of the parietal and the visceral pleura occurs here. And incidentally a sleeve of pleura extends down from the high lobe where also the medistinal pleura becomes continuous with the visceral pleura and that sleeve of pleura which only the cut section can be seen here that is known as the pulmonary ligament. That's just of anatomical significance. What do we see in the high lobe before I go to the other landmarks? We see the cut sections of the bronchi here. You can feel it by its cartilaginous feet. So this is the right principal bronchus which divides into three lobe bronchi superior, middle and inferior. So this is the principal bronchus. We can see the cut sections of the veins, pulmonary vein and we can see the cut sections of the pulmonary artery. So vein, artery, bronchi. These are the structures which are enclosed. Additionally we can see a few black dots here. Those are actually the lymph nodes. Why are they black? Because they have absorbed all the carbon particles from the atmosphere, from the polluted atmosphere and therefore they have become black. So these are the bronchopulmonary lymph nodes or the hyalur lymph nodes and you can see at least three of them. One here, one here, one here. So this is the hyalur. Now let's look at some of the important other landmarks. First you can see this big concavity here on the medial surface, on the medial surface. This is the cardiac impression. This is where the right pulmonary surface of the heart is in relation with and which part of the heart is in relation with here is the right atrium. So this area is related to the right atrium. Then we see a groove here. This is the right brachiosephalic vein which becomes continuous with the superior vena keva. And here we can see another shallow groove here which is the inferior vena keva. So the right brachiosephalic superior vena keva enters into the right atrium because the right atrium is here and the inferior vena keva also enters into the right atrium. Then we can see this depression. This is where you have the subclavian atrium. The internal carotid, the brachiosephalic artery divides into the right subclavian and the right common carotid artery. So that is the impression produced by that. Just behind the bronchus, we see a group, a depression here. This is the depression which is produced by the hooking of the azygous vein. The azygous vein, it climbs up on the posterior medial stenum, it hooks above the bronchus and it opens into the superior vena keva which I mentioned comes down like this. Okay, continuing, there is an area here which is related to the trachea and to the isophagus. And the isophagus area continues down in this region here. So this is the isophageal area. So this isophageal area continues down like this. And as I have already mentioned, this is the blunt posterior margin of the lung. So this in a nutshell are the important landmarks that we see on the medial stenum surface of the lung. On the external surface, on the medial surface of the right lung, thank you very much for watching. Ladies and gentlemen, if you have any questions or comments, please put them in the comment section below. Have a nice day. Dr. Sanjay Sanyal signing off. Thank you, Doug.


This research paper examines the evolution of a novel strain of SARS-CoV-2, known as BA.1.23, which was first identified in three individuals who had previously contracted the Armacrown variant of the virus. The initial strain was found to be resistant to neutralizing antibodies, and it subsequently evolved into a more virulent form. This strain was then passed on to others, leading to the emergence of a new strain that was even more resistant to neutralizing antibodies than the original strain. These findings suggest that the virus may continue to evolve and become increasingly difficult to control. This article was authored by Anna S. Gonzalez-Reach, Holler-Alshammery, Sarah Schaefer, and others.


As a young person grooming yourself of the future, you will need to be hard-working, diligent, and charming. While this thing sounds straightforward, they are not easy to pull off in a place where you have not established a reputation for yourself yet. You need help to succeed. In today's video, I'm going to show you 15 psychological tricks that you can use to persuade anyone to do things for you. If you're new here, subscribe to our channel for more awesome videos such as this one. 1. 2. 3. 4. 5. 6. 7. 8. 9. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 22. 22. 23. 24. 25. 26. 27. 28. 29. 30. 30. 31. 32. 32. 33. 34. 35. 36. 37. 39. 40. 41. 41. 42. 41. 46. 47. 47. 48. 49. 50. 51. 51. 52. 53. 52. face-to-face. Sending an email is not quite as effective. According to Life Hack blog, in politics, there are lots of studies that show that face-to-face connect is the most effective method of all in persuading people to vote for a candidate or cause. Remember to smile. Not smiling may make you appear unattractive to the person. 3. Use the power of touch. As a salesperson in a store, getting people to touch the product is the winning ticket to getting them to buy. A lot of studies have shown that people who touch items in a store have the highest probability of buying the items. A touch is a potent tool of persuasion. If a person is refusing an offer and you hold their hand gently and explain to them, it can swing their decision in your favor. Studies have also shown that touch can put people in a better mood. You can use district to your advantage. 4. Active listening. Listening carefully can also help you in your quest for persuasion. If in an interview question you pay close attention to all the questions and answer them appropriately, you are already almost in the door. Even before you answer the interview area, listen for bits of useful information. It may be about the interviewer's favorite football team or the color of their car. Anything at all that may be helpful. During an interview, mention something that suggests that you are aware of this information and you and the HR will become buddies immediately. 5. Speak moderately. Some of you are Mavericks. You talk as though your life depended on it and speak so fast that would have to record you and play back slowly to get what you are saying. According to the University of Michigan, U.S., researchers found that the rate of speech when persuading was an important and often overlooked factor. Speech rates, speech and fluency were all measured in telephone interviews whether we're trying to persuade people to take part in the survey. The optimal speed of speech was about 3.5 words per second, which are moderately fast. Speak a bit slowly and clearly. You sound more persuasive that way. 6. Be flexible with your tactics. Don't become rigid because one strategy has worked before. It doesn't work like that. Learn to be more flexible to use several approaches as a situation demands to get what you want. You can try talking if it's not working. Try body language. If body language is not working, try listening. Either way, keep trying. Children are typically good at this when they want to get something from their parents. They sulk, cry, scream and sometimes just go quiet. They always win. 7. Social proof. When having a conversation with someone, you can support an argument by citing social proof. You can, for example, say that everyone agrees with you or that it is a common knowledge. When you say it like that, it doesn't leave room for much argument again. It works because people want to feel like they are in the majority naturally. They want to be part of the in-group. So, if you can convince someone that most other people believe something, they are much more likely to agree with you. Makes sense, right? Have you used this on anyone yet? You probably have. 8. Using a deep voice. For some psychological reason, deep voices are persuasive. There is something about those voices that make you want to agree with them. When someone has a deep voice, he is perceived to be an alpha male, the person who everyone must look up to. As a result, he automatically is given a sense of authority in group situations. People always react emotionally to situations rather than logically. That is why the tricks of persuasion always works. Do you have a baritone voice? I don't. But hey, there are many other persuasion tactics you can apply for yourself. 9. Use branding. Many people who have done this successfully are associated with the things their brands is about. If you want to persuade customers about the authenticity of your products, bring them under a brand. What comes to your mind when you think LG? What comes to your mind when you think Samsung? How about Nike? In each of these instances, you will likely have thought electronics, electronics and sports shoes respectively. This is the power of branding. It is an exceptionally persuasive tool that can be used to get people to patronize products or services. People too can be branded. 10. Speaking in a succinct manner. Even after college, some people will go to interviews with erroneous belief that speaking in an unclear and grandiose manner will get them in. They are usually wrong. In business, time is money. To maximize your time, you have to speak efficiently, straightforwardly and smartly. People who adopt this manner of speaking are usually very persuasive. Don't talk about the history of a product when trying to sell it. Tell the prospective buyers or investors the problem it solves and how efficiently it does it. 11. Use extremes to persuade. In relating with people, there are many things that they may think are important while they will regard some of the things as not so important. If the person is religious, for example, you're trying to get them to donate to a charity. You can tell them that giving is one of the most important things Christ preached. Christ did preach giving. But he said love was the most important thing. You can still argue that giving is, after all, an act of love. This is very likely to work on people who hold beliefs in the area you're using an extreme point in. 12. Appeal to authority. If you are not sure the person will believe something simply because you said it, you can cite a notable figure of authority who supports your argument to persuade the person that the opinion is valid. College students use this on their professors a lot. When they know that the professor admires an authority in the subject he or she is teaching them, he or she will then write an essay making an argument that is supported by such people to persuade the professor of the credibility of their argument. 13. Repeat, repeat, repeat. This part cannot be emphasized enough. The more a person hears something, the more likely they are going to be persuaded about it. It is why adverts are generally not aired once. They can air them for like a month at a time. The more people see it, the more likely that they will pick those items in the stores. Powerful ads, after all, make powerful brands. Even in email marketing, the emails are not dispatched only once. They are sent in regularly and the click rate is tracked online. 14. Create a sense of urgency. People selling products and services use this a lot. They basically make the client feel like time is running out on them by giving them discounts that put them on the clock. When people are on the clock that way, they tend to hurry so as not to miss out on the benefit. This is a very sort of persuasion tactic. People who do this are usually very seasoned in the art. You can try selling something to someone for a start. And then as a conversation evolves, then you can bring it in. 15. Appeal to general acceptance. According to reality check, general acceptance refers to the norms of a certain society in a certain period. These are the political and social pressures that shape how we interact with each other and the things we do in our lives on a day-to-day basis. As long as the person believes in general societal norms, bring it up. It would persuade him or her in your favor. An example can be if your girlfriend refuses to come to see your parents. You can argue that it is acceptable cultural behavior for people who are looking at a long term relationship. I personally don't recommend using it though. Let her come if she wants to come.


My name is Sophia, and I'm at the race to deliver conference 2019. I came convicted by a testimony yesterday about New Age ceremonies felt convicted to come and break any agreements that I made in that past life and just to make sure that I wasn't being leaving space open for the enemy to attack me and to bring me back. Find an image Jesus Christ all over your body. What have you done in her life? How did you destroy her life? Fear? What else have you done? But Jesus knows me better and I went to the prayer line and a demon spoke through me through fear and lust and unworthiness that was put upon me through generational sin and when I was little. Find an image Jesus Christ all over your body.  Only go find an image Jesus Christ all over your body right now out in Jesus' mighty name. Jesus' mighty name. He freed me. Hallelujah. Praise Jesus walking in freedom.


My name is Arnold. I speak to staff. She is very rude. She says something about, you know, cleaning my animal. What breed of animal do you have? I have a pig. Very important. I clean. We wouldn't even have the facility in our grooming salon. I have a 30 kilo pig. Similar size to dog. I could maybe bring that in a harness. You could take it to a self wash. I know. I know clean. I don't know. I don't know. We can't help you, sir, unfortunately. Pig, dog, the same thing. Yes, they might be the same size. You listen here. I've been getting my pig clean for five years down in Sydney. No problem. Other dogs there. They don't even look. They just smell, smell it a bit. That's all. I understand, unfortunately. I bring him down. We bring him down and we see, okay?  I see you in the morning. Okay? Oh, it's okay. Okay. We'll see you in the morning. Bye-bye.


Yeah, so I'm on the Sherpa Committee for that. So we organized this where we bring out the staffers. Obviously representatives Lou and Landerman didn't walk the floor this time. But they were actually out here as a part of that. And their staffers, they actually went through the villages. And so we organized the schedule. And then we have multiple private events outside of here also with them. And I just think that's really cool because, I mean, one of these things, yeah. So I mean, the ICS Village that's right over there, we're a nonprofit. We're a 501C3. And a lot of what we're doing is advocating for education awareness, particularly with folks who actually control legislation that kind of affects our lives. So it's great that they're actually out here at this and not just scared of all the dirty hackers that are here at DEF CON. It's all really frightening. So, all right, we'll get started. I like this to be interactive. There's two ways for this to be interactive. Where you guys can voluntarily interact or I can help you to do it.  So what we're gonna go through is we're gonna go through a threat landscape of what have we, what did we see in 2018 in the industrial control system and internet of things landscape. So what was actually happening, where possible, let's establish attribution, who was doing it. At the end of the day, while conferences like this were focused a lot on the technical side of how we might do these things. And we'll talk through that to some degree. I think it's important to recognize that particularly when we're looking at the fact that there's nation state on nation state, it's not just a technical question. There are multiple arrows in the quiver. Cyber is just one of them to cause those effects. So, who am I? I founded Grimm and Scythe and then with Tom Van Norman, we both co-founded the ICS Village over here. We've been doing this for many years. I'm also on the board of advisors for the Army Cyber Institute and the fellow at the National Security Institute.  So, like I said, we're going to walk through the landscape. We're going to talk through particular types.  So, who saw on the news what the Russians did this week? Nobody saw on the news what the Russians did this week. Did you even look at the news because they do something every week? Raymond Blaine, what did they do?  Is there anybody else I know in here?  The Russians, I feel like that's every day, kind of sucks to live there. Right, kleptocracy. Okay, so the Russians just got caught using IoT devices for lateral movement. So, there were three categories of devices. Microsoft's the one who caught them. And what they were doing was, first of all, compromising the IoT device and environment. Which, guess what, really easy to do. I gave a talk showing how you can do that against tens of thousands of devices across the planet with no technical expertise. True story. I gave it at B-Sides Las Vegas this week. I've been giving this talk for two years. And what I was primarily trying to show is we get too focused on, as consumers, the creepiness of our IoT. Somebody's going to get into my webcam and watch me get out of the shower. As you can tell, nobody wants that. So, that's not a problem. But that's not the real threat model. The real threat model is exactly what the Russians just did this week. I can easily get into an IoT device. And more importantly, that device gives me a pivot point to get something that I do want. Something that is interesting. So, I actually give you a take-home lab where you can do that in the comfort of your own home. All right, so we've got through that. Okay, so in 2018, courtesy of Kaspersky, no irony there, a lot of companies get attacked. Most companies have had a breach. And we see this kind of thing in the news all the time.  We're all going to die tomorrow. The electric grid is fucked. What are we going to do? Yet, here we are. So, let's start with my very complex diagram, explaining how OT is different from IT. Has everybody heard of OT before? Do you know what that is? So, OT, operational technologies. This is how we are segregating that the traditional infrastructure that we're used to and that we're playing around with our computers and our daily jobs is separate from these computers that are what's providing us water and electricity and all the different parts of the infrastructure that underpins modern society. Without these, we go back to the Stone Age. So, like I said, we have a very complex diagram to show that those are two different things. The other joke of Kaspersky is that they're air-gapped. Everyone know what an air-gap is? Has anyone actually seen a real air-gap? No, because they don't actually exist. An air-gap is not an air-gap is not an air-gap. Not a single time in my entire life of pen testing in industrial control environments where someone's like, these are air-gapped. And I go, I just kind of stop and pause, like raise the eyebrow, and they go, well, I mean, except when we do this or every other Wednesday when we do this, there's always something that means they're not air-gapped. So, of course, we hear all this and we understand that computers increase our surface area, which increases our risk. So, why are we introducing computers into something like the electric grid? If this is causing these problems, why are we doing it? Why don't we just make it simpler? Why don't we just go back to complete analog? Anybody got a guess? Why are we doing this? What changed, right? Something had to have changed. If we go back 30, 40 years ago, there were kind of computer things then. Something in the last 30 to 40 years substantially shifted the environment that has caused us to be here. Any guesses? Eye contact, what is it? No, you can't look away after I point at you. Technology, well, yeah. So, the reason there's more technology is technology. Yes, sir? Because I want to work remotely, right? That drives efficiency, but I mean, if it really was that kind of risk, then I would say, you know, I'm not going to let you do that. But yeah, that is a factor, but what is the significant change? The what? The managers? The managers like to look cool? No, because it looks cool if you work for technology. Who doesn't like pretty colors? See, I was in the military. This is how you made generals happy. Every general had some color that he liked or she liked. And you'd be like, ah, he's the light blue one. She kind of likes an aqua. And God forbid you put the wrong color in there, because it didn't matter what the content was. Funny, but no, not true. So, what actually changed is, 30 years ago, power was generated at a plant and transmitted to you the consumer. One direction. Today, it's no longer one direction, right? Consumers through renewables like solar energy now contribute power back into the grid. And what used to be a very simple unidirectional where I had to worry about remote administration and efficiencies. And I was looking for those kinds of things. Now, I'd need the computers to handle the exponentially more complex electric grid of the fact that, well, it sounds like it's easier because one way this way and one way that way, except for the physics of electricity, make that a much more complex problem. That's why we're here. OK, here's our actors. Anybody out there that surprises you? Nope, we know who they are, right? Whenever you hear people talking about the complexities of attribution, at the end of the day, I think we can kind of look at motives and determine a lot of what's happening. You don't always have to do all the technical forensics to figure it out. So I would argue there is one flag that's not up here that should be. Any guesses? Who? That is China. America, UK, China, Israel, Russia, North Korea, and Iran. Vietnam. In the last year, we have seen the Vietnamese conducting nation-state espionage at an extreme level, where the part that has been publicly disclosed and everything I say is going to be an open source, of course. They are hacking all of the car manufacturing plants in their countries and stealing everything out of it. So Vietnam gets honorable mention. All right, let's start with the first one, Olympic destroyer. So originated during the 2018 Olympics, hence the name, started with spear fishing. So targeted fishing with a weaponized document. People popped that open, created a network that then started warming its way through things. One of the things they did that was interesting is this concept of a data wiper. What a data wiper is is exactly what it sounds like. I'm going to do destructive things.  I'm going to start deleting things. Now there's two reasons why I want to do that. One, could be that my interest is chaos and I'm trying to actually cause destruction on your network. The second is it's also awfully hard to do forensics in an instant response when I'm destroying the data of what you're trying to find. The reason that there are three flags up here for attribution is because a significant amount of deception has been used in this. So it's kind of difficult. We know it's one of these three. From a motive perspective, we saw Olympic destroyer appear again attacking European biolabs. Does anybody remember how the Russians didn't cheat in the Olympics? Yeah, it's like every Rocky movie, right? So from a motive perspective, that would seem to be the Russians. However, some of the techniques and tradecraft and the fact that there was a focus on money indicates either China or North Korea. The North Koreans in particular, who remembers the Cold War?  Most of us are old at this point. The Soviet Union had rubles. Do you remember, have you ever seen rubles before, like the fall of communism? No, rubles were worthless. Rubles only mattered inside the Soviet Union and even then they barely did. They needed hard currency. The US dollar is the currency of choice across the world for the financial system. It underpins everything. You can trade in and out of it. You couldn't do that with rubles. So as a Soviet, you needed to get your hands on hard currency dollars to be able to do things overseas or of course, get luxury goods for the aparachics at the top of the communist chain there. North Koreans, same kind of problem. Nobody cares about their currency. They're in a closed economy. They're locked out of the world stage. So if, you know, dear leader wants whiskey and Ferraris, he can't buy it with the local currency. He needs the US dollars. He needs hard currency. He needs a foreign currency. So their primary motive from the cyber perspective is theft. And we see this where they're attacking banks and they're attacking different cards of critical infrastructure from a financial perspective. UN report that just came out the other week that the UN has classified that they have managed to steal $2 billion alone. One or Cry. So One or Cry was not in 2018. It originally appeared in 2017 targeting windows. We all remember that one. Took down a significant part of hospital system in the United Kingdom. But what is interesting is a variant reappeared in 2018. So when I gave this talk at RSA, it's funny. I just happened to meet the CISO at Apple the night before for drinks. And I was about to tell them how I had this slide laid out because the Taiwanese manufacturer went down. That's not an error. A quarter of a billion dollars of impact. And the word on the street was actually that Apple's shipping was delayed because the entire manufacturing plant went down. How it was introduced was, and this is a problem that we see a lot in manufacturing plants in industrial control systems, is the gold image that was used because these things are old, couldn't be patched, was susceptible. Supplier brought it in, installed it on a system inside the manufacturing plant. And then because One or Cry actually couldn't beacon out, it compromised everything it could touch and continue to move, trying to find its way out and took the entire plant down. North Korea. By accident. They didn't intend to infect it. This was a supplier who just happened to have had an image that was infected and introduced it. I know, it's great, isn't it? All right, Trisys. So also started off in 2017. They used a combination of fishing and a watering hole approach. So watering hole is, I study the habits of the employees at your company and I look for the forums and I look for the websites that they go to. Forums are great because there are a lot of errors in parsing, so it's really easy for me to post something there that creates malicious content that then is served to anybody that goes there. And of course, since I've profiled that your employees go there, particularly you. Sorry, somebody else I know. I get them. Another example of, again, we see them targeting IT with trying to move laterally over to operational technology because again, where's that air gap? In the 2017 attack, they were attacking the safety instrumented system. That's a big deal. So in industrial control systems, this is the thing that's operating all of the sensors in the computers that are actually changing things in the physical environment. This is my view as a safety engineer of understanding what exactly is happening and if it's intolerance.  All they do, I don't have to hack a PLC. All I have to do is tell a PLC what to do. They don't validate me. They don't look for authority.  I'm gonna be doing this if I do it. They don't have that kind of understanding. That's what the SIS does. And so that attack in 2017 was incredibly dangerous because of that. We saw it appear in 2018 targeting the US oil and natural gas pipelines. So a variant came out. This one is great because of how it leaked. This is again, putting on my I am the Calvary hat, one of the reasons why the responsible disclosure is so important. In this instance, that 2017 malware was uploaded to VirusTotal, where it was freely available for anybody to download. So the reason why we have no attribution is anybody anywhere in the world was able to download that malware, make a few modifications, and then launch it again in 2018 against the US. We remember this one, right? 2016. However, did you notice nothing happened in 2018? So this is where we credit the Russians for what happened in 2016 and credit them for their attempts in 2018. However, the American flag goes up there. The US government deployed a different strategy in responding to, and this is, I'm putting this under the critical infrastructure piece because obviously voting machines aren't industrial control systems. But first, Cyber Command found the Russian agents, or I mean the glorious patriots, who were conducting these campaigns, and on their computers a message popped up that said, hi, we're the US government, we know what you're doing. Now, the problem with that is, as scary as that might be to anybody individually, that the US government is saying hello, it's not as scary as the GRU agent who's right behind you, who's like you will continue, right? So, all right, I'm gonna keep doing that. So, I have a phrase, a hacker can't hack what they can't touch. So, just like that, what Cyber Command did is they actually took down the entire IT infrastructure of the internet research agency in Leningrad, so they weren't even able to get out. So it didn't even matter what their intent was anymore, they weren't able to effectively meddle because they were taken offline. So, summary of what we saw in 2018. First of all, we saw more activity. Guess what happens when I do this again next year for 2019, we're gonna see more. The primary point here is that what we're seeing in critical infrastructure attacks is these are iterative intelligence campaigns. We don't have much proof that what is intended is destructive, what we definitely have proof of is intent to learn and to move and to continue to worm into the infrastructure. Ransomware is becoming popular. Ransomware has two benefits. One, it's destructive. Two, it looks like it's not intended. It can be destructive by accident, so it kind of questions what the intent is. Doing one of my five-year kind of predictions, and this is gonna kind of, hopefully you won't feel bad, but we'll try to end on a positive note somewhere. At some point in the next five years, I think that somewhere in the world somebody's gonna literally wake up next morning, they'll come from DEF CON, they'll probably be hung over. They're gonna get their coffee, they're gonna work their way down to their car to go to work, and the second they turn on that car, the infotainment system is gonna pop up Ransomware, send three Bitcoins to turn it on. I promise you, within five years, that's gonna happen somewhere in the world.  Living off the land, attackers aren't bringing their own tools to the game. They are taking what's already there in that environment and using it against you. Supply chain, just like we saw with the hack against the Taiwanese manufacturing plant, suppliers are a part of your risk model. Anything that touches your infrastructure is a part of your risk model. It's no longer just you anymore. Boo. All right. So we're gonna quick go through some consumer devices here. This was me last year with Yahoo Finance walking the floor of the Consumer Electronic Show, actually here in Vegas. If you think DEF CON is big, imagine six times as many people in the city, it's ridiculous. And what we saw is every device there, first of all, all of these IoT devices, everything is trying to go to the cloud. If you wanna really have fun, plug an IoT device in your home, check the packets and see where they're going. I have not seen a single device yet that I've plugged in that is not going to China. Now I'm not suggesting that's nefarious or malicious, I'm just suggesting every single one goes to China. Wait, where are they made? And then the other thing of course is now we wanna talk to our devices. So these devices are always listening to you and they're always talking somewhere else. Did you know that a smart TV costs less than a TV with no functionality? Why is that? Anyone got a guess? What's that?   You're also making it when you buy a car now. There are multiple models where the car manufacturers are looking at how and what they can take from you from your data when you drive your car. So, state of affairs. This is the IoT hack I was talking about. They targeted, the Russians this week just got caught by Microsoft targeting three IoT categories. I will share the lab so you can do this at home. It'll show you how to find them, how to deploy proof of concepts if you don't want to write your own proof of concepts, just go to GitHub and type in IoT POC or IoT vulnerability. There are 28,000 commits after the last time I looked. So, free code out there to do it. Who patches their devices at home? No, it'll work. I am not suggesting you do that on anything other than your own equipment in your own house, right? Let's not break the law. But Microsoft caught them, we don't know what the intent was because they weren't able to latterly move to their targets of interest, but they were able to get there and then they were then started employing traditional implant, IT implants to move further. All right, so in IoT other than lateral vector, which I just mentioned, we see pretty much three common attacks. The first of all is what I'd like to describe is the Brian Krebs attack. This is where Mariah, we saw a million devices harness to take him down and it worked. I mean, there was nothing anybody could do against that. These devices by themselves, not a lot of computational power, not a lot of bandwidth, times a million, this would be a lot. Ransomware we already described and then depending on whenever John McAfee tells us something is unhackable in Bitcoin, that drives the prices. Crypto jacking is stealing your cycles to harvest coins. So, first problem we see is two kinds of attacks that are primarily out there in the wild. One is the Mariah type attack. Something like 90% of all IoT devices are shipped with about 10 different combinations of user IDs and passwords. All I gotta do is try them. That's how Mariah got millions of devices, that was it. Anything I saw, I just tried those combinations. Do you think they even locked you out after three? How many people in this room monitor the devices on their own network at home? Yeah, right? So, and you're not doing it in real time so you're not gonna stop me before I get there. So, I can brute force that. More complex is the Reaper IO Troop. So, I just talked about the number of commits on GitHub that provide this kinds of proof of concept. What they did is they went and found 65 proof of concepts throughout their end days and of course we're not patching these. And all they did was at every device they went, they enumerated it, aka fingerprinted. I know exactly this device. I match it to my catalog of exploits and I'm in. Those are the two primary campaigns we've seen. That's all it takes. Oh, this is kind of a fun one. So, one other example of lateral movement is, did you know a casino here in Las Vegas was compromised by a fish tank? So, I believe you were the one who said remote administration? Yeah, so they had a vendor who had remote access to monitor the temperature of the fish tank. Popped the fish tank. Once we were in the fish tank, we looked around, moved in and robbed the casino. We think that was the Iranians. So, references for more info, of course. My non-profit, the ICS Village, IoT Security Foundation and I am the cavalry. Come look for me on Twitter at Brison Board. That's where the GitHub is published if you wanna do the take home lab so you can do your own on your own devices, compromise and movement. Any questions? Brison, do you have that congressional people talking about what you alluded to earlier? Yeah. You also alluded to data from TVs, vehicles, et cetera, making the vendors money. Are you having any discussion with the consumers getting value in their own data? With those congressional? So, the question is where companies are selling out our data, am I educating Congress on that? Yes. All right, well, thank you. If you haven't seen the CTF or haven't seen the ICS Village, go check it out. Appreciate your attention.


When we browse the internet, we unknowingly reveal a lot about ourselves. Privacy and data protection are important issues for everyone surfing the net. However, there are ways of remaining incognito. One common option is Tor. Tor uses the principle of onion routing for anonymous communication over a computer network. With Tor, messages are encrypted in layers and pass through routers until they reach their final destination. The identity of the sender of the message remains hidden. Tor is the technology used to access online markets in the darknet. In these markets, goods and services are exchanged between parties who use digital encryption to hide their identities. When a purchase takes place, buyers and sellers use cryptocurrencies such as Bitcoin to remain anonymous. Darknet market goods include illicit drugs.


Hello and welcome to the session. This is Professor Farhad in the session we would look at the investment process and the concept of risk versus return. This topic is covered in essentials of investment course, undergraduate or graduate level, CPA exam, as well as the CFA exam. As always, I would like to remind you to connect with me on LinkedIn if you haven't done so. YouTube is where you would need to subscribe. I have 1,700 plus accounting, auditing, tax, finance, as well as Excel tutorial. If you like my lectures, please like them, share them, put them in playlists. Subscribe to my YouTube channel. If they help you, it means they might help other people connect with me on Instagram. On my website, farhadlectures.com, you will find additional resources to supplement your accounting as well as your finance education, especially if you are studying for the CPA exam. I strongly suggest you check out my website. So let's talk about the concept of investing. So when you invest, do you think you invest in one thing or many things? Simply put, do you put your eggs in one basket or do you spread your eggs out? And the answer is obviously you want to diversify. You want to invest in many different investments. So simply put, you will create a portfolio so you don't put all your eggs in one basket. And what is a portfolio? A portfolio is a collection of investment assets. What are we talking about here? For example, this is a portfolio that consists of bonds, stocks, and cash. And this is, it's one-third, one-third, one-third, but this is what we have here. So when we talk about portfolio, we have to understand two concepts. One is called asset allocation. The other one is security collection. So what is asset allocation? Asset allocation is when you choose among broad asset classes like this. For example, here we are choosing one-third in stocks, one-third in bonds, and one-third in cash, which is when I keep one-third in cash. This is our overall asset allocation. For example, 33.33% stock, stocks 33.33 bonds, and we're going to keep 33.33% in cash. That's the asset allocation. Now, obviously it doesn't have to be this way. We could add mutual bonds, we can add commodity. This is a sample asset allocation. Now, once we have the asset allocation, let's talk about stocks now. Now we need to go into security selection. What is security selection? For example, in stocks, we have to figure out the different types of stocks we want to invest in. For example, this 33% of stocks will have to choose individual stocks. Do we want to invest in software companies? Do we want to invest in social media like Facebook, Twitter? Do we want to invest in retailers? Do we want to invest in large tax, small tax, medium-sized companies, international, real estate, so on and so forth? Same thing with bonds. We could also, we have security selection for bonds. So this is, so asset allocation is looking at the overall picture. Security selection is looking to invest in a specific stock. Now what we do over time, for example here, if stocks went up in value, what's going to happen? They're going to ear up the percentage of our portfolio. Therefore, we rebalance the portfolio as necessary. And within stocks, if we invested within that 33%, 10% in tax, we want to make sure if this percentage increased, we need to sell our gains, maybe move them to cash or move them to bonds to rebalance as needed. But this is what security selection is. Now how do we conduct our security selection? We have two approach. We have the top-down approach and we have the bottom-up approach. Let's look at the top-down approach because basically in a sense, we were talking about the top-down approach is where we have asset allocation first. We determine what's our asset allocation. Then it's followed by security analysis. Then we look at specific stocks that we want to invest in. This would require a lot of research from our end because we are saying, this is what we want our portfolio to look like from a macro perspective, like 50% stocks, 50% bond, or 70%, 30%. Or 30% stocks, 30% bond, 40% international or whatever we are looking at at asset allocation. Here we are, we might be more diversified because we are trying to invest in different classes of stocks and in different industries. This is the idea of a top-down approach. A bottom-up approach is a little bit different and this is where most individual people uses when they invest themselves as they select securities based mainly on price attractiveness. So if we think the price is right, we buy the stock. We don't care in which industry, we don't care what is our asset allocation. Now let me go back to the asset allocation page and this, you need to be familiar with this asset allocation before I move on. Why? Because when you invest in your 401K, so if you have a 401K plan at your company, most likely they send you a menu of investments and this is what they break it down for you. For example, if you want to invest 40% in stocks, then within stocks they would say, you know, you could break down your investments into various categories. For example, a person like me, I practically have 99% of my investments still in stocks and equity, but breaking down into different industries in different capsizes. But the point is investors when they do it themselves, they choose on price attractiveness. So here you don't have no class asset proportions. You don't care about how much is invested in real estate versus stack versus retailers. You don't care about this. In other words, you may not be well diversified statistically speaking because the stocks are more sensitive to the issue in company firms condition. Why? Because you are selecting one stock. And generally speaking, when an industry is doing well, it's not gonna rely on one single company. It's gonna rely on many companies. And if you keep on selecting those price securities based on price attractiveness, you might be concentrated in one specific industry without knowing why because they're all attractive stocks. So that's the concern. So just make sure you know the difference between top-down approach versus bottom-up approach. Now we need to understand the concept of risk and return. And the concept, I believe it's intuitive. I'll give you two options. Let's assume you have some money today and I'll give you two options. You could invest in a safe investments or you could invest in a risky investment. What could be a safe investment? You could give your money to the US government and buy treasury bonds. That's a safe investment. Or you can invest in a startup. Some company that's, you know, it's a drone. It's creating drones, okay? So if you have money, if you have let's assume you have $100,000 today, if you invest money in government, in the government, in US treasury bond, you may not, first of all, they're not gonna offer you high return. Why? Because you're gonna have this money later. Let's assume you're investing for 30 years. The risk of that money being there is practically risk-free.  Okay, now, so you might be, you might be okay with a 3% over all return over 30 years. But if you're gonna take this $100,000 and invest in a startup, that it's really practically brand new, what's gonna happen is this. There's a risk that this startup may not exist when you retire. So what's gonna happen? You might wanna take your chances. You can if you want to. But you're gonna ask for a higher return. You might ask for 20 or 25% return on your money if you want to invest in a startup. So what does that mean? Simply put, the riskier the investment. If you're investing in the riskier investments, then you require a higher rate of return. So the riskier is the investments, the higher is the return. And hopefully this makes sense, okay? So what are you doing when you make an investment? Whether you invest in treasury bond, US government, whether you invest in this startup drone company I'm starting, which is I'm not, but the point is giving you an example. All what you're doing is you're delaying your consumption. In other words, you are not consuming the money now. You're investing the money for later. And what you're doing is you are making a commitment. Another commitment, you are kind of basically getting a promise about the cash flow into the future. But that cash flow would have uncertainty. With the US government, there's practically no uncertainty. The US government will be here 30 years from now. But this startup company, I really don't know. So what's gonna happen? If you want to invest in the startup, you're gonna have to request or require a higher rate of return. So invest in US government, it's safe. Invest in stocks or simply a startup company, it's riskier. So the higher the risk of the asset, the higher is the required rate of return. Hopefully this makes sense. So there's a positive relationship. There's a positive correlation between the two. Higher risk, the higher the return. And this is what happened when you invest, okay? Now we need to understand the concept of efficient market. What is efficient market? What's the concept of efficient market? Efficient markets simply state in one way or another that the stock price reflect all available information. And we'll discuss this later, this concept. Simply put, when you buy a stock, it's fairly priced. Why? Because all the information is known. You have a competitive market. You have analysts, you have professional investors. You have amateurs. And everyone is aware of this information and reflecting the information in the stock price. Simply put, you cannot beat the market. The price that you buy is a fair price. It's not undervalued, it's not overvalued. And the price is quickly adjusted. And if there's new information, the stock price would quickly adjust. So the question here is how comfortable are you when you invest in this efficient market hypothesis? How comfortable are you? Because if you are comfortable with this, if you think the price is fair, if you think the price of the securities reflect all available information, then guess what? Then the stock, any stock you buy, it's not overpriced or it's not underpriced because the stock reflect all available information. And here we're talking in theory in a perfect market. If you don't believe that's the case, if you don't believe in the efficient market theory, then you have the opportunity to find advantage over other investors by doing what? By finding underpriced or undervalued investments. Now, how do you do so? Well, you conduct research and that's costly. So the point is, do you believe in market efficiency? And if you do so, well, you really should not be looking for stocks just buying the market and just, because if all the stocks are fairly priced, then the market is fairly priced. But how do we invest when we invest? We have two ways to invest when we invest. We have a passive management approach and an active management approach. Let's take a look at the passive management. Here we purchased highly diversified portfolio, okay? And nowadays it's very easy to buy a highly diversified portfolio. You have those exchange traded funds. For example, you can buy the S&P 500. The S&P 500 include all the 500 in the S&P. So you buy that ETF and you are highly diversified before either needed to buy a mutual fund or worst is you have to find an advisor or a financial analyst who would buy different stocks from different industry to have you diversified. You don't have to do this anymore. Now it can be easily done. So you can buy a passive investment. You don't make any attempt to time the market. Maybe you'll buy it in pieces, but you're not looking to time the market, okay? You're not taking any time to invest, to invest in research, no time consuming. You believe everything is, nothing is undervalued. Nothing is overvalued. All the stock prices are properly valued. So no attempt to find undervalued. Here you assume efficient market, just what we talked about when you are passive investor, you are assuming efficient market. You don't worry about doing research. And this strategy is called buy and hold and wouldn't buff it, believe it or not, as a fan. He always advise regular investors, look, buy an ETF that represent the S&P 500 that you don't have to worry about anything. You can wait 30 years and you're gonna be fine. This is if you believe in this, this is you are a passive investor. Active investments is a little bit different. Now you are looking for mispriced securities. Securities either undervalued or overvalued. If they're overvalued, you can short them and we'll talk about shorting stocks later on. So you are looking to find an opportunity to make more profit, more return than the market, okay? And also you are timing your entry. So you're looking when the market drops, or you think this is the best time to enter the market. Here you are assuming inefficient market of prices of securities. So you are actively managing your portfolio. That's costly and difficult. That's not easy at all. But those are the two strategies that you could use. Now, in my opinion, I mean, this is just a personal preference. For my 401K, for my retirement, I believe in passive. For my trading, I'm very active. But again, I am more than investor. I am basically, I'm a trader. And I don't usually trade individual stocks. I trade the market overall. But that's a different story. But the point is, I also believe in what Warren Buffett says.  S&P 500 is a good investment. Or S&P 500 and QQQ, which is the NASDAQ 100. So, or find an ETF that represents the Dow and just buy if you believe in the US, if you believe in the market, just in the long run, we're gonna be here. We're gonna be prosperous so you buy them and you just don't forget about it. That's all what you do. In the next session, we'll look at the players in the financial market. As always, I would like to remind you to, like my lectures, share them, put them in playlists. If they benefit you, they may benefit other people. And always check out my website, farhatlectures.com. If we are still experiencing this coronavirus, stay safe. That's the most important thing and study hard.


I believe you've attempted 11 free throws and four of the last five games. I'm just wondering if you've noticed a difference in the way you've been officiated or if you've just been more aggressive. Yeah, I don't know. I just, I'm trying to attack the basket. James, I got two for you. Just what would start to work for you guys towards the end of the second quarter into that big third quarter you guys had? Our spirit, our energy. You know, we got after defensively. I think the first quarter, they had 41 points. We had 25, like 25, you know, that's 100 points again in game. That's more than good enough to win. But 41 points, that's unacceptable. And so we wanted to tighten up. And the second and third, we had 42 in both those quarters.   Yeah, I mean, I couldn't finish. I had plenty of opportunities. LA had it going. And he's got over 20,000 points. You know, he can score the ball.  James, there have been a number of guys that kind of struggled with their shot a little bit and confidence from the shot. How have you communicated with them? Because Javon knocked them down. Tonight, other guys got it going. What communication been like as far as having guys to stick with it? Got to keep shooting. You got to keep shooting. Like, if you don't feel confidence in your shot, as in theory, you might as well be on the floor. So even, it's funny, because even this morning, I talked to Javon.  Yesterday, put up 500 shots today. 500 shots. He wants to just keep shooting. But I'm like, I got to carry over to the game. So I'm like, if you miss one shot, you know, don't be, don't put your head down. And he missed his first three. And they went, they went in the zone. He missed his, he missed his first three. And I think it was a time out after that. I said, keep shooting. I said, stick the landing and knock it down. And had confidence, know what's going to go in. Like, make sure it go in. And the next one he made. And just that confidence right there that, you know, that we need from each individual guy that's going to take us a long way. Before the game, Steve said he just wanted James to be James. But did you feel, you know, extra responsibility and kind of pressure, you know, with no KD out there tonight, out to kind of carry things and make it? I don't think it's never a pressure. I think just probably had to do a little bit more as far as being aggressive. And I had a lot of good looks as far as layups, floaters. That just didn't go in. But I think I had some pretty good shots. I think we did a really good job, especially from the second corner on of getting great shots. Defensively, we locked in.  Honestly, you know, James did a really good job. Obviously, LaMarca's no closing game out. Patty Dewey does. Blake, you know, finished well at the rim. So it just, it was a collective, you know, effort. You know, we knew we had guys out.  And it was a few of them. You mentioned James. I mean, what do you think about him, not just the way he played, but also kind of, you know, putting the ball on the floor, maybe doing some things he didn't, he doesn't usually do. Yeah. I mean, he brings a different dynamic to our team, that playmaking, that ball handling, dribbling at our shooters, finishing around the rim. You can do a little bit of everything. And he's going to be a key part, you know, of where we're trying to go. But tonight, he looked, he looked very.


In front of me today, I have 10 alternatives for you to buy at the drugstore that are every bit as good as the high end counterparts. I hope that you're going to love these as much as I do. Let's get into the cheaper and better makeup at the drugstore that you can buy today. Before we get started, I wanna go ahead and tell you that I will be listing my shirt and all of my jewelry along with the other makeup that I've worn today down in the description box. Sometimes you have to kind of scroll up down there and you'll find it. I also have my fingernails, which are some press-on fingernails down there so that you can see that. Everything should be listed and linked for you. Let's talk about a little bit of skincare and then we'll get into some great makeup. Now, I discovered this Lumiel. This is an exfoliant and it's glass skin liquid exfoliant, retexturizing, resurfacing, cellular renewal, exfoliant liquid glass skin. Now, what I love about this is it's so gentle. This is an AHA BHA product that just is going to really soften the dead skin and it's going to give you that new pretty skin shining through, which is where the glass skin comes from. It just seems to be a super refining toner. I love this and your skin looks so gorgeous after using it, I can't even begin to tell you. But this is, it's absolutely outrageous. I didn't get it sent to me, but it got talked up so much in the mature community over on TikTok that I watch, that I got sucked in and I wanted to try it any day as a beautiful, beautiful product. However, I do feel like one product that I get off of Amazon that is fraction, I think it's somewhere around $10. It might be a little bit more than that. This is from SOMBIME, this is a Korean skincare product. This is an AHA, BHA, PHA 30 day miracle, not mineral, miracle toner. It has really yummy ingredients like tea tree in it that make it so gentle on the skin. So this is noncommoda, comidagenic, I always get messed up on that, tested. Skin exfoliating ingredients, dual function cosmetic, low pH toner. This is gorgeous. This also has niacinamide in it, which is that beautiful brightener as well. And niacinamide can help sweep out the gunk out of your pores just like these acids can. Now what I feel like is that this does the same thing. When you put it on your skin, you're going to get that retexturizing, that resurfacing, that beautiful new skin is gonna come through. I feel like it does pretty much exactly the same thing as the Lumiel does. I love the Lumiel, but for the price, I would definitely go for the SOMBIME. This is just a beautiful, gentle exfoliant that will really show some pretty skin through. So that's my first one. The second skincare one comes from SK2 or SKII. I can never remember what it is, but this is a facial treatment essence from, I think it's called Petiera. Anyway, this is a gorgeous, gorgeous product. This has galactomyces in it, which is a fermentation process that really helps be an antioxidant, a brightener, a refiner of our skin. This has been loved by women for a very long time, but it's really expensive. I mean, I think this one is getting up there around $200. This one was sent to me, and I do love it. It does show those same results, but I will tell you that I went back and I repurchased, again, my secret key, first treatment essence. Look at the difference in the bottles. And the secret key is like, I think it's like $25 comparatively. And to me, there's like at least a third more in there, if not more than that. And what secret key is is it's this fantastic essence that is 95% galactomyces. Now, I would have to look up what the percentage of the SK2 is. I'm not exactly sure. But the fact that you can get something that has the 95% galactomyces and delivers, rightening the pore refining, the softens the wrinkles and lines, that's just fantastic that you can get something that is so much less expensive. So that's my second one. Third one is one that I actually don't have the other bottles here. So let me tell you what I'm talking about. I'm talking about two products, the Lancome Genophique and the Estee Lauder Night Repair. If you're a fan of either one of those, what those two, what those ingredients are in there, again, is a fermentation process. And it is Bifida. Bifida is a fantastic ingredient. Again, like the galactomyces that are in the secret key, it is that fermentation process that's the antioxidant, the softener of fine lines, the refiner of pore. It really does a lot for your aging skin. Bifida is a fantastic product that I have loved forever and been talking about on my channel forever. But those two that I'm talking about, there are hundreds and hundreds of dollars depending on what size bottle you get. But you can buy something like this from Misha. This is their Time Revolution Nighttime Ampule. And it's got the same products in there, except for better in that the Misha has more Bifida in it than the Estee Lauder or the Lancome Genophique. Now, the Bifida concentrations in something like the Misha are around 60%. I'll have to go back and look. I'll flash it up on the screen. But I do know that Genophique and the Night Repair from Estee Lauder, both of those only have around 10% Bifida in them. So why wouldn't we go for something that was not only cheaper, but it was actually higher in the amount of product that we're getting on our face that can really help us. So this is a wonderful buy this, not that, and save yourself a whole lot of money doing it. Okay, a hair care product. And I actually did just talk about this in a recent video, but I really find that this one is one that I want to shout from the rooftops. Because this is the Redken Acid Bonding Concentrate. This one is so much like the Olaplex Number 3. That's where all these companies came out with, their bonding products after Olaplex did. I do feel like you need that treatment or that extra conditioner treatment for your hair if you want to grow your hair, anything past about shoulder length. My hair's getting longer, and what's saving those last few inches, this is gonna save your last four inches of hair, is a bonding treatment. If you're not using a bonding treatment on your hair and it's longer, you're missing out because this can really just penetrate the hair shaft all the way down to the tip of the hair and just pull it all together and bond it together so that it's strong. And that's what this does, it makes your hair look sleeker, it makes it look healthier, and it's a beautiful product for anybody that is trying to make sure that their hair is as strong and healthy looking as it possibly can be. But if you don't wanna dull out how much that little bitty bottle of Olaplex 3 is, or that the Redkin one itself is $30, then you're gonna wanna look into something like this from L'Oreal. L'Oreal is the parent company of Redkin, and that's why I know that these products are almost identical. They can share their recipe, which is what I'm sure that most of these companies that put out high-end makeup do. You can get a drugstore alternative. This is the L'Oreal ever pure sulfate-free bond strengthening concentrate. And again, this is a perfecting and damage treatment for your hair. Now, let me tell you really quickly how I use this. I will wet my hair, well, it's dirty, I haven't washed it yet, wet my hair, put this in there, and leave it on in a twisty turby or in a towel for however long you can. The longer you can leave it on there, the more you're going to get a benefit from it. You have to have your hair wet though. That really is the key. When you're looking at the Olaplex product, I will say that you need to wash your hair, towel dry it, put this on, leave it on for the 20 minutes, and then wash it again. I don't mess with that. I've had a hairdresser tell me that you don't need to do that unless your hair is super oily or super coated down here on the ends, and mine's usually just super dry. This is definitely by this, not that, we're going to save you some money. One of my favorite, favorite primers of all time is the Tata Liquid Silky Canvas Primer. This is beautiful on my 55 year old skin. I use this underneath any makeup and it just makes my makeup look absolutely gorgeous. It plays so well with all makeup. And when I found this, I was just like, oh my gosh, I've fallen in love with my first primer ever. But then it was like, I cannot swallow that $95 price tag. And I bet this is even more now that COVID hit and all the prices are going through inflation. I bet this is even more. But as far as the most perfecting primer underneath makeup, I think that this probably hits the mark. So I have perpetually been on the hunt for the most beautiful, perfecting primer that doesn't have a ton of silicones and it still feels good on my dry skin and my mature skin. What I found and what I absolutely love is this Milani Skin Quench Hydrating Primer. What I love about the Milani is that this is hydrating at the same time of being that perfecting. I do think that the Tacha is a little bit hydrating but the Milani just, it sets itself off and it becomes a much better primer than the Tacha because of how hydrating it is. Now it's not that the hydration gets sticky or that it feels heavy on your skin at all. As a matter of fact, it just feels like the most skin quenching primer I've ever found. But as soon as it starts to sink in your skin and it will fairly quickly, as soon as it starts to sink into your skin you're gonna start to feel that perfecting of your skin and you're gonna start to see how gorgeous it is. It feels so much like the Tacha that I'm just shocked. The Tacha may be a tad bit lighter but when I'm looking for something, especially in the winter months, when you're wanting something that's just a little bit more hydrating, it's absolutely going to be the Milani. It just, can you see how perfecting that is? As I was getting this video together I realized that a couple of my very favorite things in the whole wide world are the Laura Mercier Shadow Sticks and the Sigma Shadow Sticks. Now if you have used either one of these, you know that shadow sticks are such an easy way to do a one and done look on yourself. You just put it on and take your fingers, buff it out a little bit. You have on a bulletproof look for the day. Both of these are matte but they can be blended very easily. The Laura Mercier is just a tiny bit easier to blend out and I think that's because the formula is just a tiny bit lighter and thinner than the Sigma but they're both really good and I could recommend both of them. And I really love the fact that they are so long wearing and that's really important to me when I'm looking for something as well because I don't know about you but if you ever get a hot flash, you know that you're eyelid sweat. My eyelid sweat all the time. And having a budge proof eyeshadow on is the ticket. But what I did find is this one on Amazon from Focalore. If you have never had any Focalore makeup, you're seriously missing out on some good stuff. This Focalore makeup is so creamy and yet at the same time, again, it's super duper blendable. I'm gonna blend this one out a ton so you can see. And then right next to it, I'll put a line that's a little more solid. So you can see how easily it blend out and that it was just this soft wash. The other thing that I really like about this is this particular color. This color is like the perfect neutral brown. And obviously in color, these aren't dupes at all. But in the matte formula and the long wear of the formula and how beautiful they blend out, the Focalore is definitely a buy this, not that alternative for you. Okay, this viral product right here from Laneige is their lip slipping mask. And I found this one, again, when I very first started my channel years and years and years ago. But I really found that even though I love the way that it made my lips feel, it didn't hang on all night long. It's a really pretty product. It's very hydrating, very moisturizing on your lips.  And that's really what I'm looking for with my dry lips is that I need a treatment to be there all night because when I wake up in the morning, I still want a little bit of extra hydration there. And this has skyrocketed in price as well because once everybody finds out that it's a product that everybody loves, then they hike their prices just a little bit on that. So Laneige I do love, but I feel like Elf did just every bit as good on their product as Laneige did. And I do feel like this one, maybe it's just that I feel like I can be liberal with it because it's not that expensive. But I do feel like this one is more hydrating. And I feel like in the morning, my lips feel soft and smooth. And I just love this lip mask. I think it's so pretty. So this is a definite by this, not that alternative as well. Now we all know that Smashbox bought up Becca when Becca went under, Becca Cosmetics went under. And we all know that Jacqueline Hill way back in the day, she developed this color called Champagne Pop. Well recently Smashbox just sent me Champagne Pop again and I was like, ooh, I remember why I love this. This is one of the smoothest, just it's the lightest feeling, gorgeous highlighter you have ever seen. It has this property of being this Champagne color, not too warm, not too cool. So you're not looking at an icy color and you're not looking at a color that's really super gold. You're just looking at a color that's right there in between. And I always wear my highlighters, if you've been with me, you know this, I wear my highlighters under my blush. So the fact that this just shows up highlight is absolutely gorgeous, but the fact that it's just a pretty color is gorgeous as well. And the formula is that smoothness without having any sort of glitter in it. I love Champagne Pop, loved it for years. As I was going through my highlighters, I realized that Rimmel has this highlight that's just called the Rimmel highlighter. And this one is in Stardust 001. This one is the identical color. It's probably just a little bit more of that highlighter effect on there. Maybe, maybe not. But it doesn't have any sort of pinpoints in it. There's no glitter in there at all. So you get it on your cheeks and I do have these on my cheeks today.  There's no texture shown up. Just one thing, remember when you're using highlighters if you have a problem with, you know, kind of showing texture, stay right here up on your cheekbone and stay away from this part right here. Cause this is where we have larger pores. Look how beautiful they look together. They're so pretty. And on your skin, you're going to have the most gorgeous, beautiful highlighter. And this one from Rimmel is just a few dollars compared to the 30 plus price tag of the Champagne Pop from Smash Pop. Now this one is really fun for me. This is It Cosmetics Brush for Ulta. I've had this brush for years. It is the loveliest powder brush. Oh my goodness. It's just a lovely, big, huge powder brush that I've used and used over again. It comes out absolutely beautiful and absolutely clean each time I wash it. I have loved this. It's great for putting powder on if you have mature skin cause you don't want to put too much powder on. You want to just put the right amount on and this is it. But I will tell you that the Elf Powder Brush, their Precision Powder Brush, look at the size. Oh God, just about the same size. This is every bit as nice a brush as the It Cosmetics. And this one is still, I think, 12 dollars. It might be up to 14 now. Whereas the It Cosmetics one is upwards of almost 40. I absolutely love this as a beautiful alternative to something that costs so much but you don't have to break your piggy bank. And lastly from House Labs is their Lip Crayon. I found this and I was like in love with it. And I don't know why I didn't make the connection sooner but I didn't. Now you can see how nice and creamy that goes on. It's one of those ones that just absolutely glides across your lips. It's so pretty. But it does kind of have a little bit of a matte to it. This color is called Moff Matte. And I really love it. It's really a beautiful color. It's one of those that I just reached for with every look just because it was like going with browns or grays or whatever I was going for at the moment it seemed to be going with. But then I was in my makeup drawer and you know, you forget about the things that you really love and you looked over and over again and the Maybelline Lip Crayon, the Ink Lip Crayons, excuse me, how many times do we go back to this as being the standard for all of those other ones? And this color, every bit as good. Almost identical. I love these. They're gorgeous. They're so identical in the way that they go on. You can line your lips with them. You can fill in your lips, whatever you want. I have several of the colors of the Maybelline one. And I was thinking about going back and getting the House Labs one, but now I'm absolutely not going to because the one from Maybelline is every bit as good and identical to it. It is so close. This one from Maybelline is the one I have on and I have a lip gloss on over top of it.  I did outline, fill in the whole entire thing with this. I really do love it. And I feel like it's every bit as nice and wonderful as the House Labs. I would highly recommend that if you've been thinking about getting something like this from House Labs, that you look around because unless you're looking at the Tricone Foundation, I've been through all of their stuff and there isn't anything in there that I can't look at and go, oh my goodness, I can do that at the drugstore for pennies on the dollar comparatively. So Maybelline for the win again. All right, that's it for the Buy This, not that cheaper and better at the drugstore. I hope that you did enjoy seeing all of these. If you have any sort of dupes that you have been looking at that you would like me to try, let me know down in the comment section. I love to hear those suggestions from you and I usually run right out and buy it. So let me know and we will try it out here on the channel. Thanks so much for spending this part of your day with me. I hope that you're all doing really well and I hope that you come back around to see me in my very next video. Take care of yourselves, love you, bye-bye.