Hello, everyone. Welcome. Good afternoon. Thanks for coming. Thanks to DevCon for having me. My name is Jeremy Duro. Today I'm going to present to you guys on two different variants of an attack that I made for the USB rubber ducky. What we got here? One minute. Or is that just their screen? Are these screens screwed up too? I know just that one. Alright, cool. Alright, so we made two different payloads for the USB rubber ducky that will decrypt the Wi-Fi communications. Yeah, so before we get started though, quick disclaimer. I'm here on my own behalf. It's my own opinions. Not my employer, no one else. So we get the legal jargon out of the way. Oh, so what are we doing here? There we go. Sorry guys. Alright, so about me. A little bit of background. We're more than a decade of experience in the IT security industry. In those 10 years plus I've worked for a couple different sectors. I started my career out with the Department of Defense working for the Army at a data center hosting both class and unclass material. Left out of there to go work in the energy sector defending a nuclear power facility. And then currently I'm working in the financial sector as a network security engineer for Gemworth Financial. And just a little side note there, a little fun fact. I'm a hobby. I enjoy building, driving and destroying demolition derby cars. So if there's any gear heads in the audience, feel free to find me afterwards. We'll talk cars. So the presentation outline, what we're going to talk about. From a high level we're going to first talk about what is the USB rubber ducky for those who are not familiar. Then we're going to talk about how the attack actually works. And then we're going to get into the details of each of the different payloads. So we'll first talk about the keyboard payload. And then we'll talk about the one that involves both keyboard and USB mass storage. I'll demo the second variant of the attack. And if we have any time for questions, maybe we'll take some questions, but it's probably going to take the full time. All right, so again, those are not familiar with the rubber ducky in a simple description of what it is. Think about if you were able to take a keyboard and apply some type of logic or some type of memory to it to tell it what to send to a victim's machine when you plug it in, and you ultimately have the USB rubber ducky. So these devices are sold by hack 5. Those are not familiar. They're actually selling products here. Run by and support them. Really good group of guys. I think they're like 40 bucks or a little better than 40 bucks. So it's pretty cheap. So here's what the rubber ducky looks like. You'll notice that it is a very common form factor. So notice there on the far right for you guys. You know, if you've been to any of the trade shows, like any of the IT security stuff, typically as vendors hand out swag, a lot of times it will be that's the actual form factor.  You probably have one that looks very similar to that. Inside the enclosure, you'll see that it has a micro SD card storage area, as well as a little microprocessor, a little 32 bit chip. And again, that's what kind of drives the memory part of the brain from that previous slide. And to kind of talk about the different ways that the ducky behaves, it comes shipped with the duck firmware, which is that kind of first bullet there. And again, that is just keyboard input.  But make note of that last variant of the firmware as well. That involves having both USB mass storage at your disposal when you plug the device in as well as programmable keyboard. So a lot of powerful things can be done once you start adding mass to origin. We'll see that in a demo later. But for those that are like, you know, thinking, well, this must be a hack five presentation. He's trying to pedal their products. You don't have to go with the hack five rubber ducky. There's other options out there. Sammy Camcar, he's actually here, spoke to him last night. So he's got a presentation later today. I recommend you guys support him. Really smart guy. But he developed the USB drive-by. So he does the same kind of mentality with the teensy device. So check his stuff out if you don't want to spring for the 40-some-odd dollars for the rubber ducky. As well as last year at Black Hat, Carson Noll and Jacob Lul did the bad USB. Those that are familiar with that term. And then later at DerbyCon, Adam called on Brandon Wilson and released code so that you can take an off-the-shelf variant of a flash drive, flash their firmware to it and more or less it will run the same script in language that the rubber ducky run. So that's more or less free if you have those flash drives laying around. All right, so how this attack works. This slide just depicts the victim having a wireless connection to the little radio there and you see the lock. So any SSL connections they have are working as they should. Everything's encrypted. Anything that they're supposed to be encrypted is encrypted. It's the standard connection before the attack. Then comes the rubber ducky. If the rubber ducky was, the USB flash drive was plugged in. First thing that's going to happen is there's going to be a trusted certificate that's loaded on that victim's machine. After the trusted certificate is loaded, it will then move the wireless connection over to a man in the middle machine, which I will be running. If you think about this in your head, what just happened, not only are we now man in the middle, but since we provided that key, there's nothing that can encrypt. It's kind of a bad situation for that victim. First question I had when I bought it was, is this a novelty device? It's great to rick roll your buddies with it. That's cool. But does this thing really have a place in the corporate environment for say a real CT, an actual pen test? Or is this a real useful tool for a black hat for that matter? I was kind of astounded to see these numbers. You may have heard these before, but DHS had the same thought.  Well, that's scary enough, but then if you look at the last bullet there, if they had an official logo to it, that number jumped 90%. So the moral of the story here is that you really don't need any clever social engineering for this attack to work. I mean, if someone really wanted to be bad and do this attack, for $400, you've got 10 of them, someone's going to plug it in, your odds are pretty good. And speaking of official logo, if you recall the form factor of what the Rubber Ducky ships, this is just a quick Google search of marketing USB drive or something. Ta-da! First one came up, the exact same form factor that the Rubber Ducky ships in. For a couple bucks, you can put whatever logo you want on your Rubber Ducky because it's just a little shield there that connects to it. And you're up to your 90% mark according to a DHS study. So pretty useful stuff. I kind of want to talk about now why I actually made this payload. You know, there's plenty of good ones already out there. The Rubber Ducky is nothing new. The product's been out there for a while now. And Darren, the guy that runs Hack 5, has a, his GitHub is just full of really good payloads that people have written. But what I found is that most of those, if not all of them would be stopped by the modern defenses that are deployed in most enterprise organizations.  And the first one I'll touch on there is antivirus. So a lot of the payloads that are out there will try to pull down a tool of some type. Whether it be, you know, Netcat or try to do some interpreter reverse shell, what have you. Well, you know that's cool and all, but if you pull those down on a company asset, you know, your antivirus is going to light up like a Christmas tree and it's going to stop it in its tracks. I mean, it's too well known at this point. The next bullet there, web filters and proxies. So some of the other attacks, what they'll do is they'll try to make you go out to some open storage place, you know, Dropbox or Box or something like that. Well, most organizations, at least if they're, you know, more of a secure side of things, are going to block those style sites. They're not going to let you go to just any open storage to pull down any random file you want. So that's going to be stopped. Same kind of mentality below with the FTP whitelist. Some of the attacks try to pull down files through FTP. Again, most companies, if they're at the level of any security knowledge at all, they're not going to just allow you to FTP anywhere from any asset in the organization. And then the last bullet there is has nothing to do with corporate security. I'm sure most of you guys are familiar with HSTS, but those that are not, it's kind of a tool that was designed just to stop this style attack. So the old school way of doing man in the middle attacks would be, you know, once you got in the middle of the communication path, you would tell the victim, you know, just go ahead and talk to me in clear text. You know, trust me. Talk clear text to me.  Well, I'm telling you to go ahead and load it in HTTP so I can harvest the credentials. And then on the side that's talking to the real banking website you would talk encrypted. And it worked well for a while until things like HSTS came along, which is an actual browser-based security mechanism. It says if you're a member or you're on this list of HSTS-enabled sites, no matter what the man in the middle machine tells you, you must always use encrypted traffic. And that becomes a problem because it kind of thwarts the way that the old school way of attacking took place. And again, all your big sites are doing that.  Even DEF CON implemented this year. So I guess DEF CON has got some super-secret information they don't want someone to get. So let's talk the attack. Enough kind of pre-talk. So the first step is to actually set the man in the middle machine up. Because you have to have something for the victim to connect to. Right? So this is not the focus attack so I'm going to kind of breeze through this stuff. Just to give you an idea of what I used when I set up the demo you're going to see in a minute. I used host APD for the wireless radio. I used DNS mask for the DNS server as well as the DHCP server. IP tables to kind of direct the traffic over to a proxy. And I mentioned the man in the toolkit. So those guys actually have developed some really cool scripts that I used to kind of just adjust their stuff to make it work the way I wanted it. So I mentioned proxies. There's IP tables that move stuff over to a proxy. So you got to think about it. Once you get the connections coming into your man in the middle machine and you've got the radio, it's listening, people are connecting to you. You have to have some way to manipulate the traffic or at least use the traffic. I mean what's the point of sending it through you if you can't do anything with it. So you're going to have to set up some type of proxy. In my example I use Burp Suite. It doesn't mean you have to use Burp Suite. It's just easiest in my opinion. You can use self-strip, squid, mallet, whatever. I do make note here that whatever proxy you want to use for this type of attack, make sure you know how to pull the certificate out, the actual sign in the authority it's using. Because we're going to have to convert that certificate to a base 64 encoding. And I'll get into that in a little bit. So for those that are not familiar with Burp Suite, I'm sure most of you have at least seen it. The configuration I'm using today is very, very simple. I've just got it listening on. All interfaces just picked around the 880 port. And you'll see there that invisible box as they call it is checked. But industry, that's a transparent mode proxy is all it's doing. And I mentioned you had to export your certificate. Well, that's what the little radio, I mean the little button below that there. C8 certificate you click there and you'll kind of go through some dialogue boxes to export the certificate. And when you do that it's going to come out in a Dura formatting. So again this is not a talk about certificates but at least I want to touch on this. The certificate, if it's in Dura formatting, you'll notice that top window there. That's text that I can't enter by keyboard. So I want you to make sure I convert that certificate to something that my ducky can type in easily. So use an open SSL, convert that Dura formatting to a pen formatting to the base 64 encoding. And if it's done right you should look something like in that bottom window. So it's human readable. All letters and numbers. So now we have man in the middle machine. So let's talk about the payload itself that's going to be sent to the victim. So what it's going to first do, it's going to bypass the windows UAC and open a command prompt window. If the user is logged in with admin credentials, it's going to get admin credentials. If they're logged in as user credentials, they're just going to get user credentials. And the test I'm doing today I'm actually have admin creds but I will make note that this will work with user credentials without admin creds. It's just going to have a few extra pop-up boxes along the way. The second step it's going to do is create that cert file so you're going to create a certificate from keyboard input. The same certificate we exported a few minutes ago. Then it's going to add that certificate to the trusted root store using the built-in tool cert util. Then it will create a new wireless profile and then connect to that wireless profile. And then lastly it's going to clean up its tracks. So it's going to delete the files that it made in the process. Alright so before we actually look at the code I kind of wanted to let everyone at least understand how simple this thing is to really write. So DefCon gave me a lot of credit by making me talk to you guys but really it's pretty simple stuff. Again, very straightforward. Delay, delay in millisecond. String, what you're actually typing into the machine, what you activate the payload.  And any question on that, the github that Darren keeps up has pretty much all the documentation needed to any of the commands here that it supports. Alright, so here it actually is the first step in the payload. Kind of broken it out here a little bit. So you'll see how the code kind of works. Delays 10,000 so that's 10,000 milliseconds. That's 10 seconds. And the idea behind that is when you plug the device into a machine the first time you're going to see windows spin in there with the drivers low drivers, low drivers, low drivers. Hopefully it's done in 10 seconds and then it's going to enter the issue of GUI R command. Those are not familiar with GUI R. That's going to open a run dialog box. And it's going to delay 200 milliseconds to allow time for that box to pop up. And then it's going to type a little PowerShell command, start process command verb run as. All that does is open the dialog box. It's in admin credentials if possible. And a little side note here. You'll see now I put a little side note that windows 10 and this is as well as 8. You don't have to do that PowerShell command for those that got the windows 10 and 8 thing. If you just do GUI X and then type a, it opens up an admin command prompt. A little side note. So next up is we're going to have to create that certificate on the victims machine with keyboard input. And the way we're going to do that is we're going to use a built-in tool windows called copycon. Those that are not familiar with copycon, it's copycon file name and anything below is concatenated to the file. You break out of it and now you have a certificate. And I had to put the obligatory picture of the hacker in the presentation. But I noticed earlier when I was going on my slides, this poor guy was having a hard time typing because he's got big, thick winter gloves on. So I don't know. That's what Google search for hacker. Anyway. So we're going to use, in my opinion, is the climax of the attack. So this is the part where it's actually doing bad things. Cert. Util. Add store. Enterprise. So that's added to the machine root store. It's adding that certificate we just created. So if this command succeeds, game over. Lastly, we're going to create an XML file. And again, those are not familiar. Windows with handles, wireless profiles, just a little XML file. So we create an XML file and then we, after we create it, we then connect to it with netsh command. Again, pretty straightforward stuff. And lastly, we'll just delete those XML file and that certificate file we created. All right. So here is what it looks like from the attackers machine. Right. So this is, again, Burp Suite. We're looking at the proxy kind of view there. And I've kind of highlighted there. We're typically going to be interested in post commands. So I've kind of looked at a post command there to Wells Fargo. I'm not picking on Wells Fargo. So hopefully you don't sue me. But any bank would work. And you'll see it under the bottom of the details. You've got user ID and password. Clear text. Right. So that poor person's bank was just compromised. And alternatively, this is what it looks like from the victim's point of view. There have been no pop-ups, no warnings, no errors, no issues, no indication there was anything wrong. And I've even kind of opened up the certificate details to show that this certificate was signed by, you probably can't read that, but it's issued by Portswigger. Those are not familiar Portswiggers company that actually writes Burp Suite. So they put their name in the certificate. But yeah. So really bad day. Internet Explorer got the best of them. But I'm sure some of you in the crowd are like, well, I don't ever use Internet Explorer. I'm cool. I use Chrome. So there's no way you'd get me. Well, here's Chrome. Same deal. Look at their credential. I mean, look at the certificate details. You'll also see signed by Portswigger. And again, same story. No pop-ups, no warnings, no errors, no issues. There's no point transparent to the user. There's no way by at least the certificate anyway you'd ever be able to know something bad had happened. All right. So again, they have no one bunny in their bank account. All right. Firefox though. How about Firefox? The special snowflake that Firefox is. Yeah, yeah. Yeah, clap. Yeah. It was a bad day for me. So I'm glad y'all think it's funny. Yeah. So Firefox. And I'm sure some of you know already why this is the case. So Firefox decided they're not going to trust Windows, Keystore and Trustdoor. That they're going to implement their own Keystore and Trustdoor. So those commands that I issued earlier with AssertUtil, that's all for the Windows certificates. NSS, Labs has the tool you can download to actually manipulate Firefox certs because they have their own Keystore, Trustdoor. But it's not installed on a typical distribution. Therefore it would be very hard to use on a victim's machine. So I kind of banged my head against the wall for a while and you know, my face looked a lot like that image there for quite a bit. Trying to figure out how in the world to get this to work. And I just couldn't come up with anything clever. So that kind of brings me up to the next variant of the attack, the TwinDuck that I referred to earlier. So TwinDuck Firmware, again, just a recap, it mounts both a USB mass storage device as well as that same programmable keyboard mentality we just had before. So to use the TwinDuck firmware, obviously you're going to have to reflash the device. Not a big deal. The other thing is that the other devices are out there how to do that very straightforward. And I will make one little side note here that if you're planning on making some attacks using the TwinDuck firmware, it's not really designed for really fast IOs.  Just a quick side note there. So let's start this attack. What's different this time? We have to set it up. First steps are to create a new Firefox key store trust store and the easiest way to do that is go ahead and infect your own browser. So go ahead and open your own Firefox up and take that certificate that you just exported from your proxy, load it into your own browser. And I've kind of listed here how to do that, I'm sure you all know, but go ahead and click trust the certificate identities from that website. So that way port Twitter can sign anything through Firefox. Okay. After you do that, then you're going to pull your key store and trust store and copy it over to your microSD card. And it's located in the path there listed on the screen. And that variable works for pretty much any basic install. You'll see it uses variables as well as a wildcard.default because it's going to give it some crazy number string.default. So that path right there, if you just would enter that into your machine right now, it would go to your Firefox profile. And you're going to get those two files that are listed in the bottom. You're going to get the key3db and the cert8db, that's your key store and your trust store for Firefox profiles. Alright, so again, from a high level, how does this attack center work now? We've done the pre-work to set it all up. Same as before, it's going to open a command prompt with admin creds if it can get admin creds. It's going to then, this time, a little bit different, it's going to create a script to identify if that master was mapped. Alright, so again, we've got to think about this. We're going to it blind. We don't know what's going to be on the machine once it's plugged in. So it could be mapped to eDrive, fDrive, you know, who knows. So a little script try to find where the Ducky U.S.E. master is located. Then it will create another script, a little VBS script that will run a batch file invisibly. And when I say invisibly, it's just running the background. And the idea behind that is it's quicker to write a script on the screen because it's all done with keyboard input than it is to run the whole, write the whole batch file out. And it just gives you a little less time that text is kind of scrolling across the screen. But what that batch file is going to do, it's going to first add, just like before, it's going to add the Windows Trusted Root certificate. It's going to then overwrite the user's Firefox search and key store. And then it's going to create a new wireless profile, connect to it, clean up. So here's what that batch file looks like just for those that are looking for the code part of the talk. You'll see here, we obviously kill Firefox, we don't want to do anything while it's running. Same commands, add it to the Windows enterprise store, the machine store. And then you'll see that it overwrites the Firefox profiles. And as a quick view, here's what the MicroSD card looks like on my device, I'm going to do a demo. You'll see the XML file, which is the wireless profile. You'll see the cert file, which is what we load the Windows. You'll see the certain key files for Firefox, as well as the batch file we just looked at. So there's the files that are needed to run in the TwinDuck mode. So again, we'll go back to looking at what it looks like from the user's point of view or the victim's point of view. There's the Internet Explorer. Yeah, got them. Chrome, same story, no more money in their bank account. Firefox, yay Firefox.  So you'll see it's also been signed by Portswigger. We got them. Again, because we loaded those trusted certificates into their own key store and trust store. So at this point, I more or less consider the attack successful. We've got all three modern browsers and yeah, they've all been puns. So with that being said, thank you, thank you. So we'll kind of dive into the demonstration now. I kind of want to set this up so it makes somewhat of sense because I obviously don't have a nice environment here to have someone over there getting attacked and show you guys what's going to happen is hopefully no one in the crowd be that guy that tries to mess up my SSID please. If you do whatever, I've got a video but I'd rather do it live. So please don't screw with it. There's going to be the Windows machine which I'm presenting from, that's going to be the victim. So you'll see Windows machines where I'll actually apply the rubber ducky payload but there's going to be a Cali Linux box that's going to have a Davian background to kind of represent which is which. It'll be a Davian background VM that has, I've got a bunch of like USB connections up here, I can't really show you but I've got a USB connection into a hard wire out to the internet as well as a wireless radio that is going to be hosting the SSID from the VM. And when the payload is deployed, hopefully the built in wireless on the Windows machine will connect to that wireless radio. So it's all kind of M1 but it should depict what the attack would look like. Alright, so let's do that now without further ado. So that's what the Windows machine is going to look like. I'm going to change it so you can clone the machines again. You should be able to see my desktop now. Alright, so here's going to be the victim and let's go ahead and pull up super secret password. So before I actually get started, my resolution is all whacked out now but this is the script that I was talking about, the MANA toolkit that I kind of modified. So again for anyone that wants to take note, it's using host APD again, using DNS mask and then using some IP tables to redirect traffic. Alright, so let's actually do that. Let's kick that off. Actually before I kick it off, let me show you again here's the, I've already got BurpSuite up and running so it's just listening on any interface on port 8080 and it's in transparent mode and there's where again where you would go to export those certificates. Alright, so let's go ahead and run that script hit enter to kill me, that's a little brutal. Okay, so at this point what I should see if I were to look, yep, alright there's SSIDBM broadcasting. It's actually trying to connect to it. I'll disconnect from it once it just approved that this does work but so let's disconnect from that. So now again, what I'm going to do is I'm going to restart the payload. So this would be an indicative of me plugging in.  Alright 10 seconds, this is where drivers would be loaded but I already had the drivers on the machine. The payload has now started and it's now done. So that's how long it takes to do its magic. Alright, so there you'll see now it's connecting like it's supposed to be doing. It just takes a little bit. Alright, so you guys are being nice to me not kicking me off there. Appreciate that. So what we're going to do is now we're going to and again you guys already probably know damage is going to be done now that I've got this connection in this shape but just for grams over to a Facebook account that I created just for this presentation here so please don't own my Facebook account. Alright, and then we'll also go again poor Wells Fargo. I could use any other bank but they're not my bank so that's what I chose them. Alright, so let's go for Defcon user and some super secret password login. I hope to god this is no one's password that would be awful. Let's see here. Alright, no, obviously it didn't work. Okay, perfect. So let's kill out of that. Let's just demonstrate. Here we go. Okay, we got some data so the attack is working as we would expect. So let's first look at Wells Fargo. You'll see like I had in the slides. There's the authentication packet. You'll see the post, the off log on. And I'm just going to hear the parameters and I'll scroll a little bit. I hope you can see that. Defcon user, password d3fcon23 so yeah, let's go ahead and transfer all the money out of that account. Got them. Alright, thank you.  Good luck getting that password now. You messed the presentation up because it was one of those little collect box leave me always logged in which I think we all kind of know what that means is using authentication cookies. That actually may be even worse because any of the Facebooks, anyone who knows anything about Facebook and how they do their authentication cookies let's see here, drag it up so you can see it a little bit better. But like every packet that you ever send to Facebook you'll see this DATR cookie. That's your authentication cookie. So every time you do anything in Facebook it just sends it over and over and over. So I can click on pretty much any of these posts and you'll see, yeah look there it is again. And there it is again. So what we'll do is we're going to go ahead and say let me just have those cookies for a minute.  I'm not logged in. Yeah, see I just refreshed. No one's logged in here. But with the help of a little tool for those that are familiar with grease monkeys is a scripting tool. And I've got the cookie injector script loaded. If I go in here to let's go ahead and take those cookies I just stole and paste them in. Well thank you. Alright. So now we have hijacked the session. Got you. Right? Thank you. So and again the point being there is it's not that Facebook's really your end goal and your attacks but there's so many sites now that are using the authentication cookies. I think that Facebook kind of just drives the point home that anywhere it uses the authentication cookies or passwords really doesn't matter. Once you're encrypted in traffic it's the date is yours. Alright so let's go back to the presentation. I think it's going to see here. Wait for it. Wait for it. Got it. Alright. So now since like I told you guys at the beginning I'm not a fancester. I'm not a security researcher. I am a security engineer. So I am paid to defend against these attacks and not create them. So it's only fair and responsible thing that I talk about is how to stop this kind of attack. Alright so the first bullet I want to touch on here is wireless intrusion prevention systems so WIPS systems. Those are not familiar with those. They're very powerful but this style of attack would not work because as soon as I'd spin up that rogue AP it would start flooding me with DL packets and it just wouldn't work. So if your organization employs some type of WIPS environment you'd have to find some other mechanism to get into traffic to you other than through wireless. Disable mass storage devices. This is becoming more common just because of these I guess there's lots of style attacks. Not to mention DLP concerns. People are starting to disable mass storage but that's also kind of a bummer if you're trying to do that second variant of the attack because if you don't have mass storage available you can't get all three browsers at least the way that I did the payload. And take that kind of mentality a little step further a little more extreme. Some companies even disable USB ports entirely. That would certainly limit the attack because none of the USB style attacks should work if you wanted to turn on. And then this slide I mean this bullet I put it in there. Frankly that bullet could be in any DEF CON talk given this weekend and user training can always be encouraged to be more responsible with X. Just today it's USB usage because that's what I'm talking about. So yeah you can always use more user training to encourage responsible use of technology. Multi-factor authentication Yeah so if I was able to pull this attack off on you and you're using some kind of one time use password or some token based password it's going to be very difficult for me to reuse that credential. So yeah that's another check in the box for why you should use multi-factor authentication. And the last one here it may not be quite so obvious but those familiar with cloud proxy agents a lot of organizations are now starting to deploy them. So on all the corporate assets what that does is it requires the company asset to talk directly out to a cloud resource for their proxy exceptions. And typically it has some type of authentication mechanism built into that. So if I got mental that communication it would probably just break. It just wouldn't allow you to go anywhere. It would encrypt anything because it would have broken your connection. So a couple other things here to consider I use wireless as the mechanism of getting the data to me but that certainly doesn't have to be what you use. You could set up like a proxy that lists it out in the cloud and instead of changing wireless settings you could go in and say let's monkey with some of the proxy settings to have it no matter if it's hardwired, wireless whatever you always connect out to like say AWS proxy listener and you could have the same kind of attack take place. And the benefits there is one again hardwired or wireless but you also don't have to be in physical proximity. So you could deploy this thing and then no matter where they went it would be connected out to like a cloud listener. And you could also increase the authenticity. And what I mean by that is again I made this as just a proof of concept that the files are labeled what they are. You could certainly label them more suspicious things that people would be trying to really click in. Like if I was trying to get more authentic I'd probably put in a file that says like salaries or something and I'd corrupt it so they keep trying to open it. Just about anymore time of that screen before they thought something was fishy. As well as we talked about putting a label on the device you could print out whatever label you were trying to attack so company X put that label on it. Another note here that the syntax will need to be adjusted slightly for whatever your victim base would be. And the reason I say that is certain OS's are going to have different dialog boxes pop up at different times, warnings pop up at different times. As well as timers. So if your timers are on like a try to get it very aggressive on your timers on when things work and you play it into a really slow old machine the timers may not work out right and it'll break the whole attack. So you gotta really play with the timer, play with the syntax but the attack should work pretty much regardless of any version of Windows. And just a quick little shout out for the guys at hack 5. They have a forum out there for people to share collaborate, new payloads, it's a pretty active community so if you're thinking about doing this style of attack or you're looking at new ways to get in this kind of thing I recommend you go check them out because that's where I got a lot of ideas and some of the code that I use for my attack. And with that I'll finish here with please any questions you have email me. I'm not going to try to do the question thing here in this forum it's just too many people. But feel free to get any questions, find me out in the public areas and with that thank you guys all for your attention, I appreciate it.


you have any doubts, this you have not done EMI yet, no doubts, okay, so next we will do is AC generator, AC generator is a device that converts magnetism into electricity, fine, so it is a very useful device like what we discussed last class it is very easy to generate magnetic field, you can you know have a huge amount of magnetic field and if you have a device that converts magnetism into electricity that is like one of the greatest invention of all and this is that one of that invention, okay, so the construction of this AC generator is something like this, you might have seen this in class 10 also, it is North Pole, South Pole, you know right the coil will rotate and you have North and South poles which suppose creates a uniform magnet, it will be fine, a uniform magnet will be created, this coil can rotate with omega angular speed, its area is A, fine, right now the coil is kept like this, getting it, coil is like this, find out the flux through the coil, how much it is, I would have drawn while I was drawing it, why you waited for me, how much is the flux, BA, BA right, the area is like this, magnetic field is crossing this area, so B into A and if this has number of turns as capital N, the total flux will be N, B into A, this is initially but this coil is rotating, suppose this coil rotates little bit, after time t how much it is a rotation, theta will be omega t, right, so angle between area and magnetic field will become how much after time t, omega t, right now it is 0, so that is what V dot A is NVA, after time t it becomes omega t angle, so the flux will become NVA cos of omega t, right, so EMF will be what, minus of d phi by d t, this is equal to NDA omega sin omega t, so you are not changing magnetic field, you are not changing area of the coil, what you are doing, you are changing only angle between area and the magnetic field and you are able to generate EMF out of it, so the current through this coil will be E by R, this is the resistance, this NB A into omega is magnitude of the voltage that is created, can you draw with time the value of flux, how it will vary, this is flux, N is constant, B is constant, it is a cos graph with time, how the cos graph looks like, it will be like this, this is how flux varies, how the EMF will vary, it is a sin graph, so it goes like this, so when flux is maximum EMF is minimum and when EMF is maximum flux is minimum, this is just a basic introduction of AC generator, this actually tells you that you do not need to vary only magnetic field or area, you can change the angle also and you will be able to generate the EMF, right, so let us start the next topic, this is inductance, have you heard of inductance before, have you heard of inductance, what comes to your mind when you hear inductance, capacitor is used to store what, capacitor is used to do what, store charges and electrostatic energy, inductor or inductance is a device to store magnetic energy, right, right down inductor or inductance stores the magnetic energy, now you have found out capacitance like how, you assume that capacitor is given a charge Q and whatever is the potential difference, if you can write in terms of, if you write this equation Q is equal to some constant into V then this constant of proportionality becomes the capacitance, fine, this is how you quantify the capacity of the capacitor, you supply the charge and look at what is the potential difference, if potential difference is high, it means that its capacity is less, it is like you take a bucket, you pour 1 liter of water, if high difference is very high, it immediately picks the height, it means capacity is less, similarly capacitance, you put the charge in it, if potential difference rises to a larger degree, the capacity should be less, reading it, so without increasing its potential to a large degree, it is able to store a lot of charge, that is what capacitance actually means and it is nothing but a constant capacitance, fine, so capacitance also in a way tells you that how much energy you can store, fine, now when it comes to magnetic energy inductance, what is the cause of the magnetic energy, the basic cause of magnetic energy or magnetism, what it is, a dipole, a dipole, right and the basic, the most basic dipole is electron revolving in the orbit, fine and counterpart of that in real life is a loop, okay. Fine or you can just say a current is the cause of magnetism, fine, so suppose you supply current I to any structure, fine and it gives away some magnetic flux, okay in the loop, okay, then the constant of proportionality here, this is inductance, if you have to supply less amount of current to get huge amount of flux, it means that capacity is large, you are able to generate lot of magnetic energy with less current, fine, so it is, I mean there is no other logic other than this that you know that, okay, current can be the cause of magnetic energy and flux can be the effect of magnetic energy, it can denote the cause of magnetic energy, so just like that I mean the constant of proportionality between the flux and the current is assumed to be inductance, fine, now once we have studied the capacitance, this is the generate definition of capacitance, whatever structure you put the charge cube measure the potential constant of proportionality is capacitance, after that what we did, we found out capacitance of some basic structures and the first one was parallel plate capacitor, fine, so now we have definition of inductance, we will try to find out inductance of few basic things, are you getting it, so but then the way this inductance is defined, it can be slightly different from the way capacitance is defined because the flux in one coil can be give to its own current and can also be given because of the adjacent current, is it not, you have a coil like this and another coil like that, if this coil has a current even this coil will have flux, this coil does not have a current in it, getting it, so without having current this coil can have flux, so this current may not be of the coil itself, fine, so the inductance is defined in two ways, one is self inductance, when you define the self inductance, you measure the flux in the first coil in terms of current in that coil itself and you call that as self inductance, you represent it by L, this is self inductance definition, when the flux is because of its own current, then you say that is due to its self inductance, getting it, but if you see that there can be flux because of let us say adjacent current or I2, so this I2 is able to create magnetic energy on the first coil, second coil current is creating magnetic energy on the first coil, fine, so the concept of proportionality is called mutual inductance, this is mutual inductance, fine and mutual inductance, how many mutual inductances are possible, can be as many, right, because this one coil, this can have flux because of all the adjacent coils, so between this and this there will be a mutual inductance between that and this there will be mutual inductance between this and 2, between 5 and 2, between 6 and 2, between 7 and 2, so every pair has a mutual inductance, even these two have mutual inductance, but right now my focus is this with respect to every other thing, fine, so when you try to write down the total flux in the coil, you can write it like this, L into I1 plus M12 into I2 plus M13 into I3 and so on, in our syllabus we will be dealing mostly with just 2 coils, so you will have LI1 plus M12 I2, what if I find out this flux in the second coil because of the current in the first coil, you will get M21, getting it, these 2 will be same, flux in the second coil due to the current in the first coil, this constant of course will be same as this one, mutual inductance will be same, whether you find flux due to the first on the second or flux due to the second on the first, the mutual inductance will be same, sorry, yeah, mutual inductance will be same, self inductance will be different, self inductance is its own property, mutual inductance is the mutual property, fine, so now we will try to find out self inductance and mutual inductance is of some, you know, routine geometry, just like capacitance depends on only its geometry shape and size, similarly inductance also depends on its geometry shape and size.


Welcome to the Addiction Counselor Exam Review. This presentation is part of the Addiction Counselor Certification Training. Go to https.www.allceus.com slash certificate-tracks to learn more about our specialty certificates starting at $149. Hi everybody and welcome to your review of diagnosis. Now, this is again going to be a really high-level overview of diagnosis for substance abuse and mental health issues. If you're looking for something more in-depth, we do have other diagnosis courses at allceus.com. But this one is just to hit the highlight, so you're going through and going, yeah, I know that. Yeah, I know that. It's what I'm hoping. We'll review the criteria for substance use disorder, discuss substance-induced disorders, and learn mnemonics to help you identify signs of intoxication and withdrawal, as well as signs of mental health issues. So, the DSM is created to facilitate communication between and within professions regarding mental health and substance use disorders. You got to remember that a DSM diagnosis, like depression, for example, says you have to have a certain number of the symptoms in order to meet diagnostic criteria. But those symptoms can show up in any one of like 144 different permutations. So, it's important to remember that not every person's depression is going to look like every other person's depression, nor is it going to necessarily be caused by the same thing. You can have depression because of not enough serotonin. You can have depression because of not enough, not enough norepinephrine, not enough dopamine. There's a whole bunch of stuff. I mean, we do know that moods are affected by our levels of neurotransmitters, but then you back up a step and you go, what is causing that imbalance in neurotransmitters? Is it organic? The brain just can't make enough? Or is it something like the person isn't getting enough nutrition, or is under too much stress, or is not sleeping enough? So, it's important to recognize that the DSM and diagnoses in general are just shorthand, and they're necessary for billing and that kind of stuff, but you don't wanna assume you know what's going on with the client when you read the word depression or substance use disorder. It improves inter-rater reliability regarding diagnosis because it says you have to have, for example, six out of the following nine symptoms. So, you're not gonna have Jim Bob over here who wants to find a label of diagnosis for everybody, and Sally over here who says no, you have to have all nine symptoms. You know, the DSM says any six of these nine, so it improves the reliability. So, if you see a client, and I had this happen a lot of times when I worked in community mental health, where clients would come back for another episode of treatment, and I would be reassessing them, and you know, you really want, if the first therapist diagnosed them with bipolar disorder, for example, the second therapist needs to be able to see those same symptoms and see how that therapist arrived at their diagnosis. So, the DSM helps with that, and it improves sharing of information about client presentation and needs because it ensures we really look at all of the quote symptoms, so to speak, and the DSM goes into great detail about differential diagnosis. So, it helps us figure out what biopsychosocial needs the client might have in addition to their emotional mental health needs. The ICD-10 is the international classification of disease, and is used for diagnosis just like the DSM. It's used more in medical settings, and some insurance providers require that you use the ICD-10 classification. So, you know, if you're getting ready to take your addictions counselor exam or something, you know, it's important to be able to go online and figure out how to look something up in the ICD-10 because you can find it online. Let me just see, do it right here real quick. So, the ICD-10 code for generalized anxiety disorder unspecified is F41.9. Let's do for generalized anxiety. It's F41.1. So, you know, the ICD-10 should not be confusing or scary to you at all. And through the use of Google or some other browser, you can usually really easily find the codes that you need. So, you don't necessarily have to have the book sitting on your desk. So, diagnosis of substance use disorders. The DSM-5, which is what we're on right now, recognizes 10 separate classes of drugs. Alcohol is in a class by itself. Now, that doesn't, well, inhalants, opioids, sedatives, such as hypnotics and barbiturates and anxiolytics, your anti-anxiety medications, stimulants, caffeine, tobacco, cannabis, hallucinogens, and then other unknown substances. Now, it's important to recognize that sedatives and alcohol, for example, have some similar properties. So, you don't want to assume that they're completely distinct. And we'll talk about some of the symptoms of intoxication withdrawal as we go through this presentation. Stimulants are another one. And caffeine is a stimulant, but it's in a class all by itself. So, just being aware that you can have substance intoxication of any of these things, substance withdrawal from any of these things. And, you know, the substance use disorder diagnosis, it used to be broken into substance abuse and substance dependence. And when we went to the DSM-5, they combined it all into substance use disorder. Although how each type of drug acts in the brain differs, they all activate the brain's reward system. Wow, I can't talk this afternoon. Two groups of substance disorders that you need to be aware of. Substance use disorders, which are what we typically think of as addiction, substance intoxication, withdrawal, tolerance, yada, yada. And substance induced disorders. Sometimes when you take a substance, it can cause hallucinations, it can cause anxiety, it can cause depression. So, you know, you need to differentiate what's going on. When you're looking at mental health disorders, for example, is the depression simply a side effect of withdrawal from stimulants, or is it an ongoing underlying disorder? You can have substance induced depression, or you can have a substance use disorder and major depressive disorder in the same person. So, for substance use disorder diagnosis, the person needs to use in larger amounts or for a longer period of time than intended. They have needed to want to cut down or stop, but failed. They need to spend increased time getting, using, or recovering from use, have cravings and urges, neglect work, school, family, social obligations because of use, continue to use even when it causes problems and relationships, give up important social, occupational, recreational activities because of use. So even if it's not causing problems, if you're giving this stuff up and all you're doing is using, that's a problem. Using in risky situations and continuing to use despite knowing that it's making a physical or psychological problem worse, those are your big criteria. Then you've also got tolerance, which is the need of more of the substance to get the same high or the need to combine substances to get the same high or the same effect and withdrawal. Physiological or psychological symptoms that occur when that substance is leaving your system. So people who have a certain number of criteria meet the criteria for substance use disorder. So if they have two to three symptoms, so that's not many, then they have mild substance use disorder, which is what we may have called substance abuse in the past. Four or five is moderate and more than five is a severe substance use disorder, which in the past we would have called substance dependence. So we wanna look at, is there problem mild, moderate, severe? And then we wanna look at where are they at in terms of their recovery process? Are they in early remission, which means they pretty much just got out of detox or 30 days clean, something like that. Are they in sustained remission? That would be a much longer period of time. On maintenance therapy, like methadone maintenance. So you can be not using your drug of choice, but on maintenance therapy or in a controlled environment. So this helps us see how long has the person been clean or able to refrain from using their drug of choice to a point where it's going to cause them problems. And are there factors that are contributing to that such as their on maintenance therapy or they just can't access it because they're in jail or they're in inpatient? Substance induced means that the current presenting symptoms are likely the result of use of a substance and not an underlying preexisting mental disorder. So like I alluded to a little while ago, you can have someone who is experiencing clinical depression as a result of detoxing from excessive stimulant use. You can have somebody have really bad anxiety who is detoxing from benzodiazepine or alcohol use. So that would be substance induced. Now, once that substance is out of their system and they're clean, so to speak, then we start to get a better picture about whether there's an underlying mental health issue in addition to the substance use disorder. Concurrent mental disorders can and often do occur. The rule now is that co-occurring disorders are the expectation, not the exception. The results from effects of the use of a substance can include intoxication and withdrawal, anxiety or depressive disorders, bipolar or related symptoms, psychotic issues like hallucinations or delusions, sleep issues, either insomnia or being really, really sleepy. I've worked with clients who've been on, they've been using methamphetamine for a week and haven't slept and then when they start to detox, they sleep for days. Sexual dysfunction and neurocognitive disorders, such as decreases in memory, inability to concentrate, those sorts of things. The substances, whether they're in your system or whether you're withdrawing from them, you're putting them in, it changes the neurotransmitters.  So it's important to recognize that some of these things may happen just because of the action of the substance that was ingested or used. The Teter-Totter principle helps predict symptoms in the withdrawal period. If somebody's using stimulants, then when they're withdrawing, they're gonna probably be depressed. If somebody's using depressants like alcohol, then when they withdraw, they're probably gonna be anxious and agitated. So you see the opposite of whatever the drug did. Now, if they were using poly substances such as cocaine and alcohol or cocaine and benzodiazepines, it complicates the picture a little bit because cocaine, you would typically see them be depressed afterwards, but alcohol, you would typically see them be agitated and anxious. So if they're using both of them, you're not really sure what it's gonna look like in the detox period. So depressants, let's talk about how do you know somebody's been on this because diagnostics are important and I've put together some mnemonics that can help you identify what you're looking at. So for alcohol, which is a depressant, general sedatives and your anti-anxiety medications, your barbiturates, what you're looking at is sans gin. This is best in mnemonic. Slurred speech, attention impairment, they're not focusing on much of anything. Memory impairment, can't remember what you said five minutes ago. Stupa or stupor or coma or death. So they may be just bleh and kind of unresponsive. Now obviously that is heavy intoxication. Their gait may be unsteady, so they have difficulty walking. They may be uncoordinated, have difficulty signing papers, carrying things, not just walking, but uncoordination in other areas. And they may have nystigmas, which is when the eyes go side to side or up and down in terms of alcohol, side to side involuntarily. So their pupils, their irises are kind of jumping around all over the place. Now every person who's intoxicated is not gonna have every single one of these symptoms, just like when we're making a mental health diagnosis. But these are the things that you're going to look at. Most people who are under the influence of alcohol, you're also gonna smell it on them. But if they're using Xanax or Valium or one of those, there's nothing to smell. So you're gonna have to look for some of these sorts of things. Withdrawal from your sedatives. You're gonna have psychomotor agitation. Remember that Teter-Totter principle. So instead of stupor and coma, you're gonna have somebody who's restless, irritable, jittery, anxiety. Seizures can happen. As the person, as the drug gets out of the system, the person's blood pressure can go up with any of these, which can cause grand mal seizures. Detoxification from your alcohol sedative hypnotic anti-anxiety medications can be life-threatening. This is not something we wanna advise people to do on their own. They need to be medically supervised. Transient hallucinations can happen. Nausea or vomiting, insomnia, hand tremors, excitability, increased heart rate and blood pressure. So they might feel like they're gonna crawl out of their own skin as they detox. And sweating, which is the clinical term as diaphoresis. But if they start sweating profusely, that's also a symptom. And if you've worked in a detox unit, you've seen this, you recognize this. The acronym that we're talking about here is Past Nights. And you can download this presentation from the class. So you can learn all these different acronyms and you have them handy when you're doing diagnostics or so you can memorize them for the test. Amphetamine, cocaine intoxication. The mnemonic is A code blue. So the person is agitated or slowed down. So when we say agitation or psychomotor retardation, that means they're either really jittery and kind of all over the place or they're really sloth-like and slow. Cardiac, you can have tachycardia, which is the heart rate beating too fast or sometimes bradycardia, which is the heart rate beating too slow. So you wanna look for that normal heart rate. Opening of the pupils. When they're on amphetamines, their pupils will be blown, just like when you're a really dark room, your pupils get really big to let more light in. Well, the pupils are not going to be as reactive to light when somebody's under the influence of amphetamines. Diaphoresis or sweating and chills. Then you have encephalopathic-like changes. So brain-type changes, including seizures, confusion or coma. Blood pressure can be elevated or lowered. Loss of stomach content, so people puke a lot of times when they're on intoxicated with stimulants. Unstable muscle-associated changes can include muscle weakness, slowing or increasing of respiration and heart arrhythmias. So it's not even, you know, we said it's too fast, too slow or not regular. You want to hear bump, bump, bump, bump, bump, bump, not bump, bump, bump, bump, bump, bump, bump, bump. That's not a heart rate. That's something you dance to. And evidence of weight loss. People who are taking amphetamines, I mean, amphetamines are prescribed for weight loss. It's a system, what's the word I'm looking for? It makes you so you're not hungry. And so amphetamines are going to do that naturally, but they also speed up your heart rate and your metabolism and stuff. So people may lose a lot of weight if they're using stimulants. When they withdraw from stimulants, it's much shorter list. Depends, depression is really prominent for a lot of people withdrawing from cocaine and amphetamines. Just lots of depressed thoughts, sense of hopelessness, apathy, often suicidal ideation, not always there, but sometimes. Psychomotor agitation or retardation, sometimes a lot of times people slow way down. Their appetite increases because they don't have that appetite suppressant in their system anymore. They may have nightmares, vivid unpleasant dreams. They may be really tired. Well, if you've been running on full bore for three days and haven't slept, you're probably going to be tired. And they may have sleep problems. And it can be hypersomnia, sleeping too much, which would make sense, but it can also be insomnia. They may still be a little revved. They may have some underlying anxiety. So we want to look for sleep changes in these clients. The biggest thing to watch out with, with amphetamine and cocaine withdrawal is the suicidal ideation. So hallucinogens and cannabis, hallucinogens, the mnemonic is distort. They may have distorted vision. It's kind of blurred, hazy, wavy. They may be uncoordinated, sweating, have a fast heart rate, which is tachycardia. Again, their pupils may be wide open and really not responsive to light. They may have racing heart or heart palpitations where it feels like their heart's gonna beat out of their chest. And it may even be at a semi-normal rate, but it feels like it's gonna beat out of their chest. And they may have tremor, hand tremors, when they're intoxicated with hallucinogens. When they're intoxicated with cannabis, and I'm not sure why they came up with mnemonic meat, but they did.  Mouth dry, red eyes, increased appetite, and tachycardia, racing heart rate. So you see that tachycardia comes up quite a bit as does sweating and incoordination. So being aware of the different range, so you can figure out, again, the presentation is gonna be very, very complicated. If you have a client who says, yeah, I was out partying all night, and I was doing PCP and cocaine and alcohol, and anything and everything, you're not gonna know exactly what kind of symptoms you're gonna have during the detox period, but you're also not sure whether the intoxication period is completely peaked yet. If somebody eats a marijuana cookie or brownie or something, those effects don't kick in for a lot longer than if they smoked it, for example. So you may still have some increasing symptomatology even after they get to wherever you're seeing them, at the jail receiving facility or emergency room or whatever. So let's talk about opiates. Opiates are the word on everybody's tongue right now. Opiate intoxication. And the mnemonic is spared. Slurred speech, pinpoint pupils. So up until now, we've been talking about blown pupils. They've been wide open and not responsive. Somebody who's under the influence of opiates, you look at them and their pupils, the black part of their eye is teeny, teeny, teeny, teeny, tiny. And it won't open up if you go into a dark room. It's not reactive to light either. Attention or memory impairment. A lot of people who are on opiates are just kinda la-la-land place. Respiratory depression, opiates are sedatives. So it does slow down, heart rate, breathing, that kind of thing. Too much opiate slows it down completely, person dies. Euphoria. Now this is something a lot of people don't think of with opiates. But many opiates, and one of my clients referred to opiates as his effet drug, or screw it drug, we'll clean it up a little bit. Because when he took it, he didn't have a care in the world. He was just like, oh my gosh, it's so liberating. So he had this sense of euphoria when he was taking it. He wasn't manic, he felt relieved. He felt his uber self. So some people, and for some people, this is the most addicting part of the opiates. Other people get really drowsy. So you wanna look and you don't wanna assume that somebody on opiates is going to be drowsy. They can be euphoric and drowsy at the same time. Pinpoint Pupils is one of the things that's gonna give them away. When we talk about withdrawal, you're going to have the pupils will dilate more. They start to get itchy. People are talking to you and they're scratching like this, like they've got bugs on them or something. A lot of times people who are abusing opiates itch a lot. So pay attention to that. Akes, okay, withdrawal. The mnemonic is army finds, and this has nothing to do with the army. It's just the way the acronym panned out. Muscular aches, rhinorrhea, which is nose running, or lacrimation, which is eyes tearing and kind of running. So somebody kind of oozing. Their mood is dysphoric. So they're probably gonna be depressed. Some people may also have some underlying anxiety issues. I've seen a lot of people self-medicate their anxiety with opiates. So when they're withdrawing from the opiates, the anxiety stuff comes back out. Yawning, fever, insomnia, nausea and vomiting, diarrhea and sweating. A lot of people say that withdrawing from opiates looks a lot like the flu, and it does. It's really unpleasant. In 99% of the cases, well, even more than that, it's not life-threatening. It is severely unpleasant. But as long as the person doesn't get too dehydrated, most of the time, opiate withdrawal can be managed on an outpatient basis. But you do need to be aware of these different things that are happening. You can also get goosebumps, and they call it pilo erection, but it's when the hairs stand up on end. So looking for that in your clients, and I had a client who would go to the bathroom during class, during group, and he would use, and he would come back and 20, 30 minutes later, those pupils would be pinpoint, and he'd be itching at himself, and I knew exactly what was up. PCP, map stand, you're looking for muscle rigidity and acute sense of hearing. Like they think they can hear the mice walking in the walls. Pain numbness, just oblivious to pain. I've had associates, classmates, who had a bad trip on PCP, who just, he kept banging his head into the wall until it got bloody, and he was just oblivious to the fact that he was giving himself a concussion. Seizures or coma are possible. Tachycardia, which is, again, racing heart, or hypertension, which is high blood pressure. You don't have to have, they don't both go together necessarily. You can have both, you can have one or the other. Ataxia, which is loss of control of your bodily movements.  Nostigmus, like we talked about before, the eyes are kind of jumping around. With PCP, it can be horizontal or vertical. And dysarthria, which is problems with articulating. So, you know, it's basically slurring your words and having difficulty getting your words out. When we're talking about differentially diagnosing mood disorders, you know, you may have clients, you probably will have clients that have concurrent mood disorders. So, let's learn some mnemonics for the big ones. A sad face is the mnemonic you use for depression. Appetite changes, sleep disturbances, and hedonia, which means you just don't find pleasure in much of anything. Dysphoria, a sense of being depressed, hopeless, helpless, guilty, agitation. You know, some people, when they get depressed, have difficulty sitting still and they feel kind of restless. Other people can hardly move. Concentration difficulties, when you're depressed, it's hard to concentrate. And low self-esteem. Remember, not every symptom is required for a diagnosis of depression, but these are the most common symptoms that you'll see. For mania, the mnemonic is dig fast. Now, if you're diagnosing bipolar disorder, the person is going to have an episode or episodes of depression or persistent depressive disorder and either mania or hypomania. So, you know, you have to have those and bipolar one or bipolar two are different in terms of bipolar one, you have a full-blown manic episode. Bipolar two, it's only hypomanic, but I digress. So for mania, you know, how can we tell if this person is manic or not?  That's okay, that's not mania, that's them, that's the clouds lifting, that's them being able to breathe again. Mania is distractibility, extreme distractibility, indiscretion in what they do, you know, doing things that are dangerous, they're taking chances, they're things you wouldn't normally do.  Grandios ideas can get people into a lot of trouble when they're manic, because they tend to think that they can do things that they can't or think that they can convince people to do things and they can't. Flight of ideas, they're all over the place. They may be talking about one thing now and then they'll change directions and start talking about something completely different and then 15 seconds later, they're talking about something just completely different than that. And a lot of times their speech is really, really fast and it all kind of runs together and you're just going, please take a breath. Flight of ideas. Activity increase, people who are manic are wired. So they are going around and it's often goal-directed activity. They're seeking pleasure, they're seeking something that's stimulating. Sleep deficit, you know, they're wide open, they are not sleepy at all. Or if they fall asleep, that's like for an hour or two and they feel completely rested. And talkativeness, they talk a lot when they're in a manic episode and they talk about a lot of things because their brain is going really, really fast and there's no filter between their brain and their mouth sometimes. So they're just kind of talking about everything that they think. One thing that I found helpful with clients who are in a manic or hypomanic episode is to use a whiteboard and write down the themes or general issues that they're talking about during the assessment. So then I can say, all right, let's take these one at a time because I'm going a little slower than you are. Let's talk about this and then work through it a little bit. Now the difference between mania and hypomania is degree. People who are in a manic episode can have psychotic features. People who are in a hypomanic episode won't. People who are in a manic episode have significant impairment in daily functioning. People who are hypomanic may not. They may actually seem like they're more driven, like they're driven by a motor, like they finally had this burst of energy. But it's more so. The other thing to remember is with bipolar disorder. People usually don't go from being depressed to being manic. They don't swing like a pendulum. They may have a depressive episode and then have a remission and then have a manic episode or maybe even another depressive episode. They may have four or five depressive episodes and then finally a manic episode. So you don't wanna assume that somebody's gonna swing like a pendulum back and forth. There are long periods of remission and somebody may only have one manic episode ever but multiple depressive episodes. So just because they've only had one manic episode or only one depressive episode, doesn't mean that it's not bipolar. So you wanna really look at what's going on. Anxiety disorder. Most commonly you're gonna see generalized anxiety disorder. So this is watchers. The person has a lot of worry about a lot of different things and it feels uncontrollable. They have a lot of anxiety. They worry about their worry and they're anxious. They feel threatened. Tension in their muscles. Concentration difficulty. And think about when you're stressed. Let's go back to tension in muscles for a second. Makes sense, right? When you're worried, a lot of us tend to carry tension. I know I grind my teeth and I carry tension in my upper back and my neck. Well, people who have generalized anxiety disorder, they have that same tension in their muscles. So concentration difficulties. If you're worried about something, you probably have difficulty concentrating on other things and getting through the day because you're focused on this other thing over here. Hyperarousal being kind of wound up or irritability. Being more irritable moody than normal. People who are anxious. Now remember, anger and anxiety fight or flee. Both of them represent the emotional responses to a threat or a perception of a threat.  Something bad's gonna happen. When you are feeling threatened, we tend to be more irritable. We tend to be a little bit more short tempered. We tend to be a little bit more like a cat that's backed into a corner. Just get away from me. Energy loss. When, and yeah, anxiety can result in that because when you're wound up for so long, eventually your body's just like, I can't do it. I got no more to give. You're not sleeping. You're not eating well.  I'm tired.  Restlessness. Part of you may still be kind of on edge looking around hypervigilant, so to speak. Restless, difficulty sitting still. You know, you can't do anything, but you can't sleep and you're just kind of in this limbo land. And sleep disturbances. Most of the time people with generalized anxiety have difficulty sleeping. They may be able to get to sleep, but they may wake up three, four, five, seven times during the night worrying about things or even may wake up with panic attacks. So sleep disturbance doesn't necessarily mean they don't want to sleep or they're not sleepy. It may mean they can't stay asleep. And PTSD. The mnemonic I chose, there are multiple out there is trauma. Traumatic event has to have happened. Yeah, go figure. They need to be re-experiencing the event either through flashbacks or intrusive dreams and nightmares. They need to be avoiding reminders of the event or their feelings about the event. Emotional numbing kind of goes in that avoidance too where people just, they're like, I don't feel anymore. I can't feel, it's not safe. They're unable to function. They have difficulty going to work and doing things. The symptoms last for a month or more and they have increased arousal. And obviously that should go up a little bit higher but in order to make the mnemonic work, it had to go at the bottom. But their arousal is increased. So they're constantly scanning for signs of threat. They're hyper-vigilant. Their startle response is a lot stronger to things that may happen. They may be a little bit and not pathologically so, but they may seem to others to be a little bit paranoid or over-concerned about things. So being aware of the arousal, it's important. And I will say this, and it's true for all of the disorders and all of the symptoms, not just PTSD, to help normalize the symptoms, help the clients see how the symptom makes sense in terms of the body's desire to survive. If you've been through a trauma, then it makes sense. You're gonna be a little bit more sensitive and aware and maybe aroused to your environment to prevent being traumatized again. Now we can deal with those symptoms so they can reduce their level of arousal because that's exhausting. But it's important to help clients see that these symptoms make sense. They're not pathological. They are basically creative ways that your body has tried to help you survive something that most people shouldn't have to experience. So some conditions are substance induced. That means like depression that's caused when you're withdrawing from stimulants. Once the body has the stimulants out of its system and has a couple of days to get back in order, that depressiveness, those depressive symptoms may go away. Now you may have depressive symptoms that continue because the brain chemistry is out of whack for some other reason. So we have substance induced symptoms. We have substance use disorder, which is using more than intended and continuing to use despite knowing it's causing you problems in multiple areas of life. And then you have mental health issues that would have existed with or without the substance. Now sometimes the substance can trigger schizophrenia, the stress from everything that's going on, but it's important to recognize that depression needs to be treated. If somebody is in your treatment program and they're sobering up and they're clinically depressed, if they don't get some help for that, if you just assume, well, once they get through that post-acute area, they'll be fine. They need to have treatment to help them deal with their depressive symptoms or they ain't gonna stay clean and sober for long. I hope this review was helpful and I will see you on the next video.


Well, let's see the breakfast in plus TV Africa. Thanks for joining us. We look quickly, take a look at our second conversation where we're looking at the alleged wrongful relocation of oil fields. And we have an expert that joins the conversation, but however, a bit of a background to this. Trouble over the oil fields started on April the 6th, 2020, when the regulatory agency, Department of Petroleum Resources, revoked the operating license of biosell oil company over the alleged lack of assets turned around for the nation. Now, Senators, Director of the Nigerian Opstream Petroleum Regulatory Commission to show proof of the presidential directive for revocation and relocation of the Attala Marginal Oil Field OML-46 owned by the Biosell State Government, which was transferred to the Hulking Exploration and Production Company Limited. Well, the directive followed by the Senate was given, but however, you have a trio of the Biosell, had the oil Nigerian Limited and the Century Exploration and Production Limited kicking against the renovation and revocation or relocation on the ground that the original operators of the oil field exploration and production have been made and loyalties were paid into the accounts of the federal government as at the time, the fuel was purportedly revoked and joint venture partners had an outstanding 20,700 hours of crude on ground. We have a guest joining the conversation is almost over at the time, we'll have the Biosell State Government taking, you know, speaking out and being very vocal about this saying, hey, this belongs to the Biosell State Government, but you also have the Senate of recent time showing her consent and this made statement, but what does this mean at the end of the day for Biosell State? We have Ola Bodeh Shawome, who is an oil and gas expert joining us this morning on the conversation. Thank you for joining us, Ola Bodeh, Shawome. Yeah, good morning, Madam. It's a pleasure to be with you. All right then. Thank you once again. Quickly, what do you make of all of this? I mean, this is a conversation that's been going on for a long time. We're in 2022, but something that started way back from 2020. I think that's how it was way before 2020. So we can just go to the origins of when the licenses were... Revolt. I mean, were given by the federal government. There were incidents, there were activities that led to the revocation in the first place. So when the joint venture was given, there were three partners, Century, Biasas, the government, but there was a lot of fight and disagreements among them. To the extent that nothing was being done, the DPR then wrote them a warning letter saying that if they did not develop the fields, that their licenses would be revoked. But still, they were not able to harmonize. The three parties were not able to harmonize and get work going. In fact, in point of fact, there is a record where Century wrote a letter to the DPR then, asking them for the licenses to be revoked. So it was really no surprise for us to see when the licenses were revoked. So the first of all, they had no activity on the field, primarily because they were having issues. So while we understand that they paid royalties and all that, but it's also important that we allow the law to work, it's just unfortunate for the new people, Harkin, who have been allocated the field that they are inheriting a seabed of problems, primarily because one of the people that was given the licenses is a state government. So the issue here is about law and order and the fact that the commission, which has the powers to do this thing, must be allowed to do this work. I mean, that's the essence of the petroleum industry at any rate. At any rate, they made a representation to the commission and the commission set up a committee headed by one of his commissioners to investigate the whole issue. And they took a few months, they took evidences from everybody, they listened to them and they also came up with the fact that the old DPR, as it was, was in the right to revoke those licenses. And subsequently, I think it went somewhere else. Now, what they have done is go to an arbiter because what the responsibility the Senate has in this case is to just check whether the DPR acted in good faith and with respect to external existing laws, which I believe the Senate will do. But in the process, they have brought in a lot of things into the media. Sometimes you take your fight to the media to ensure that you get even better hearing. So it is the responsibility of everyone to hear from all parties, for which I'm not a party to anyone anyway at this moment. But you may want to speak to the NUPRC, who have already listened to all the parties, I judge in the case, and issue the letter to all parties on the results of the arbitration that they did. You may also want to speak to the new people who were located the licenses, and then you may have a different view on the whole thing. But the truth be told is that we as Nigerians need to learn to be comfortable with law and order. We cannot just expect that every time, because we have some power, we have some influence, we can break laws, we can alter circumstances and allow things to go away. It cannot, we cannot, I mean, that's how we got into commotion in the first place. The PIA is clear in terms of who has what authority. And it is also clear everywhere in the world, if you are given a license and you do not use it, and there are extant laws within those licenses that says it can be revoked, then you have the challenges of it being revoked, particularly because there was a warning letter from the DPR then that there was no development and it stood the risk of being revoked. But more importantly, because one of the parties had written to the DPR asking that the licenses be revoked because of irreconcilable differences. So I mean, those are facts of the matter that can be verified. Irreconcilable differences or, you know, turn around at the end of the day to the nation? Well, I'm not century, so I cannot speak to their intent. Yeah, but I can speak to the fact that they wrote a letter. I mean, and that's public and that can be verified and that evidence of that can be gotten. So it's not my own place to say what the issues are. You know, the subjective things are not my place. What we do is just to analyze the facts of the matter. So the facts of the matter is what I've spoken to. The license were given to Biosurge government century and the three parties were not able to effectively develop the field. The second fact of the matter was that there was a warning from the DPR that their licenses could be revoked. But still, they were not able to harmonize and get work going. And at the point in time, one of the parties who wrote to DPR asking that the licenses be revoked and along the line, probably after the expiration of the term, that I don't know for certain, but I guess it would be that way, the licenses were revoked. Those are the facts that I know of the matter. I would like you to talk about the role of President Mahoud Buhari in all of this. Also the role of the Senate Committee on Ethics, Privileges and Public Petitions. Because they've asked the new agency that emerged from the ashes of the DPR, the assembly upstream regulatory commission, to produce the written directive from the president on the allocation of the oilfield to Hauke'in EMP. So what do you say to this? The role of the president, the role of the Senate Committee in all of this? If you recall, one of the things that was in the public game, if you want to go, was the issue about the sale of oilfields on such a separate. And the fact that there was a reservation by a PRC. And then there was an announcement from the presidency and PRC took a stand. And what we basically say, I mean, what the trust of the message from the police is that it would be a lot of work. So NUPRC is the regulator for industry. Just like you have CPM, regulator for the banks. Just like you have DCT, regulator for the broadcast industry. If it has a reservation for a radio station, is it the presidency that we have? You know what we are allowed to do is if we want oil and gas in the industry, we need the oil and gas industry to be a proper system. It cannot be a place where it is the powerful that just way. There is a way to work on democracy's work with systems. The work with proper system. The issue is that, is it within the powers of the NUPRC? What they have done? Is it within the parts of NUPRC? And NUPRC has done it out of its powers. The case should be taken to cover the presidency. That is how democracy works. I mean, so if they feel justified, they should go to the presidency. They should even go to the Senate. So, and this is an important story when the banks said president. And I believe that only the mighty will get the money that survives. So, the law is clear. The rule and the powers of the commission as a regulator is also clear. Okay, a lot of you have talked about the law. Sorry to interrupt you, sir. You've talked about the law, but can we spare a thought? What do you think we should spare a thought for these bodies, these companies? BOCL on one side, or BOCL, Hardy Oil and Nigeria Limited and then Century Exploration and Production. Because they're saying that this revocation is unfair to them. On the grounds that, you know, as the original operators of the field, they had made exploration and production royalties. They had paid royalties. They had gone ahead to make exploration. They've also invested in production. So, if you invest in exploration, it's not small money. You invest in production, it's not small money. You're paying royalties to communities through the federal government, into the account of the federation. It's not a small money. At the time that the license had been revoked, you know, and that they have an outstanding 20,700 barrels of crude oil on the site. So these things have already been ongoing. Okay, I think you spoke about the law and then on the other side, we have to look at the moral issues. On the moral issues, it will be unfair. On the basis of the law, the law is the law. So, and I'll give you this example. In 2010, my mom went to the U.S. And as you can expect with our citizens, she had some, but more, I think she had a few vegetables and that. And the customer of the center in New York at JFK said, he's actually managing Nigerian, so it was American. And that he understands everything and let him, particularly because of his testimony, he would have allowed her to do what he said, but the law is the law. And on the basis of that, all that she spent a lot of time packing had to be seized because they had to offer the procedure for entry into the United States. There's something that for law and order is an economic fundamental. Because if you take the list of economic fundamentals, law and order is one of them. When you get a license and you have paid for your license, that does not mean you own it 100%. And I'll give you an example of a broadcast license. There are actions you can take when you have a broadcast license that can make your license to be revoked. The same thing with the backing license, irrespective of whatever commitment and investment you must have made. Now, under the same law that granted the oil license, there are conditions where that license can be revoked. And one of it is non-investment and non-actions on the field. But more importantly, the fact that they were actually warned about an impending revocation. So these are facts. Okay, so quickly. When we talk law, yes. Let's bring this down because I want to understand if you would describe the action of the executive arm of government where the president on the strength of protest, President Mohammad Buhari, at the time in October, directed the immediate reinstatement of the revoked license on a discretionary basis. I mean, we have seen that the Biasa state government had said, we're going to be committed to ensuring that, hey, if it's a turnaround and whatever you have, we're going to improve this if that's the issue. Would you say that the declaration or the act or the involvement of the executive arm of government led by the president is a meddle sum interloper? First of all, so we're going to the details of law and all that now. So I think the lawyer reacts on that. And I'm being fair, I'm trying to everyone. So I don't want to speak beyond what is my own expertise. What the federal government does will be right if it is consistent with the law that is in existence. And that is the PIA. But I'm only speaking, I'm a technical expert and I'm aware of some of the issues in this case. That is the base for which I'm speaking. If the president acts in a manner that is consistent with the law, it can be taken and that is reversed. So the issue here is a point of principle. It has nothing to do with any of the state. And the point is this, that we have to follow what the law says. Where there is inconsistencies or debate about the law. In a democracy, the person that corrects it is the court. It is not the president. So if there are sincere and genuine grounds by any of the parties, the real place to go is the court. It's not to go to a higher authority because you cannot appropriate and repropriate. So the government, if the DPR... So the Biosag government can have a case, is if they are alleging that the circumstances and the procedures for the revocation of the license was wrong or illegal, then they can have a case. But they cannot have a case by saying that simply because they have invested so much money that the license cannot be revoked. That is not tenable within law. All right, so they need to approach it. Yes, please. Yes, yes, your final sentence, please. Okay, so that's not tenable within law. So to my mind, since the NUPRC, which is the regulator, has looked into the case and found in favor of the old DPR. So what they can do now is take the NUPRC and those who currently have the license to court and state their case before the court, when the court determines. It's one thing. We have to go now. Let me just point them out. Olapode, we have to go. I'm sure we can have this conversation some of the time. Before me, it leaves a question of what it could be now that the Senate is saying, hey, we're frowning and they're asking that there be a proof, you know, where that license was asked to be directed. What becomes, you know, of the situation, a conversation for another time? Thank you so much. Olapode, show me. Oil and gas expert. Thank you very much. It's a pleasure. Well, that's it this morning on the show. I mean, it's quite interesting. I really don't know. It feels like we get back to the times where we dig some of these issues, you know, from way back. But we've been speaking with an expert and he shared his thoughts on all of that. But let's see how all of these things pan out. And that's the size of a conversation this morning on the breakfast. If you missed out on any part of it, it will be okay to follow us on Facebook, Twitter, and Instagram in the subscribe to our YouTube channel, who is at Plus TV Africa, and Plus TV Africa Lifestyle. My name is Messi Boko. Have a great morning. And my name is Kofi Bartels. We will attend tomorrow. Good morning.


Now, this brings us to the last topic that we want to discuss on insecurity, which is basically certain practices that we can follow at home to ensure a secure communication and secure network. So, what are the things that we can do? So, let us look it in parts. So, the first part is the personal computing device recommendations, which basically means what are the recommendations for the devices that you have that you communicate with over the network. So, the few things that you should take care of is update your operating systems, use security softwares, limit the use of root and administrative accounts, because if those are compromised, it becomes easier to access your system, then use sandboxing browsers. So, what we mean by sandboxing browsers is, these browsers, they work in an independent environment and in case there is a malicious code that has been executed, it will just affect the browser and not the system. So, there are a lot of sandboxing browsers that are available and a lot of browsers have the sandboxing capabilities. You should also update the applications that you are using, use encryption wherever possible. For example, use HTTPS, ensure all your websites that you are using are on HTTPS. Then you should always download software from trusted sources. For example, if you are, say you are trying to download VLC media player, you could go directly to the website and download it from there. And if even if you are downloading it from, say a different source, there is something called a checksum, which is available with every software. You could copy the checksum from the website, download the software and use any simple software to calculate the checksum of that particular application or the file that you have downloaded. If these two match, then that means you have the correct software and it has not been tampered with. And the last point in this section is classify activities as per device trust level. So what do we mean by device trust levels? So you have a lot of devices, say one device is used by your children in the house, some are used by you. So children are not that aware and they might go into websites which might compromise their systems. So try not to use those systems for say financial transactions. So every device can have a different trust level based on who is using it, how much that particular user is aware. So you should know which applications or which particular functions you should not perform or perform on those devices.


Spain will give Ukraine launchers for Hawke air defense systems. Spain has confirmed that it will send Ukraine six launchers for Hawke air defense missile systems and supply Ukraine with 155mm and 105mm artillery shells. Margarita Robles, the Spanish Minister of Defense, said that six new anti-aircraft missile systems will join an American battery of Hawks in Ukraine. Starting from November, Spain will also hold training on operating the Hawke systems for Ukrainian soldiers and technical personnel. Robles also said Spain will supply Ukraine with 155mm and 105mm caliber artillery shells and machine guns to strengthen Ukraine's anti-drone defenses. She added that the Russian Federation continues to be able to secure access to new drones with the help of other countries. The Spanish Defense Minister confirmed that field rotations were already on the way to the Ukrainian military and the next shipment from Madrid will include generators and diving compressors as well as winter gear for the military. Training for the Ukrainian military in Toledo and other Spanish cities will continue and will involve up to 4,000 Ukrainian military personnel.


Hi, welcome to my studio. My name is Nomi Safanhorn and I'm a painter. I make mixed-media work with cement and photographs and lace. My studio is in the Monty Building in Cown Heights. So this is an example of a small piece I made last week. I start with the photograph and I build the wood frame to match the size of the photograph and I mount the photograph onto the canvas. Then with an exacto knife I cut through the photograph into the canvas to make a hole and I stretched lace on the back and then on the floor elevated I pushed cement through the back to create this texture. Then I let it dry and it hardens. I use my own photograph that I take when I go home to visit my family in Haifa in Israel. In my own personal life it's hard for me to separate my own personal journey and the journey of what happened to the country I grew up in and that place. And so in a metaphorical way the cement references the political world, the brutality of it and the lace represents a domestic space and bringing those two together makes great attention. For me being in Brooklyn is being in this island of creativity surrounded by people who are engaged and ambitious and creative and I'm really happy to make work here and able to reflect both on the environment here around me and see the relationship between what I'm interested in and how it plays out in Brooklyn or in New York or in the US and thinking back about my home and its history and place.


Hello everyone, my name is Julia. I'm from Ukraine. I just get a soul certificate from ITTT It's very interesting and very useful course Now I'm working as English teacher and I use a lot of games a lot of activities a lot of ideas from this course So I can recommend it to you. Goodbye


వ౬ లార్లిందిల్లూ మ్ల్ల్లో భ్లార్ల్లో మానోటలెలెటు వ్లోనోగ్లిందింనో.我們 couldn't just maintain healthy lifestyle do they know about Argus' health connect? yes little bit we will close the problem of healthy with diligence Argus wouldn't have brought this out on the 31st of January Argus Health Connect will selere we gonna keep your feet in a good fit enjoy he healthy relieved we will tell you more about it next week