Hey guys, what is up? Welcome to my channel. For today's video, we are doing my September beauty favorites. That means it's October and I'm excited. The weather is cooling down. I really hate the heat. So I am taking in the upcoming fall season here. So if you want to see the products that I've been loving this month, then just keep watching. Hi guys, if you're new here, my name is Morgan. I am a product knowledge enthusiast. I just love knowing anything and everything about all the new makeup on the market and sharing my thoughts with you guys. And these videos are one of my favorites because I try out so many products so I can really round up everything that I've been loving for the month and what has stood out. If you're familiar with my favorites videos, I normally start off with a channel of the month. A little bit different this month. As I was filming this video, Kelsey Breanna J uploaded her tribute video for Mel, if you don't know Kelsey, she was Mel Thompson's best friend. I'm going to link that video down below. Make sure you have some tissues near you if you haven't watched it. Really beautifully done by Kelsey and they were best friends and my heart goes out to Kelsey as well. So make sure you subscribe to Kelsey's channel. I will link her video and channel down below. And I'm also going to link the GoFundMe page for Mel Thompson's family down below. Kelsey set that up. Obviously don't feel obligated to donate to it but I have had questions of how you guys can help. I think the GoFundMe is an option. So it's just there. If that's something that you want to do, I would also say another great way to support Mel's family. It's just to simply watch her videos, like and comment and I know it will be so appreciated. So all of those links will be down below. Let's get into the products. I have one skincare item you guys and sometimes I will admit, I can be a little picky about my skincare but this product is so good and it's affordable. This is from Elf. I swear, Loki Elf has really good skincare. This is the Holy Hydration Face Cream and they've had this before but this one now has SPF 30 in it and I swear the texture of this is better. I love this. It does have a slight fragrance to it. It's nothing that irritates me but that's not something that I look for really. So there's a slight fragrance but honestly the cream just feels so luxurious. I love the way that it just soaks into the skin and hydrates it and I've been leaving this out on my desk just to apply before makeup application and it does a great job of prepping the skin, keeping the skin hydrated throughout the day. I do have normal to dry skin, leaning more dry in the winter or if I'm not properly taking care of it and I just think that this is such a great value. You get a really quality moisturizer for a very affordable price and Elf just did a phenomenal job with this moisturizer. I highly recommend it. Next up I have a couple of concealers. I tried out quite a few concealers this month and there were two that stood out on top of all the others so the first one, not necessarily recommending it to you, it's $90 but if you've been watching my channel I've been sneaking in this dang Tom Ford shade and illuminate concealer. It's $90 but I love it. Like I really, really love it you guys. It's a little bit luminous on the under eyes, nothing crazy. It's more of like a luminous matte I would say but it just blends over the skin beautifully and the wear on this phenomenal doesn't dry out the under eyes, doesn't leave the under eyes looking really crazy. Honestly I think this is a great liquid concealer for more mature skin or dry your under eyes. I just think the wear of this is what is beating out other concealers because the next concealer I'm gonna talk about looks I would say as good as the Tom Ford but the Tom Ford wears better. However, it is $90. I'm not saying that you need to go out and buy it. No concealer is worth $90 unless it is plastic surgery itself but if you have the money I love this concealer. The next concealer is very, very comparable to the Tom Ford. This is the ABH concealer. It is awesome. This has the most giant dough foot. It's a very interesting size here. I don't know if you can see the hook. I don't know but this concealer is so smooth over the skin. It's not as luminous as the Tom Ford but I find that they perform very similarly and they spread out very similarly. I just think the Tom Ford withstands time a little bit better but this is like $30. The Tom Ford is three times the price so if you're concerned about the price definitely go for the ABH there. It's not a $60 difference in performance. That's what I'm gonna say. Definitely not. That's why I would almost recommend the ABH over the Tom Ford just because of that price difference but they both are phenomenal, phenomenal concealers. I'm wearing the Tom Ford today. I meant to do half and half but without thinking about it I just put concealer under both eyes and I was like no going back down but yeah, those two concealers, really awesome. This next product is not new but I've been grabbing for it over all of my other powders. It's just so universal. It works with really any product that I'm wearing on my face. This is the Cosas Cloud Setting Powder. I have mine in the shade Feathery. I love this powder. It really is so versatile and I've told you guys that I've liked it since the beginning. It's awesome but it's really just something that I've been grabbing for over all of my other powders because no matter what I'm using it's going to work good to set it. It smooths the skin. It doesn't look too heavy on the skin. I don't know, it doesn't look really good. It's really, really nice. It's a little bit smoothing and I think because it's a little bit more powdery because I compared this to the Dior Powder. That one is a little bit more gel-like whereas this one is a little bit more powdery. I prefer the Dior I would say because I have dry skin so that one's a bit more hydrating. If you have a little bit more oils this one is really, really great because it does a nice job with longevity of sucking in the oils as the day goes on and it's just a really solid setting powder. I don't know what else to say about it but I really like it and I've been using it all month over all of my other setting powders. Okay, I mean this one was a really, really predictable choice here but you guys know I'm obsessed with the Hourglass Ambient Palettes every year. I picked up both of them if you want to see my review and comparisons on these I do have that on my channel if you're curious but both of these are super good. So they have two palettes this year. One is made for lighter skin tones, one is made for deeper skin tones. I really like the lighter one here even though it looks like bacon, raw bacon at best but this is the cheek palette that I'm wearing today and these are just so easy to use, so easy to grab for. I went away a couple of times this month for like stacations, things like that. I brought this with me, okay? And it's just so easy, it saves space. The packaging is nice and sturdy, I like that it's metal, I just love it, I like it. This palette as a whole I would say is a little bit more rosy, it's definitely gonna work for lighter skin tones and even down to fair, the Unlocked Palette is the one for deeper skin tones. I would say this is best geared towards tan and medium skin tones. This is perfect for you guys but I know a lot of you with lighter skin have actually preferred this palette because it is a bit different for one, it has this awesome setting powder here whereas in the lighter one it has one that has like too much glitter in it. I used it today as a finishing powder and it's still like I looked glittery, I'm not a big fan of that shade so take that shade out, the other shades are awesome but what is great about the darker one is it just has their normal finishing powder which is a lot more flattering to the skin, it has a strobe highlight which is a little bit more metallic, however this highlight is too dark on me, definitely not made for my skin tone but I'm telling you, if you have a medium skin tone I really think you would love this palette, they both are great though and I can make both work for my skin tone but I will be giving this one to my mom just because it's gonna work so good for her, I don't have a use for it really, I'm gonna keep this one, I really love it, I love the colors, I love the formula, I love how easy everything is to apply and I do think that these are better than last years. Last years, it was good, they're always good but it wasn't my favorite mix of colors, I like how this year's is set up, it's sad that there's only five shades as opposed to the six that were in last years but I'm still very happy with these, I love the blush tones in particular and that's all for face, let's move on to eyes, very heavy on eyes in the video, this was pretty top but we'll start off with eyebrows, not a new product but one that I semi rediscovered, I kind of bought it a couple months ago, I was like oh it's nice and I threw it in a drawer and I moved on with my life, I picked this up at the beginning of the month and I cannot put it down, this is the Patrick Tull Major Brow Lemonation Gel and you guys know, I'm not really into feather brows on myself, I just, I feel like I went through a wind tunnel and it's not very cute but if there's any way for me to get a feather brow that I like, it's with this one, I like a toned down one, like you can see, I do love how this controls where my brow hairs go, it separates the brows because of the brush applicator itself, it makes the eyebrows look really thick because it separates them so flattering, oh my goodness, they just look so good and it keeps the brows glued down, like this is close to glue, I'm convinced and even, I don't know if you guys saw my demo, like ugh, it globs out like glue, I don't really love that factor about it but my eyebrows don't go anywhere, I love how it brushes and separates the hairs on my eyebrows, it's the best brow gel, this has shot up to arguably my number one favorite, I think I prefer something a little less heavy for every day or certain occasions, so this is a little bit too heavy sometimes but when I want my brows to listen to me, this is how they would listen to me, so if you have really thick, curly, stubborn eyebrows, this one is worth a try, it will literally tame your brows and brush them out, so it's like glue, but if you're looking for something super-duper intense, the ABH freeze brow gel thing in the pot, that is crazy controlling, I much prefer this, it's a little bit lighter, all of this other stuff was fine and dandy, but I've got to be honest, September was the best month, hands down for eyeshadow palette releases, point blank, no other month, so let me tell you that my monthly palette rankings that I'm gonna film next week, it's going to be intense, I might cry, I don't know how I'm gonna do it, so for now I'm just gonna, I picked out a few palettes, but I'm sitting here with regret because I'm not featuring the two Charlotte Tilbury palettes that I tried this month, which were Bomb Fire, but I just don't know how I'm gonna rank them, so I don't know, maybe those will be number one, I don't know, but these at the very least are the ones that I've spent the most time playing with, so the first one, duh duh duh duh, we have the Pat McGrath Celestial Odyssey palette, I said in my review that I preferred last year's, but it don't matter, because I still really like this one, honestly, even though I prefer the color straight from last year's, I think I would probably reach for this one more in terms of wearing because it has like really good tones to wear neutral everyday looks, even though I come on camera and wearing looks like these, if I'm not on camera and I'm running errands or doing boring stuff, I put on boring everyday kind of makeup, it's not worth the time in any other way, I see myself grabbing for this one a lot more because of that, but you also have the fun pops, the quality is great, not a single dud, I did a three looks one palette video, I could do a billion more looks with this, this palette is so versatile, but anyways, this palette is beautiful, it's worth every penny, I think it's one of the best Pat McGrath palettes to start off with in terms of value, in terms of color story, I mean, it's a given, like you know I was gonna talk about this, right? You knew that, okay, let's move on to the next one, another like dud one, so the Natasha Denona Retro Palette came out of the, or I tried at the very, very, very, do I have pit stains? No good, you guys, TMI, but one of the sweatiest parts of my body is my armpits, like I don't even be hot in my, anyways, back to the point, I tried this in the beginning of the month, so I've had it for a while, I did a lot of looks with this one as well, this one is a little bit more wearable for me compared to the Pat McGrath, but like this, you guys know, it's my kind of palette, it's mauve, pinky, purples, it's a gorgeous palette all around, again, I feel like not the looks that I can do are endless, but within one color family, I feel like I can do a lot of looks with this, and just generally speaking, this is a color story that I find to be very flattering, I'm very comfortable with it, Natasha Jenona picked a great selection of colors here, great quality, one of my favorites, I don't think this one is gonna be everybody's cup of tea, honestly, this color story is not pinpointed for everybody, but for me, it was pointed in my direction, and I love this one, this one is a good one, I feel like this came out so long ago, so many releases came out this month, that this feels like it should have been in last month's video, because I haven't used this in a good two weeks, because of all the new releases, but I love it, it's so good, okay, the last one, even though I love a lot more palettes than this this month, but this collection in particular really just stood out to me, because of how special the shades are, the formula is, and that is the Odin's Eye Collection, where they collaborated with three lovely creators, so we have Tina over at Fancy Face, created the Hummingbird Palettes, I haven't yet created a dedicated look for this palette, I've taken a few of the colors from the palette and incorporated them into my looks, but this is a very, very colorful one, so if you're into colors, I think you would really like this, but this is next on my calendar, to create a look with, and then we'll talk about the one that I'm wearing right now, which is Giant Wolves, which is a collaboration with Annette's Makeup Corner, I was going to use the Hummingbird palette, because it's so colorful today, but then I looked at the vibe of my outfit, and I wanted to do something a little bit more grungy, and if you're into grungy tones, Giant Wolves is definitely the way to go, you can see that I stuck to just the top three colors, and then the black for this look to create the green, because I thought it would go with my outfit, but I wanna play with this lower half of the palette so bad, the colors look super pretty, and then I did a couple looks with the Red Dragon palette, which was a collaboration with Judy, oh my gosh, I created one of my favorite looks I've done in the longest time with this palette, I put it in my fall palette video, because I think it's a beautiful palette for fall, while containing very unique tones, I think all three of these are great additions to your collection, I can't name really any other palettes that look like these, and then the formula on top of it all, I think this is the best formulation that Odin's eye has done as well, the shimmers are so impactful, and glittery, dimensional, each palette contains a multi-chrome shadow, I mean you can see all of the dimension on my eyes, all of the matte shades blend really beautifully, and the best thing if you purchase these, you are supporting really great creators, that aside, even if these weren't a collaboration, literally these are the prettiest color stories, so I'm still having a lot of fun with these, these are awesome, I definitely feel like I'm missing some good eyeshadow palettes, but for my mental strength, let's move on to lips, I only have one lip product, Kaleidos earlier in the month came out with their Apple Collection, which contained new shades of their lab clay lip formula, which I love them you guys, they're great for mask wearing, they're really really comfortable, I got all of the shades sent to me, but I'm so boring with lips, I like the wearable colors, so I've been loving the shade Nude, I'm gonna show you it in the demo, cause I kinda changed it for today's look, but these are kind of like a souffle formula, but they're quite hydrating as well, they last a really long time, this one has a pinky tone to it, it's one of the more neutral wearable shades in this collection, I just love having this in my purse, really comfortable, really wearable, for today I do have it right now, it's the base color, but I did wanna neutralize it a little bit, just to go with my outfit and my look, so on top of it I put on Staycation from Hooda Beauty, and then a little bit of the Bobby Brown in West Coast Bay, but this was strictly to neutralize it for my outfit, but other than that I've been rocking this to brighten up my face, to add some color to my face, these are phenomenal lip formula to look into, and I have one last and final product, and that is for my hair, I've slowly been trying out a lot of different hair products, and I don't know I'm still debating if I need to do an updated hair routine, let me play with my new products first to see if I have a new routine, but I used the Briogeo hair cream, I don't know if that video is up yet, but I have a haul coming up and I used a Briogeo hair gel, and I think this is second day curls, they're a little frizzy, but not bad because normally second day hair don't work on me, but anyways, once I finalize my hair routine I'll finally film that for you guys, so I have the Briogeo Don't Despair Repair Vegan Apple Honey Deep Conditioning Mask, and of course, yes, a selling point to me was this cute little bear, which honestly, the bear, I don't know, I find it hard to squeeze product out of, but I suppose it's worth it, this smells phenomenal, and my hair's been extra dry because I've been using a really cheap bad conditioner and I've been too lazy to purchase a new one, so this is actually like a hair mask, I've been using it kind of as just a regular conditioner, I will let it sit in my hair, but anyways, it's done wonders, like I need to let it sit in my hair longer, my hair's shinier, it feels much more moisturized, and I have very dry hair to you guys, it's a con of having curly hair and using all the product that I do, but this isn't really nice, so if you're looking for a good hair mask, Briogeo has not disappointed me, this is a great hair mask, and it smells super good. All right you guys, there we have it, those were all of the products that I've been loving this month of September, again make sure you check out all of my links down below, purely Kelsey's page, as well as Mal Thompson's GoFundMe page, and I will see you guys in the next one, thank you so much for being subscribed to my channel and liking this video and for all of your continued support, bye guys, have a good one.


It's going on everyone Sam here late in sports cards.  There's a look again at your random results as always you can find those on the website Under the results tab as well as the link and chat Randy. What's up my guy? How you doing, buddy? Let me drop you guys a link to Six to go on our next soccer break it's gonna be a 10 boxer the choice right here We're gonna go ahead and start with select. So good luck here everybody. Thanks again for getting this filled on up Let's do it Silver and Ramsdale for Arsenal and a pink Wilfred Zaha to 99. That's going to Crystal Palace. Nice one there How about Chris Paul going to Warriors? How weird is that dude? Silver Julio and Piso for Brighton and purple Michael Antonio going to West Ham to 135 There you go snowball Dream I was just right thinking Chris better not get my face right There's Andy Colt for Newcastle on the auto nice one there pitch side signatures Andy Colt for Newcastle future silver future Is Marcus Taven here or Bournemouth? He'll probably I have to imagine he comes off the bench I have to imagine he comes off the bench blue is Lucas D9 for as in via blues are not numbered orange Alexander Esak It's 99 for Newcastle It's when they're Newcastle United Newcastle United That is a John Kulesovsky. We've got Ilkay Gundogan 20 of 25 on the tie-dye auto nice one there for Manchester City Congrats on that man city Thank you Kevin taking three in the next Micah taken two So we're down to one to go now in our next break. Thank you everybody. Well the prison choice spot came in as well silver David Raya Raya got a Field level of Lucas Kata for West Ham and a pink Rodrigo Bentecourt to 25 nice one there Yep, rakes already listed for tops comb UEFA club competitions coming up this week, which is gonna be fun, man Really excited for that That is gonna be Marco Sinisee rookie on the tricolor as well as an orange William Saliba nice one there on the rookie for Arsenal to 75 I'm Saliba that is gonna be a for Everton on the Silver Jersey is Dominic Calvert-Lewin Grats on that Gonduon really that's how it's spelled it. You look I can do on did not know that Gabriel Martinelli The game would seem to bowl was there for the first time about this So I'll be there probably Probably silver is Matoma for Brighton and hope and Martin Odegaard nice one there for Arsenal select There's Calvin Phillips nice one there I knew because of the announcers humming son my guy for Equalizers probably my favorite player in the world. I would say like I love on the sun silver Kyle Walker from N-City and a Deion Kulisevski for Tottenham on the pink to 99 Tottenham Hotspur Look I can do on remember that now. I can do on there's a Matthias Jensen red not numbered and unstoppable Gabriel Jesus for our silver Stop Timmy How you doing, buddy? Just parents are Turkish huh interesting Interesting There's a good do on doesn't really sound I was gonna say can do on doesn't sound like a very German name But that makes sense now that makes a lot more sense Silva Jordan Henderson for Liverpool And Joe Arriba Silver Edward Mendy That's very true. That's gonna be a zebra is gonna be Martin Odegaard nice one there to 25 13 up 25 Mastavatos in the UCC chrome It does look like a pretty crazy checklist for sure. I know for us is pumped about it For us is pumped There's a Gabriel Martinelli nice one there for Arsenal On the jersey card and silver Fabio Viera future select future About triples and duos nice. Let's go dude. I love the dualism triples the Tony Adams on the signatures for Arsenal nice one there are some going to Jim G Tony Adams I have one of those for Liverpool really safe tomorrow Yeah, Arsenal Checks out Got a Wesley Popano for Chelsea on the jersey card a Holland messy Ronaldo triple. Oh, no way That is gonna be a Amelia Martinez for Asin Villa and it's silver Kevin de Bruyne For at Man City, I'll be a fun random That might not go to random. Yes There's Alexis MacAllister for Brighton and hope or Brighton I should say and camo Matthias Jensen for Brentford 225 You have to get that one for Best product hit Ellie Dela crew probably 22 bowman. I think yeah, right? We're bowman's best he's in a lot all over the place too. Yeah I got a redemption. It's gonna be Alexis MacAllister Brighton. Hope pull the checklist really quick here What's this 22 23?  Oh pinch side signatures Premier League tie-dye nice one there. Yeah Can double check. Yeah That's awesome, dude. Harry Kane. Yes, sir. Go to Tottenham Grats on that nice pitch side signatures Premier League On the title What's that gonna be number two because the tie is different this at 49 But it is pitch side signatures No 25 or less very nice It's a bird. It's a play it's a burn. It's a plane. No, it's not Okay Get this guy out of here And that's gonna be checked relish to 135 stop break Yes, yeah, sir red is Jolenton, I wouldn't Silver Wilfred Zaha be such a kind soul Yeah, maybe not Alexander Esau there's silver Darwin Nunez nice one there on the pitch side that it's gonna be a equalizer is Brendan Aronson It's gonna be Gabriel Jesus and how about this that it's gonna be a field level Early Holland One of 49 for man city congrats on that one Manchester City very nice Sold out on our next break. Thank you guys Appreciate that. I was going to Felix and with Manchester City. This one you can for sure Well, I appreciate you looking it up darling You are the man Tyrell, Malisea There's pink Gabriel Martinelli 299 nice one there for Hey, Donnie, you want to see me do the grouchy Sean stop naming moves after me everyone's a steamer except for me Well, it's true one thing really quick guys hold on.  We're ripping soccer too. So how perfect is that that you get a yellow card Kyle? beautiful There's a Bobby dake Cordova read for form on the red and unstoppable is Ryan Christie Stain glass early Holland. Let's go for men city Congrats on that one. Let's go man Felix and congrats buddy. Hell yeah, man. Awesome Wow, dude Back to back boxes with a huge Holland in it. Let's go Because that was all me. Yeah, there's a blue of Tyrell, Malisea and unstoppable early Holland there's a silver Maxwell Cornette and Christian Pulisic nice one there to 1 9 not for Chelsea American hero right there. Thank you. Nice job. Got a green green aroni coming up here silver Joe Joe Hart and green is gonna be Allison Becker for Liverpool. Nice one there That is gonna be numbered four of five There's a Alexander Esau field level on the tricolor as well as a silver gal Gavin Bazunou for Southampton red is Timothy Castani and Declan writes nice one there to 135 tricolor is Alexander Mitrovic and orange Christian Pulisic 24 of 75 on the field level I Silver Harvey Elliot Michael Oli's future it's gonna be dual is Anthony and Bruno Fernandez nice one there for man city and Just man city right. Yeah, just man city The it's called the EPL logo threw me off for a second there The EPL logo threw me off for a second there I thought it was a tool of two different teams nice one there for Manchester Manchester United, excuse me Manchester United. It's going to Ben a silver Ruben Navas, I was gonna say a man United That's gonna be another dual this time Erling Holland and Julian Alvarez nice one there on the tie-dye nine of 25 Dual for Manchester City. That's awesome. Silver is Tobin or Tosin Daravio Silva William Saliba And Aaron Hickey to 225 for Brentford. Stop blame. I appreciate that spirit It's gonna be a keen Louis Potter nice one there on the rookie auto going to Brentford. That's on that Brentford Silver Alexander Esauk right are taken wow a lot of spots two in each of the pearls as well as four in Origins and foreign select. Thank you Brett. You're the man you are the man my friend and we are sold out now on our next break We're sold out all the way up until cosmic luminaries. Let me drop you guys a link for that really quick Cosmic chrome and luminaries next break with spots 22 to go on that one. All right three choice now three choice Aronis It's Jensen. There's a Jeremy nice one there That is gonna be two of ten on the gold gold scope auto flashback for Chelsea Two of ten that's very nice Flashback autographs. We've got our exclusives are gonna be Darwin Nunez for Liverpool Goncalo Gwinnis for Wolverhampton And Jared Bowen going to Westam nice one there got silver Jeffery Shlup Silver Dean Henderson and Hugo Loris.  I remember we told him he was in I don't know what product it was and me and Sean were breaking. I said Jeffery Shlup We looked at each other.  He was no you're a shlup Sounds alright. Yep Do you really expect anything different fireworks page on needle? It's gonna be a Ray Paul parlor nice one there for Arsenal on the scope bottom and that's Arsenal Jim G And a red scope is Jordan Henderson nice one there for at the Liverpool 14 of 30 Exclusives are gonna be a James Justin a Hey Alphonse Ariella Van Rekoufalsilver Joe Warrell on the rookie and Dominic Solanke a cloud of scope Declan Rex It's gonna be a David James for Liverpool on the flashback autographs. Nice one there congrats Liverpool That is gonna be Jeff have there you go Jeff grass buddy Exclusives now is Jolenton going to Newcastle nice one here green scope Diego Lorente That is gonna be number three of five for Leeds Rats on that one there leads United for Jeff M another exclusive Tim Reem Defender for fuller silver Aaron Hickey. We've got Alan St. Maxim and Idrisa Goya All right guys do a quick recap here pretty solid six boxers start us off We had the tie-dye Holland and Julian Alvarez nice one there for Man City We had Bruno Fernandez and Anthony for Manchester United Wesley Fofana Chelsea Gabriel Martinelli going to Arsenal as well as Dominic Calvert Lewin for Everton autos. We had the David James as well as a Ray Parler and Jeremy Gold to ten flashback autographs. We had Keen Lewis Potter Tottenham, that's gonna be Harry Kane on the pitch side signatures tie-dye to 25 or less Tony Adams We had Let me look at the force gave me the pronunciation that is gonna be You look high gonna do on that's what it is gonna do on You look high gonna do on to 25 as well as Andy Cole We also had our mags cards are gonna be a Erling Holland on the stained glass and Erling Holland on the pitch side or the field level to 25. It's gonna do it for the break guys Thanks again for the fill next up is choice 10 box


as you can see got some incredible views behind me for this video and we're also featuring a few monkeys in this one yeah on to the topic this is why narcissists disappear the reason why they disappear is because you're no longer an easy target for them you're becoming more difficult for them to manipulate it's a lot of work for them so they don't want to work on anything with you anymore instead they would rather find an easier target someone who is easier for them to fool where they can pull the wall over their eyes where they can get them to do what they want so that is why they have disappeared it is why they've ghosted you it is why they're nowhere to be found it is why you don't hear from them anymore because remember before they were all over you they couldn't leave you alone when you were listening to what they said when you were doing what they want to do to do I mean that's all it really is that's their idea of a perfect source of supply a perfect partner is someone who listens to them and does what they want someone who is easy for them to control and if you're not going to be that for them then good riddance they don't need you really is that simple so that is why they have ghosted you that is why they have disappeared because you're difficult for them to deal with they can't manipulate you anymore because you're on to their gains you figure them out so they'll go and find someone else who is unsuspecting someone who doesn't know what they're really about someone who they can trick and deceive doesn't mean that the new person is better than you it just means that they're a bigger fool they're willing to be the narcissist doormat the narcissist punching bag and listen to all of their problems listen to everything they have to say and be at their beck and call when the narcissist says jump they will say how high and that person may have been you at one point I'm sure many of you can remember that you did everything the narcissist wanted you to do it's like it was never enough so you kept doing more you were running on this endless hamster wheel trying to please them nothing you did was ever enough they're never happy with you and it's gonna be the same with whoever they meet even if they do somehow manage to meet someone who is doing more than what you did for them they're still not going to be happy just like they were happy with you there is no specific measure or amount that will satisfy a narcissist they have insatiable desires that cannot be fulfilled so it's not about how much you do for them or what you do for them it will never be enough it will never make them happy but this is why they disappear because they're just looking for short-term satisfaction it only lasts for the moment they enjoy the adrenaline rush the high of meeting someone new and it fades away with time and then they're gonna find someone else it's an endless cycle it's an endless pattern of behavior they never change that is keep doing the same thing again and again expecting a different result but this is what they do I'm coming towards the end now of a three and a half hour journey driving through the mountains and around this beautiful scenery and I think I chose the right car for it the Range Rover Evoke it's a great car for driving through the mountains and even driving off-road through the forests so yeah that's why narcissists disappear don't take it personally don't think that it is anything to do with you as a person because it doesn't it's just your vice to their games that's what it really is narcissist sized people up to see what type of person you are to see if you're gonna listen to them to see if you're gonna do what they want and if you're not then they don't need you it's as simple as that it's not about you not being a nice person you did something wrong or you're not good enough it's nothing to do with that it has nothing to do with that at all as many of you will know narcissists often down great they will settle for anything it's just that they know they can't trick you they can't deceive you they can't pull the wall over your eyes so to them you're a lost cause there's no point in dealing with you because all they care about is what they're gonna get and if they're not gonna get nothing then it's on to the next it's as simple as that but you are doing the right thing don't cave in don't give into their demands you just keep doing you focus on yourself focus on making yourself better your life you see they don't want you to do that they want you to focus on them and do what they want well what about you what about your life what about making things better for you they don't care about that but you need to have to say I'm a bit cautious after I don't know if everyone knows you but in Thailand a few years ago I got bit by a monkey just under my arm I was in hospital for one month having treatment normally they're okay but if they think you've got food or anything then it's possible they may attack I do enjoy see the monkeys as well I'm gonna go see the views down there on the other side and then continue with the rest of my journey not too far now and then I'll do a video at my next destination okay thank you all for joining me 41 viewers here let's get those thumbs ups in and please share your thoughts in the comment section subscribe share the video for one-on-one coaching go to my website it's narcsurvivor.co.uk okay that's all for today I will talk to you in another one very soon


St. Augustine is up by six with 45 seconds to go. And the announcers say, no way they're going to punt this. They may just decide to take the safety and run out the final seconds here. I think you, well, one thing I know, they're not going to punt it. Surprise punt, surprise, horrible punt. St. Bonaventure has the ball at, like, the 25-yard line now with eight seconds left. And they go right down the middle with a beautiful pass. Come on. Get to the line. Get to the line. Get to the line. Get to the line. Spike it, spike it, spike it, spike it, spike it, spike it. Clock stopped. But look what you guys missed, even though you were watching. Number two on defense tries to intercept the spike by the quarterback. Here it is as slow as I can do it. And I think it splits his hands and he doesn't catch it. Imagine if they just called that and they can't review it. What play do they run? Oh, they throw it to this dude. He throws it to that dude. Trickery for the win. You got to love the coaching there.  He's got to make this to win. Of course he does. What an ending.


Hi, I'm Carmen Vandenberg. This is the CV10 6L6, which is basically based off the Studio 10 6L6, which is a great amp that I've been playing for quite a while, like in small gigs or just in studios. It's just really the perfect size and really handy and it just sounds great. That was just the amp on its own. I mean, I love my CV30 and how we really dialed in for the tone, but I think, you know, if I needed to go and do a quick gig or like a quick studio session, I'd be bringing this one around. It's so easy and so accessible and it's just got a great tone. Yeah, this is just like, if you play it, then it's just the same. Just play a bit harder. Just bring the volume down. It's very loud for just being like, this is not even like, this is just the gain itself up. It's just, it's so good for looking at. So yeah, this is the CV10 6L6 and I hope you get to try it.


So I was just driving spent through a yellow light and then on the side of the road There's this black car with no nothing on the side or anything And then it pulls out of the parking lot and I look back and it's a Undercover not undercover, but it's just a traffic cop. I'm like, oh my god It's really happening to me right now because the speed limit was like 45 and I was going like 50 or 55 He was following me for a little bit and they put into the next lane over me and they sped off And then turn on his lights to get the guy right in front of me I was like, oh my god that that would be the close one. So moral of the story Don't speed the yellow lights and get caught. Anyway, right now I'm headed to go grab some lunch Yeah, it should be a fun day. I'm meeting up with some friends before they all leave for school Luckily, Prince doesn't start until September 10th. So I'm chilling. I've got about a month left at home I have been trying to do a little bit more blogging while I am home Because I know I'm not gonna have time while I'm at school or anything like that. Yeah, I'll see you guys at lunch Actually broke my pair of glasses back in France. So before I left that's a pick up a new pair I got these they're kind of like a gold with the caramel kind of thing I bought them in Paris and I really liked them and I just had the prescription lenses filled Back in Dallas. I haven't worn glasses in a while. So I'm a little bit dizzy, but They have like these gold rims on top. I like the gold accent because it just kind of Accentuates the glasses once again and as you guys know glasses are kind of like a part of my style and they just kind of add to any outfit Overall, I think I really like them. So just wrapped up lunch at a Korean fried chicken place Which is super good and then some bubble tea because you guys know I love me some bubble tea now I'm headed back home to go meet with another friend Today's just busy meeting with people running errands things like that. Nothing too crazy, but always a good time Childish a bino in the house Watching haters wonder why Gambino got the game like half-tied thick y'all she wanted to his bank We do some throwbacks today Foods to be healthy with my girl Mara hates being in the vlog. That's bubble tea place to go I'm back with my boy Paul some shopping go to North Park. Try to get my phone fixed at the Apple store Room like this would be awesome. How much is this? So right here we have Here's dashboard some cup holders Big roof. I should think the Tesla Model X is one of the coolest cars on the market right now Except I can't figure how to open these stupid doors Huge freakin display right here. It's like a space ship. I couldn't figure how to open the door I was like, where's the Coming try to open this door. If you figure this out on the first try, I'll be very impressed. You see me do it


All right, I'm here with the trainer of Michael Jordan and Kobe Bryant Charles Barkley Kimalajewan Tim Grover Look at that ring. What year is that? 2009 Laker championship ring he has not bad. He's showing me how to shoot better. Check out his book relentless thing you see Recreational basketball players doing wrong Not stretching they never cross half court They're out of shape How many guys have you seen in a pickup game where ten people are actually on the same side of the court, right? So just conditioning stuff. Yeah, I mean people. It's just like anything else.  They won't hustle back on defense yet when they get the ball. They're sprit. They're sprit now look I'm open What about conditioning? Do you have a favorite? A lot of people just condition to get tired and they think that they're doing something but the the recovery in between You're running and how you're doing it has a lot to do with how quickly and how good how well you're gonna get in shape so You know developing like squats on uneven Bons of balls or whatever was that kind of stuff you were pioneering way back way. Oh, yeah That's what he's right. Yeah, Pete. If you watch people playing basketball It's not in one plane, you know, they may jump off from a certain spot land somewhere else They're always hitting the floor they're getting they're getting pushed So it's just like okay if you only have them work on a grounded surface Then you're really not working all the aspects, you know When you get rebound when you jump you may get pushed So you want to be able to catch your balance have the ability for your ligaments and tendons to be trained and developed So they can take forces in uneven planes So what's the main trick for somebody? Increasing their vertical people either think that it's only the legs But you got to involve the whole body you think of it like an accordion accordion is connected when you take a Spring the farther you can pull it apart and when you let go of it the quicker it snaps together People forget that the muscles had they contract in different ways Not only do they shorten but they lengthen also So you have to be able to have a program design that teaches your muscles to snap shorten and lengthen with a lot of force But also do it with a lot of speed So you have to work different types of contractions when you're working out people have a tendency to only work The shortening of the muscle they don't have a tendency to work the lengthening of the muscle What's an example of a lengthening exercise a lengthening exercise in you know We talk about this in the book in the jumper tag if you were to sit down and just you would hold a lunge position So if you were to go down Okay, so if you would write and you would just a hole just to hold that position from anywhere from a minute to three minutes Oh, oh, right. So you just holding yeah now you know you would time-lapse 30 minutes later Have you been able to find you can pretty much increase anybody's vertical? Oh, yeah, and there's room for improvement for anybody and a how many people do you know in sports? Actually improve when they're 30, you know Kobe's not going to tone down his stuff for anybody right so flexibility stuff Most people flexibility in your in your in your sport what happens is a lot of people think if you're Overly flexible you'll be better at your particular sport You have to be flexible in the range of motion for your sport like being able to do The splits is not going to decrease your chances of getting injured because you never do this split motion You need to be flexible and be able to control that range of motion in whatever sports Yeah, it goes both ways the one thing Larry did not do and he he got this a little later in his career Larry did old-school basketball where his thing was I run and I play basketball to get in the shape Yes, he had never really he didn't lift he didn't lift and do all that other stuff because you know back then you thought about Basketball lift and all everyone if you lift make sure measure shot a shot off and so forth So do you think that messed him up? I mean he did not have long term it did because you know when his back went out when that happens It's too late. You just can't recover from it and that's what we try to teach all you got The only way you can if you have a proper program, you're not going to do a if you're a basketball player You can do MMA As part of your program, right? I can't be your main Yeah, I can't be your main thing if you're trying to be a cleaner or a top MMA person You're not going to do a basketball routine You can come in and shoot around and maybe that's round a little bit just to break up the monotony Yeah, but it can't it can't be thing when a lot of people get they start to Replace a set of add-on like you'll see people wherever the latest craze is they'll say okay. This is what I'm going to do You got a beautiful house here. Hey, but the bottom line is if the foundation, right? It's not built correctly. Yeah, doesn't matter what you have inside and what everybody wants to do now is They want to go to sexy right and what I always tell them is a sexy can cook So what do I need to do better on my shot? Just think about this when you shoot Okay, you want to try to put these two fingers and your thumb and elbow in the basket If you make a shot and the ball comes back to you That's a perfect shot if you can hit in the back of the rim You don't have to chase the ball as much it comes back to you when you're that good that you determine How you swish your shots gotten so much better. See it's from you. I guess I couldn't hire you away from Jordan


Good afternoon. My real name is not whatever that says. We'll go with Chef for today. Thank you for coming. It's awesome to be here. Thanks also. So everyone that's affiliated with DEF CON, this is phenomenal. Thank you for the hard work you do. The goons, you guys are doing a great job. This is fantastic. If not overwhelming.  I hope someone will show up and watch this thing. So thank you for you guys for coming and standing in the line and coming into the room. Uh oh. I'm going to keep going. So what I'm here to talk about today is the beyond the scan, the value proposition of vulnerability assessment. Great title, right? It's not a tools talk though. So first of all, I pulled the room. How many folks are involved in vulnerability assessment or vulnerability management of some type? Great. You're the people I want to talk to. So we already know how to do the scan. I'm sorry. It's not a tools talk. Your talk's been canceled. All right. Well, see ya. Do I still get- We have a little tradition here at DEF CON. When you're first time speaker, you must do a shot on stage. Excellent. Wait a second. I got those mixed up. That one's yours. All right. I do this all day. I know. DEF CON, our brand new speaker. DEF CON, 23. Thank you very much. Good luck. Thank you. Water chaser. So a lot of us already do vulnerability assessment. We're involved in scanning types of activities. So we kind of know how that works. We're doing that already in our organizations. But I think there's a lot of the aspects of performing scanning that are not well understood. Maybe not by us, but perhaps by our organizations. And I think when I started working on this presentation, I was a client and several clients that I've worked with over the years that knew that they needed to do this, but they weren't necessarily all together clear on what we would do with that information once we got it. And so in working with clients and going through that narrative on what we're doing while we're performing the scans, I realized that there's an opportunity maybe to help us as performing this activity do really make more meaningful changes with our organizations. And you'll hear me say this a couple of times, kind of where the layer 8 happens, you know, as we get further away from the technical activity and we're actually trying to impact the business and make meaningful change. I'm going to talk a lot about too, as us, the human beings that are doing the scans and also trying to communicate with the business that we support. So that's what we're talking about. This is me, managing consultant at IO Active from Louisiana, like we say in Texas. I'm not from Texas, but I got there as fast as I could. Since 1995, and I started focusing on Infosecond 2001. So I love, like all of you, I love this industry. I like the dynamic nature of the world we live in. I love being a part of the dialogue so there's some contact information you can find it on the CD as well. So I love talking about this. So stay in touch. All right. So it's, we're not talking about clicking scan.  And a lot of people might think, okay, you set up the scan or you click scan. And that's it. That's all you do, right? Would you agree that it's a little more complex than that? I mean, hopefully it is. So it's regarded as one of the least sexy things in Infosecond, right? Our industry is really exciting right now and has been for a while and there's a lot of interesting things going on. And so vulnerability assessment tends to get lost over, I think. But it's my view that it's a key component of our information security program and one that's often overlooked. And if you overlook it and you don't give it the attention it deserves it, you're doing a disservice to your organization. So as I talk through this and talk about some of the success stories I have had, hopefully this will be useful to you when you go back to, you know, your organization that you're supporting. So yeah, we're going to talk about how we can go beyond the scan and provide tangible value, not only to the security team but the entire business that we're supporting. Because at the end of the day, that's the point, right? Information assurance of whatever business we're doing this for. So whether you're a red team or blue team, we're doing kind of the heavy lifting blue collar security work, I think, is what we're talking about. So this next slide, we talk with clients I've worked with, we talk a lot about the human scanner, sorry, the human tester and the tools based scanning. And the scan data by itself is very, very useful, right? I mean, it tells you a lot about your environment and what you're doing. And the human testing is absolutely critical.  But I really feel strongly that when you apply the human testers, it's all of us, to the data that we gather, that's when actionable information happens. And I think that's the sweet spot when you apply the human to the scan data we gather, magical things start to happen. So I point that out just to reiterate the point that this isn't a tools based talk. I'm advocating for using tools in a smart way, but more importantly, you've got to have people who know what they're doing when they use these tools. Does that make sense? I mean, have you ever, you know, I'm sure you've experienced this too, but you've had cases where you say, oh, we need to do a scan, so we'll give it to some new guy that works in desktop and we'll give him the scanner and let him go run off and scan the network. I don't generally respond positively to that. Please don't do that. You need to have the talented humans that are doing it. So in addition to talking about, you know, having the talented human and applying that to the data, a question that comes up a lot and perhaps you've heard this question as well, what should we scan? And it's an important question because our organization might be very small or very large. I advocate for what I like to call longitudinal scans, scan everything. Because clicking scan is easy but, you know, making sense of the data is the hard part and to realize some of the benefits I'm going to get to later on in this deck when I talk about the case studies, you have to do, again, longitudinal studies over time of a large number of hosts. Preferably if it has an IP stack, you should scan it. Now there may be different times where you're targeting scans and you're scanning very specific things that you're interested in. But at some point to really understand your network environment, you need to see everything that's on there, not just the known quantities that you have. And there's some interesting stories coming up talking about that. So have your talented humans that are looking at the data and also scan all of the things. Another point I want to make, this, obviously we can't avoid talking about the tools because that's what we're using to gather this data. But I am going to try and be as vendor agnostic as possible. There's some names up here of some tools and they're all very, very good in their own way. When you, you know, your current engagement or future engagements, you may have a situation where you need to pick a new tool and that's very specific to the organization and what your goals are when you're doing it. There is one tool that I'm using currently that's doing very fine. But all of them will work and you have to just, you know, make sure you're working with your organizations internally to decide which is the right one for you.  So when did all this start? When I was preparing the slide deck, I vaguely remembered when some of this started happening but I did a little bit of research. The security administrator tool for analyzing networks or Satan was released in 1995. Now obviously they're very talented folks that created it but they weren't interested in marketing obviously with the name like Satan. I don't know that worked very well. And if anybody, was anybody around in the industry in 95 other than me, anybody where? Thank goodness, my people. So that was a big deal when that happened. It absolutely polarized the industry. I remember reading in some of the trade rags and mailing lists that about half the folks thought this is the worst idea ever. Why in the world would you create a tool to make it easy to find vulnerabilities? The other half of the people thought thank goodness, now I as a systems administrator have a way to find these vulnerabilities easily. And it was a very difficult conversation. A lot of people got very passionate about it and it was the same type of discussion that we had years ago where firewalls were nothing more than, you know, an expensive way to slow down your network and router ACLs will work just fine. We know that's not true, right? We should. So PC Mag in 1996 published an article and just to give you a little context on what the state of the art was back then. It was at 166 megahertz processors, 2 gig hard drives. It was a long time ago, right? Things were a lot different back then. So PC Mag wrote this article and as you can see the DOJ became very, very concerned about this tool and actually threatened to press charges against one of the authors of the tool. And I think they dropped the charges only after he lost his job. So to show you for now today and, you know, 2015 when we do scans all the time, there's people out there that are literally scanning the Internet, 20 years ago this would get you landed in jail. You know, that's just two decades. It's amazing to think that it was such a dramatic new thing that we were doing back then. One of the other tools that came out after Satan did Internet scanner which later became I.S.S. can scan more than 100 known vulnerabilities. Think about that for a minute. I've got 100 known vulnerabilities on the computer in my pocket right now probably that many of you are trying to find by the way. The scanner I'm using now, last time I checked it, it was scanning for something like 160,000 different specific vulnerabilities across multiple platforms. So in 20 years we've gone from 100 known things that were primarily on Linux to now, you know, almost a couple hundred thousand on many, many different platforms. So you can learn more about these folks that were involved in creating Satan. They went on to have successful careers and interestingly a couple of folks got together and forked Satan into the security administrator's integrated network tool. They wisely chose Saint. So now this story is somewhat like a Dan Brown novel. Satan and saying, yeah, thank you. I wrote that joke myself. And it became a commercial product in 1998. So Satan came out in 95, all hell broke loose, 98 now all of a sudden we've got commercial products and obviously you remember from my earlier slide there's lots of commercial products that exist. So from those humble beginnings we've got now an entirely new capability that we didn't have before in InfoSec. It was very difficult to figure out what is wrong with our systems. So it progressed from simple scanning, 100 known vulnerabilities to now we're doing vulnerability assessment. We're looking across multiple platforms across a large number of hosts and that leads into vulnerability management. And I'm going to pause on this just for a moment to make the point that it's not just performing the scan. I distinguish vulnerability assessment from vulnerability management because vulnerability management includes the things like, okay, now that we have this information and we know this, what are we going to do about it? And that's the whole risk management thing. You mitigate it, you accept it or you transfer it, right? You got to do something now that we know this and then now that we've decided what to do about it, how are we going to document it in an audible way? So we did this thing, how do we know that we did this thing and that it's actually working and then now that we've documented it, how do we know that this decision that we made today continues to be the correct decision moving on in the future? Maybe there's a vulnerability that I know about but I don't care because the threat landscape seems to be very, very tiny, but that can change. All of a sudden a new zero day comes out targeting whatever that vulnerability was, now I care all of a sudden. So vulnerability management includes all of those things from now that I know about it, what am I going to do, now that I've done it, how do I document it and make sure that that continues to be the right decision? So already what I'm telling you is once the scan is complete there is a lot of work that goes on organizationally for us to make sure that we're actually protecting our information assets. So I went through all that just to say and this is either you already know this because you're doing it now and so hopefully it's reinforcing this for you so when you go back to work it will help out or if you're relatively new to this type of activity hopefully you're starting to see that oh man after the scan is over you're not done at all. So a couple of decades excuse me that was loud. A couple of decades ago scanners came out and yet I still feel like in our industry particularly where we start touching the business they're still understood. I love that cartoon. Did no one else like it? No laughs? Thank you. They're still misunderstood so in working with clients several clients over the last several years I eventually started one question that always comes up is okay I've got human testing that's going on so people are doing things and trying to break into things and I'm doing tools based scanning so if I get this new scanner what can I get rid of? And that was a terrifying conversation that I started to have so I actually started talking about the scanning activity relative to the OSI model and what this is going to show is what certain tools that we might use how they work relative to other tools so are we all familiar with the OSI model? Love it, hate it. There's lots of models to choose from this just happened to be the one that worked the best so down at the bottom we've got physical we're talking about electrons and photons going through fiber. If we're interested in things like TCP, UDP, IP ports maybe we use something like in-map to gather that information. If we're interested in thick client applications that are talking to a server somewhere now we're higher up in the model in the host layers it's giving us visibility into there. User facing web applications maybe we use web inspector burp and it's again, oops I forgot to, there you go, up in the high in the host layers and again down on the network if we're wanting to sniff traffic and it goes on so you can see already when I drop the scanner in there it's giving us a little bit wider view than some of those other tools are so if the question ever comes up okay we bought this great expensive scanner what can we get rid of the answer is nothing because this isn't replacing something this is giving us additional information that's useful and it kind of serves as an adjunct to the other information we're gathering and of course the only thing which is capable of scanning the entire stack is the humans, us. They're actually doing the work and whether it's manually penetration testing on an application or manually trying to break in or if it's just looking at the results of a tools based scan that we gathered the people are the most important thing and I've gotten a lot of really good feedback and I would be interested to hearing from you folks if this particular OSI slide is useful because when again going to layer 8 leaving the technical and going to the starting to talk to the business this really helps them see that we've got a lot of information we're dealing with when we talk about securing applications or systems and there's lots of different ways we have to gather that information so just to kind of illustrate that in a different way so you can see our tools are very very useful for those longitudinal scans that I talked about doing scans over time of a large number of hosts and comparing results so we can see okay what was our security posture today and as that changes it moves on and statistical reporting it but the people don't ever let anyone tell you if you decide to start using tools which is a great idea it's not going to replace other tools it's also not going to replace your people you still have to have people who know what that data is and what they're looking at and you can read through the list of things that are on there it's just a very you know short list of the things that we're good at that the tools are not so they're critical but limited without the skills security professionals alright this is an interesting example of that I told the story earlier and it worked out so we did an assessment for a client and we came back with a lot of HTTP based vulnerabilities a lot of Apache things and we went to the ops team and said hey can you update Apache please this it seems to be broke and they came back and said well those aren't web servers so obviously those are false positives and we said okay well yes that server's job is not to be a web server but I can see the banner right here I assure you that there's a web demon somewhere running on that thing and as it turns out it was a web based management tool from the OEM that was sitting there helping gather data and so even though it wasn't a web server in that that's not what his primary job was there still was in fact a web demon running on that server and it wasn't until and apparently that had been reported previously but it had gone unfixed because there wasn't that human analyst that was able to say well no it's not a false positive and here is why that was a fun conversation to have so one other thing I'm not going to spend too much time on this one but when you start having those conversations when you're sharing results with operations or with business units or other people I found a really interesting thing that when you use words the same word might mean something completely different depending on who you're talking to so use interface as an example if I say interface three times it's going to mean three different things depending on who I'm talking to right if you all ever had this experience as well you know if you're talking to you know if you say interface there might be talk you know think rest API right it's an API that's allowing things you talk to you know routing and switching guys and they're talking about you know a network interface card that attaches a computer to a network so it's important to be cognizant of who you're talking to when you're delivering these results or you're working on remediation efforts because language you can you know can be a confusing thing so you have to know what you're talking about you need to know your environment as well on a client engagement we're trying to decide how to scan a very large network that had a global presence so we had distributed scan engines that existed in various key locations around the world and there's a location in southeast Texas there was one in Brazil one in Argentina so intuitively it seemed like well to scan South America we should send a scan engine down to South America right when we met with the networking folks what we realized is that both Brazil and Argentina backhauled through Houston so if I wanted to scan Argentina from Brazil it went by way of Houston first so architecturally the smart decision to do was to scan South America from North America so it's not enough just to say okay we'll put a scanner out there somewhere and click scan and go nuts if you have a sufficiently large and complex environment you really need to know how those packets are getting to where they're headed to so understand the architecture of your network logically and physically so now we know what language to use now we know our environment now we need to know our organization okay don't panic I'm not going to walk you through this whole slide I know there's a lot of boxes and a lot of things going on but what it illustrates is working with a particular client there's lots of ways a scanner can allow us to slice and dice data right now we've all done this we can do different types of reports we can look at specific vulnerabilities and host and group them in many different ways but to get to that actionable and meaningful data that we're giving to the organization we have to be make very conscious decisions on how we're going to organize the data and how it relates to the support organizations that ultimately are going to fix the problems we identify get a little feedback if you happen to be the same person that's identifying the problems and then also fixing them then that might be a slightly different story but in a lot of ways you're reporting out information and you're working on helping validate findings and remediation efforts but just the point of this is you spend a lot of time understanding how the data is going to relate to the different parts of the organization that you're going to talk to and I really think that's a critical critical thing alright so now I'm going to get into the case studies the very specific stories I have where we did some things beyond the scan that were a little unexpected if not intuitive so the list here some of it's very obvious identifies potential vulnerabilities well yes of course that's why we're doing this in the first place right but there's a lot of other things that a good scanner will do for us numbers three and four are not really specifically named capabilities but if you're doing it right asset management and software management and almost by accident so you need to capitalize on that in your organization and don't focus solely on well I'm telling you what's wrong with your box but all these other things as well so let's get right into the case study part of it identifies potential vulnerabilities so what we're trying to figure out here and if you're already doing this this might be a little obvious but I think it's important to reiterate it so bear with me what are the targets what patches are missing from those targets but also is our environment configured properly so it's not just about the specific host but the entire enterprise as a whole so for example we did a perimeter scan of an organization and found that SIFS was exposed to the open internet and we panic these were net bios ports on Windows boxes many of which were Windows XP this was 2013 and what happened is we asked the question why? why is that set up that way that is the worst thing you could ever do is to put those Windows boxes on the internet in that way and the answer we got back is that it was necessary for support and by the way it's never a good idea to put a Windows box exposed with net bios ports on the open internet you're asking for trouble but the support organization at this company didn't they believed that that was the best way to do what they were trying to do and so they opened up those ports and of course there's VPNs there's remote access there's a million billion better ways to do this thing but because we asked the question why rather than just saying hey close those ports and have a nice day we realized that there was a gap in the understanding of how those boxes should even be supported in the first place there was also a related issue where those boxes needed access to a legacy application that required IP based authentication so they needed to have unique IP addresses and that's how this remote application would let them in so they not only were those ports exposed but they had static NAT setup so that each of these machines had a routable IP address and so when they set up the NAT which by itself isn't necessarily a huge deal but for some reason they put an inbound firewall rule that was pretty much any any except so everything was coming inbound to these boxes so what was interesting about that is we identified not only some technical problems but also a business problem that was broken because they never should have allowed that firewall rule to be put in place as it was right so it's not again just about finding a vulnerability but we found these processes that weren't working the way they should I got ahead of myself my apologies so yeah there were multiple misunderstandings that resulted in poor decisions the poor decisions were left unchecked for a very very long time then you get into oh well Bob set that up ten years ago and he's retired and we can call him to ask him why and we're afraid to change it because something might stop working so we're going to leave it alone so we resulted we found not only those vulnerabilities but there was poor documentation we couldn't figure out why this thing was set up the way it was again the broken processes that allowed the firewall rule to get put in place in the first place and a lack of understanding of what the specific requirements were at this same organization we found that there is an obsolete version of Java that resulted in hundreds of findings so if you do scanning obsolete Java shouldn't be a surprise and having it result in hundreds of specific vulnerabilities shouldn't be a surprise either but when we went back and again same question why is this set up the way it is the team came back and said well business critical application that requires that version of Java seemed like a sketchy answer we didn't like it so we actually called the vendor which apparently no one had ever done before and we said hey do you really require this specific version of Java and they said no we require at least that version of Java but apparently that wasn't it's a very subtle detail that was left out at this client site you can't no longer hide behind the idea that well we have to use this version because the vendor said to if I were a cynical person and for those of you that know me I kind of am really I think they were just using that as an excuse to not do the work of upgrading Java in a large enterprise so you can help them understand the importance of what they're doing so very similar results there was poor documentation failures of the oral tradition where well you know I heard somebody say that that's the one that was required so it must be true all of these things were benefits that the organization got long after the scan was over and it happened when we started working with the business units and the support organizations to figure these things out so it'll provide a scanning tool will provide remediation information things that might be obvious to a lot of us in here but I've worked with a lot of clients who are surprised to find out that not only will it tell me what's wrong with the systems I'm scanning but a good commercial product will also tell us how we can fix it and I think this client that I'm thinking of perhaps had only ever seen the results of a scan in a spreadsheet that says IP address, host name what's wrong with it and when we provided a more detailed report that included the remediation information it became hugely more valuable to this organization because now they knew not only what was wrong but also what they needed to do to fix it so make sure you capitalize how many times did that happen to you there's this weird problem operations please go fix this thing and it's impossible for any of us to know everything so they might not know so make sure you take advantage of the information that's already in the tool that you're using another cartoon so asset management is anybody involved in asset management as well for your organizations here so you know what I'm talking about here with herding cats that's very difficult I have a pretty good idea of what everything is on my home network but in a big organization if anyone tells you that oh yeah we know exactly what is on our wire everywhere across the organization here's where you have to make a decision and I talked about in my opening remarks are you going to scan a specific list of hosts that you're interested in or are you going to scan all the things and try and figure out what's out there now those are two different activities that are solving two different problems but I think we should do them both a client I worked with scanned all of the cider blocks that they knew about and we actually had a little bit of time left over in the engagement at the end we decided okay let's scan the stuff that you think doesn't exist let's scan it anyway and lo and behold we found active networks that were completely undocumented obviously the switches didn't turn themselves on right and hosts didn't come online on their own somebody had set up those networks but it wasn't documented they were forgotten about somehow but by doing that activity we can find parts of our networks that we maybe what was there so in addition to scanning known hosts also it's a good idea to scan the cider blocks the big ranges of IP addresses that exist on your network to try and figure out what's there one client that I'm working with when you do that and you scan these huge blocks you end up creating a very nice inventory of what exists on your network and if you have people that do configuration management in addition to asset management it became very useful to share that information with them because now there's a check and balance to validate the data that they have so it's not even at that point a security related issue at all as much as it is asset management but still hugely important you know if you don't know what is on your network how can you possibly secure it right an interesting thing happened at a previous client where we found a large number of IP cameras so these cameras weren't on anybody's list it was a little embedded system it wasn't even a computer as such that anyone cared about but they were all over this place and many of them were configured incorrectly with default credentials I mean how many times have we seen default credentials be a problem but even though IT didn't care because they were a different organization it was a huge win for the client because they fixed a very big problem that could have could have been a very big problem the same client again it wasn't a security related issue but we found some Nintendo machines on the network now it was a children's hospital so it was okay I mean they were supposed to be there so the kids could play the games but it illustrated the point that if IT didn't know they were there now you have to ask the question wait a minute I've got gaming consoles that are on the same network as some of my production equipment is that really the best place to put that so that starts driving the conversations of how is our network configured are we doing this in an appropriate way and the best way we can last example for asset management was a drilling company I worked with they had a lot of rigs in the Gulf of Mexico and the way they couched it for us was the platform has exactly four hosts on it and that's all you're going to find okay cool so we do the scan go over the V-SAT connection and we scan and most of the platforms did in fact have exactly four hosts and it was fine but there was a couple that had way more than that and we went back to the client said look there's a dozen hot IP addresses coming off of this rig and you obviously don't know what they are because you told me they were supposed to be four so they got really interested in that what were those machines that were out there was obviously folks flying out to the location and bringing unauthorized devices so asset management I can't emphasize enough that in addition to finding what's wrong with the things that's on our network finding out what is on our network in the first place is a huge idea and I got permission from a gentleman I work with that if you don't believe me he said this on Twitter so it must be true running an infosack program is 90% asset management if you're not doing it you're screwed no matter what else you're doing and I think that's very very true and I think it speaks to the importance of this activity and why we should spend a lot of time making sure we're hitting every corner of our network we get to so similarly with software management do you know what software is running on every single machine in your enterprise that you're scanning we might have a pretty good idea but a good scanner that's doing credentialed scans and by the way that's a whole other part of the discussion you know do we scan with or without credentials obviously you're going to get a lot more information if you provide credentials and if you do the good scanning tool will allow us to enumerate everything that's installed on a box and by the way once we've done those scans we can always go back and run reports and try and figure out if there's anything interesting there that we should that you would know about maybe you've standardized on internet explorer for your browser sorry if you did and maybe you don't want firefox for some reason or what about a bit torrent clients or if you found those on your network you'd be very interested in knowing about that and don't forget that having a list of that software that's running is hugely hugely important so compliance on some level we're scanning things and we're flinging packets information comes back and we make decisions about what the configuration is and we can learn more about activities we need to take to make them more secure but make sure your scanner is an issue for you is compliance an issue for anyone by the way if it's a standard like PCI or if it's a regulation like HIPAA, Sarbanes Oxley GLBA your scanner should be able to tell you what your security posture looks like relative to something else and that can be important if you do work with audit folks or again with compliance folks make sure you're taking advantage of the fact that you can gather that information and help you understand what your compliance status is that's all I'm going to say about that so strategically the information we're gathering should be very important to our organizations as well and I'm talking about ongoing operational intelligence so again I'll use the word again because I like it I'm talking about these longitudinal scans that we do over time we're scanning large numbers of hosts so it's not a scan at a point in time we're looking at the trends that are developing as we continue to do these scans and that can become very strategic and important in an unexpected way and that is if you look and you see that you're continuing to find vulnerabilities but they're not getting fixed maybe you have a resourcing problem and I've actually seen where managers were able to say wait a minute we're not fixing things quickly enough or efficiently enough so that can be data that you can use to help find out if you have staffing problems or even process problems with your organization so strategically it can be very, very important tactically it can be very, very important as well so if we're doing these scans often and over time if something happens like heart bleed happens well I don't necessarily have to scan perform a new scan right now if heart bleed is going to be an issue for me I've already scanned these systems so I should know what versions of SSL exist and whether or not I care about these things what platforms they're running on and those sorts of questions or if something happens and now all of a sudden bash is vulnerable we don't need to perform a new scan straight away we should already know if this is in our environment and if we need to do something so not only is it strategically very, very important but tactically it can be very, very important as well so does anybody work in either healthcare or work on environments that have industrial control systems more hands alright so this is this conversation is going on a lot in our industry now and it's going to continue because these systems in particular are not the same as the other computers that are on our networks biomedical devices and control systems SCADA things that help run plants and refineries and what not they're highly, highly specialized and they're purpose built and they're used to getting a very, very specific type of traffic so when you start throwing unexpected traffic at them as you're trying to scan it it's on there weird things can happen and that's both true for biomedical and ICS so if you work in a healthcare organization and there's biomed you need to be careful so my first bullet point there FDA 510K that's kind of a hot button for me because although the FDA is getting a little stronger in forcing equipment manufacturers to do it in a more secure way a lot of times you'll find that your manufacturer will hide behind the FDA regulation and by the way if you want to hear more about FDA there's a link there I blogged about it and there's some good information I think does anyone know specifically what FDA 510K is and have to deal with it now maybe not so FDA the Food and Drug Administration says that before you sell a medical device go through pre-market submission that is to say they have to examine it and make sure that it's not going to harm the patient once the FDA says yes this device is fine you can use it you can't make any changes to it that becomes a problem when I say you need to patch your X-ray machine because they tend to say well no we can't change it because pre-market submission says we can't change it so be aware of that if you're in charge of finding vulnerabilities in your organization you have to work very closely with your biomedical team the guidance that's come out from the FDA in the past years they're really strengthening the position and saying look applying a patch to an X-ray machine that happens to run a windows operating system that's fine please do that in fact not patching it causes greater risk to the patient than patching the device and potentially changing it it's the security versus supportability issue and it's not by any means unique to healthcare but it's a problem we have to deal with all the time and sometimes that can lead to poor design decisions for example we did a scan of some radiology devices and it was a large number of workstations that were in this hospital the vendor supported the software and they supported it with FTP so every one of these workstations had IIS installed and it was running FTP but to make it easy to support they set it up so anonymous logins were enabled and to make sure that they had access to the file system they moved the FTP root all the way up to the root of the system drive so in effect I'm not making this up I know who in the world would ever do that buy me a beer and I'll tell you later who did that but basically everybody that had access to the network had anonymous FTP access to the entire file system and the service account by the way that was used to do this had local administrative access so it's the worst thing you could possibly ever do and so normally if you scan and you see FTP that might not be a big deal but that's why it became a big deal very very quickly so similar set of stories with industrial control systems if any of you work with that now again I'm talking about the control systems that may be turn valves refineries or chemical plants and those sorts of things operational technology, OT, SCADA those things they're not the same as information technology at all shutting down a plant to do maintenance on computers is extremely expensive and their patch cycles might be measured in months or years so if you find yourself working on these types of systems you need to make sure that you work closely with the OT people to understand that once you find the vulnerability remediation efforts aren't going to be as simple as applying a patch or making a change and in fact when you do scan it it's the same with biomedical they're purpose built very very specific unusual traffic they might not deal with it very well at all so be very cautious in those environments I know I'm running out of time so I'd be glad to talk about this more later if you want but basically the story I've tried to tell you is that scanning's been around for a long time it's matured to something that's a lot more useful to our organizations than it was 10 years ago and don't think of the data that's in your scanner as being data that's in a bucket powerful when shared appropriately so look for opportunities to share this data within your organization and if you develop a mature vulnerability management program that includes all these processes I think you'll really impact your organization in a meaningful way thank you very much for sitting through all that and enjoy DEF CON 23 thank you


Time, 2034 hours, status of base, unknown, ETA fallout, we're working on it. Sheltercom checks out his command post, brings in control centers, orders, break cover and look at base. Deploy damage assessment teams, deploy casualty assessment teams, casualty and damage assessment teams deployed to provide command post with an evaluation of total base conditions, instructions to assess and report, especially report, you call us because if you don't, we'll call you. Tape up tight, assess and report, and no umbrellas. When it starts to rain, we'll let you know, and post. 2036 hours, DO reports aircraft successfully dispersed at 2018 hours, two aircraft detached on bomb damage assessment missions, security reports three fires, vicinity weapon storage, one major, ruptured gas lines and hangar two, fires in BOQ block one, blast damage at base calm and heavy vehicle repair shop, medical control center reports casualties vicinity base headquarters, one first aid man detached, team proceeding north with assessment, civil engineers control reports heavy damage among forward equipment, equipment at west dispersal point needed urgently, transportation dispatches one vehicle with four drivers to west dispersal with instructions to use the runway. There's one more thing we know, ETA fallout 2050 to 2055 hours, anyone leaving shelter is so advised, 20 minutes to go. Since it was weeks, 20 weeks, and just as urgent, expedient shelter needed to be found, made or assembled out of base resources, disaster preparedness planning board survey secured a jet engine test cell with a protection factor of 50 and three unused ammo bunkers with an average protection factor of 500, they were good, but they were only a start. More shelter was needed and more dispersal. Not only dispersal, but better proximity to emergency war operations work area. Four trips of five minutes in radiation is 20 minutes work lost, not delayed, lost. In 20 minutes you can arm an airplane, more shelters were needed, and the only expedient materials at hand were quantities of disused containers and perforated steel plank. They met the basic requirement, they would house men and support a covering of sand. At the shelter sites, ground was leveled and the containers were ranged up into a shelter nucleus. Simple wooden arches were prepared to support the PSP, the enclosures were then sandbagged. This is expedient shelter, a few feet of sand to cut a lot of radiation, to keep a unit on the board when its turn comes to move. Eight shelters of this kind were completed from base resources. By then, we were in DEF CON 4. 2045 hours, status of base, battle hit and burning, fire chief reports BOQ fire spreading out of control into adjacent quarters, new fires reported in tar storage and in grass near medical bunker generator, civil engineer reports control tower unstable and hazardous, live electric power lines grounding near LOX tanks. Command post requests information on progress of runway clearing. Sweeper reports occasional debris beyond its capacity, waiting for tractor currently clearing overturned vehicle from taxiway. Could the debris be cleared by hand? Yes. Work force dispatched to assist. Control specialists are dispatched to assess and recover blast damage at base calm, but two more to be dropped off to neutralize power lines at LOX storage. Civil engineer reports all survived equipment in from dispersal and man, all priority demands being met.  All units concentrated in weapons storage area except two units detached to medical bunker on orders from command post. Work force removing tires from storage with orders to abandon the building. Work force standing by with extinguishers that hang at two during emergency stoppage of gas leaks. Detachment at medical bunker reports grass fire extinguished with no damage to generator. Request orders, two pieces of equipment, tar storage or weapons. DEF CON 3. Base personnel had been recalled and the base disaster preparedness plan put into effect. As the disaster response team was being formed, the base was being hardened for battle. 20-47 hours. Medical personnel report to hospital shelter to treat casualties. Medical control advises command post 23 recoverable cases received. More information coming in from field sorting teams. In the field, non-medical personnel organizing dispatch of casualties to hospital report 20 more recoverable wounded on the way. Six non-recoverable casualties for terminal care and second priority transportation. They're dead and about 30 men for first aid and return to duty. Medical control relays the information. Command post acknowledges. Initial recovery almost complete. All casualties accounted for. Priority fires out or in final control. Abandoned fires stable and offering no new threat. Loss of tower anticipated in emergency plans and effects. Blast damage at base comm not immediately recoverable. Emergency comm installed and priorities established. 20-59 hours. Fire chief reports new casualties and collapse of tire storage building. DO reports one aircraft coming back with fire warning lights. Shelter monitor reports radiation. It's here. Upon detection of radiation, fallout procedures described in AFM 355-1 will immediately be observed. No personnel will leave shelter without orders of the controlling agency. So went the briefing as shelter teams were formed and familiarized with checklists. At the same time, supplies and equipment were being installed and checked into shelters. Medical supplies. Water. Sanitation equipment. Forms and displays were set out. As communications were installed and tested. Exposure control stations were equipped. Dosage forms, accumulated dosage charts and radiac sets also tested. Generators and blowers had been checked out regularly on a weekly basis. This was their final test. The fuel was topped off. We were through DEF CON 2. Time, 21-10 hours. Radiation, 40 rentals per hour. Fire chief reports priority missions accomplished. Fire storage casualties dispatched to hospital. Fire crash crews on standby for returning aircraft on emergency landing. Medical control center confirms fire casualties received at hospital. Command post requests dosage report on personnel involved. Time, 21-27 hours. Radiation, 370 rentals per hour. Inside a closed vehicle cut by half. Hospital, less than one rentgen per hour. Residence control, less than one rentgen per hour. At security and calm, less than one rentgen per hour. In the command post, the recovered pilot is DEF CON and given a dosage status. Returning fire crash crew with an average accumulated dose of 90 rad are rotated to bottom priority for future duty. Duty comes at 2,200 hours when base commander orders ramp wash down. Radiation peak at 21-50 hours. Current level in rentgen per hour is 630. In center of washed area, 160. 22-20 hours. Base reported operational and able to recover aircraft. Division says get with it. Recover and report estimated time to launch. Assess and report your capability to refit aircraft from air battle damage. Also, advise estimated duration of air battle capability. This morning, base capability under fallout was only an estimate. But it was based on study and effort. And the test was faced with confidence. It was DEF CON 1. Aircraft were ready to accordingly. To noon, shelters were manned and functioning as a coordinated group. TAC warning came at 20-15 hours. No more planning, no more preparation. This was it. Birds drop in through 400 rentgen per hour. Mission maintenance personnel given 30 minutes state time for an average predicted dose of 58 rad for the mission. 23.05 hours. Maintenance control reports second rotation personnel dispatched. First rotation personnel coming in. Average predicted dose to complete turnaround, 62 rad. Predicted dosages for first rotation personnel are converted to actual. Reported to command post. DM requests six specialists for an estimated hour's work on engines of recovered defective airplane. Maintenance control reports four specialists with minimal doses. But they accomplish the work with non-specialist assistance. They could. Four vehicle maintenance personnel dispatched to hangar two to assist aircraft engine specialists. Reports turnaround proceeding on schedule. Command post prepares to advise division. Communications control reports loss of emergency calm. Two specialists now investigating. Trouble is reported recoverable. Assistance of two more specialists requested. Could one do the job? Yes, but one specialist dispatched. Estimated time to complete work 15 minutes. Maximum state time 30. Division advised by calm relay of group readiness. Reply, standby to launch. Firefighters control reports shelter intensity high. Five men showing signs of radiation sickness. Three of them segregated with nausea. All dosage levels rising faster than anticipated. Request permission to go outside and wash down the roof. Permission denied. Firefighters ordered evacuated to maintenance bunker. Manpower pool personnel given 20 minutes state time to assist. 2340 hours. Fourth hour of operation from shelter. Command post reports launch accomplished. No replacements for radiation casualties anticipated immediately. The base is ready for further orders.