Dear students, dear students, I know it's Monday, we're all groggy, psychology is the last thing on our mind, but life has to go on. Today's lecture is a unit in Objects Relations Theory and so your reading assignment is Balint, B-A-L-I-N-T, Autorank, Spitz, Bowel Bay, Guntrip, Winnicott, and Feber. The ego evolves. There is a big debate whether, when the baby is born, the baby has an ego, or whether the baby develops an ego, evolves an ego, as he grows up. It's a big debate. Freud says one thing, Melanie Klein says another. The very concept of ego is very contentious and derided actually by modern psychology and modern psychiatry. It's no longer used in respectable circles and in universities, especially in the West where there's an emphasis on experimentation, laboratories, white codes, and pretensions to science. The ego evolves, it is molded, it is jump-started via external object relations. The baby forms, the ego develops it, begins to get in touch with it, senses it, emerging, only when the baby interacts with other people. Now of course the first person is mommy, she is the primary object. The mother is the first to provide the baby with a sense of externality. There's something out there. Initially the baby is immersed in this oceanic feeling. We are the world. He cannot make a distinction between himself and objects out there, and mommy is the first who provides him with this external internal dichotomy which gives rise to the ego. As life progresses, within the formative years, especially by the critical age of two, the baby had encountered other people, had accepted and realized that these people are not within himself, they're not part of himself, they're not extensions of himself, but they're autonomous independent entities with agency. And this is a trauma of course, but he overcomes it. And an ego is born, or an ego evolves. The ego derives strength and a sense of reality from these interactions with external objects. Of course, if the interactions are fraught with fear, with dread, with terror, with unpredictability, with absence, with rejection, with humiliation, with violence, regression, with negative emotionality and affectivity, if the external objects do not provide the baby, later the toddler, with what he needs emotionally, love, unconditional love, acceptance, warmth, receptivity, predictability, structure, order, justice. If the external objects are arbitrary, capricious, narcissistic, selfish, absent, dead mothers in Andre Green's term, if the external objects frustrate the child much more than they gratify the child. The child has a problem with his or her ego. It's not evolved. It remains stunted, stilted. It remains primitive. It remains fragmented. It does not integrate. Such a baby grows up, becomes an adolescent and then an adult without an ego. And we call this kind of people narcissists or schizies. One of the strategies that such a baby develops is a fear reaction, a flight reaction. It's very frightening.  Such a parent is an infinitely ominous figure. The child's dependence on the parent is total and absolute. The child cannot survive without the parent. And a bad parent is essentially a death verdict. Now, healthy children who are born luckily for them to healthy parents, they seek pleasure. There is a pleasure in interacting with the parental figures and later with role models, peers, etc., by extension. There's a pleasure in interacting with external objects and Freud called it the pleasure principle. Now, the pleasure principle later is regulated via the reality principle, which its seat is in the ego. The ego embodies the reality principle and controls the pleasure principle, which is the id. But such children would be pleasure-seeking. Children who are born to dysfunctional, threatening, bad parents, such children will prefer safety to pleasure. They have a flight reaction. And what's the only way open to them to be safe? Not being. They want to undo their being. They want to not be. They want to become absent. They want to become a void, an emptiness.  A mother can never abuse an absence, an emptiness, a void, deep space. How do you abuse a non-being, a non-entity? You can't. So by undoing one's being, by becoming an absence, one actually defends against the fear, defends against the abuse, the mistreatment, the dread, and the terror and horror of being at the mercy of a hater. Being at the mercy of someone, at the total mercy of someone who doesn't love you. So absence, emptiness, ironically, ego-death, they are very common among narcissists and schizoids. Because they are common among both narcissists and schizoids, there's been a got-off on confusion at the very beginning between the two. And in the 60s, narcissism was considered a schizoid manifestation, a subtype of schizoid phenomena or schizoid disorders. But narcissism is not a schizoid phenomenon. It's not a schizoid disorder. It's intimately connected with a schizoid disorder, intimately connected with a schizoid style, schizoid phenomena, schizoid lack of emotions or lack of access to emotions, schizoid absence, schizoid withdrawal and avoidance. They are all supremely intimately connected with narcissism. They are twins, but they're not identical to each other. Narcissism is an attempt to avoid the schizoid solution. Not to remind you, the baby is tormented, tortured, horrified, terrorized by bad parents, absent parents, selfish parents, abusive parents. And he feels that his life is in danger. It's a life-threatening situation. So he chooses to undo his own birth. He chooses to go back to the womb. He wants to go back to the womb. He wants to say, okay, I don't like this world. I don't like mommy. I don't like anyone here. They don't love me. They don't give me what I need. I'm terrified. I feel very frightened. I want to stop the world. I want to get off. I want to go back to mommy's tummy. I want to disappear. I want to go back to the womb. That's a schizoid solution. I don't want to have emotions. I don't want to have relationships. I don't want to acknowledge the existence of external objects. If they do exist, I feel threatened. I feel suffocated. I feel like they can kill me. I feel like dying. I don't want anything to do with other people. And I don't want anything to do with my internal world as well. Both of them out. So this is the schizoid solution. Narcissism is an attempt to maintain object relations in the face of the schizoid solution. It's an attempt to avoid the schizoid solution. Because as you see, the schizoid solution is mental suicide. And no one wants to die really. So narcissism is a kind of middle of the way home, kind of a compromise. We'll come to it in a minute and we'll come to your role in this compromise, your critical role as the narcissist's intimate partner. And why the narcissist insists on having an intimate partner is without an intimate partner, he cannot implement the narcissistic compromise. So the narcissist is a child or an adolescent or an adult who feels threatened by the schizoid solution. Because the schizoid solution is psychological suicide, is cutting yourself off from the world, is having nothing to do with people, is not experiencing any kind of emotion, is the undead, it's the living dead, it's to zombify yourself, mummify yourself. So narcissism is an attempt to avoid this. And how does the narcissist avoid the schizoid solution via grandiose fantasies of invulnerability, omnipotence and omniscience? Let me explain the logical sequence. The baby says, I'm terrified. I'm terrorized. I feel my life is in danger.  She's a bad mother. She hates me. She does or she doesn't love me. She doesn't hold me. She doesn't contain me. She doesn't support me. She doesn't allow me to separate or individuate. She objectifies me, instrumentalizes me, parentifies me horrible. I can't live like that anymore. It hurts. It hurts a lot. This abuse hurts a lot. So I'm going to pretend that I am not vulnerable, that I cannot feel pain, that I am omnipotent like God, that I'm omniscient like God. I'm going to pretend that I'm God.  So the narcissistic child or the child in the process of becoming a narcissist converts himself into a divinity, a God-like figure.  So there are two solutions now. One is to go back to the womb, to unborn yourself, to unborn yourself, to become the undead, to become a zombie. The second solution is to be born again. So to become another entity, you were born as a vulnerable, fragile, small child, totally dependent and in need of these parental figures who had let you down and frustrated you. So now you will be born again. This time, the SD exact opposite of this child, you will be born as God-like, omnipotent, omniscient, invulnerable, etc., etc. You will be reborn as a God. It's a metamorphosis, like Kafka's metamorphosis, but this time you're not born as a cockroach, you're reborn as a God. So being reborn as a God is a solution, or being unborn and becoming undead is another solution. And one solution is fighting the other. Narcissism is an attempt to suppress the schizoid solution, to somehow remain alive, to somehow remain in touch with reality, to somehow have relationships with external objects. However, thwarted, deformed and dysfunctional these relationships are, they're better than nothing. They're better than the schizoid solution, where there are zero, no relationships. And this self-concocted, self-invented, invulnerability, omnipotence, omniscience, the locus of these is the false self. The false self is a construct, but the false self ironically again, paradoxically even, represents a compromise. It's a compromise. The child says to himself, I'm being abused, I'm being maltreated, I'm being mistreated, I'm being ignored, I'm being instrumentalized, I mean, I really feel bad, I'm really hurting. The pain is unbearable, intolerable, I'm overwhelmed. I have emotional dysregulation. Right. So how to solve this? I don't want to die. I don't want to become a schizoid.  I want to have contact with people. I want to go out. I want to experience some emotions. I want to see flowers. I want to see sunshine. I don't want to die. I don't want to go back to the womb. I know it's a solution. I know it's a perfect solution. If I absent myself, if I convert myself into an emptiness, avoid, it's a solution because no one can abuse torture and torment, avoid or an emptiness or an absence. So schizoid solution is verifications, self-effications. But I don't want that.  I want to stay alive as much as I can under the circumstances.  But the external object relations are not with a person, not with a narcissist. The external object relations are with the false self. The external object relations are maintained but they are one step removed and they take place with the decoy, with a facade, with a construct, with a piece of fiction, the false self. So anything bad that happens in external object relations, anything bad that happens in an intimate partnership, in a business transaction with friends, anything bad that recreates the experience with the rejecting parental figures, is not happening to the narcissist. It's happening to the false self. The false self kind of attracts the fire. That's why I call it a decoy. So the narcissist discarded the schizoid solution. The narcissist says, I'm not going to become a schizoid. I'm not going to withdraw from the world. I am going to have relations with other people, external object relations. I'm going to experience emotions of some kind. I'm going to reach out to the world somehow. But because I'm terrified, because I'm traumatized, because I had been abused, because I can't tolerate this pain, should it happen again, I will not survive.  I'm going to invent a wizard of us. I'm going to invent an artificial creation. And I'm going to tell people, please interact with that thing, with this entity, with this self, not with me.   Motification. This is known as modification. I don't want to be modified. It's life threatening.  I had created the false self for you to interact with.  Leave me alone. Leave me alone, because I'm fragile, I'm vulnerable. I can die. I don't have an immune system. I am immune or compromised. I cannot protect myself against the virus of love. This love is pain. So please direct all this energy at the false self. He can take it. It can take it. And so the false self is actually a combination, a compromise, because there is a facade. There is a firewall. There is an outward public-facing kind of visage, mirage, fantasy that maintains object relations, maintains touch with reality, however distorted. And behind this facade, behind this mirage, behind this stage set, there is a schizoid inner absence. The narcissist's combination, internal schizoid state, external object relations, one step removed. External object relations are maintained in narcissism, but not with the narcissist. They are maintained with the work of art, with his creative effort known as the false self.  It's an egoless state. It's exactly like being unborn where a real core should have been. There's nothing howling winds, empty corridors. It's an abandoned castle, an abandoned castle. And the fortifications of the false self, the enemy is going to attack the fortifications. The castle is secure. So the narcissism is a combination, schizoid state plus functional object relations, functional for the narcissist, dysfunctional for other people.   We will discuss this, the fetishistic element in the solution a bit later. When the narcissistic solution fails as well, you remember the narcissist rejects the schizoid solution, adopts the narcissistic solution, which is a compromise. Okay, I will become a schizoid, but I will maintain object relations via a false self. When this solution fails, there's modification, and then the narcissist becomes 100% schizoid. He withdraws, he avoids, he vanishes, he absents himself from himself. If he experiences firsthand what it is to not be. It's not a feeling of safety because for the narcissist, the schizoid state is threatening. For the classic schizoid, the schizoid state is safe. It's not egosyntonic. The classic schizoid resents his schizoid incapacity, his schizoid disability, but he feels safe. The narcissist doesn't have even this. He resents the schizoid core, the schizoid nucleus, the absence, the emptiness inside himself. He resents it and he doesn't make him feel safe. On the very contrary, it makes him feel like he is disappearing. Modification is the sensation of vanishing, evaporating into molecules. Like narcissism, paranoia and depression are also defenses against the schizoid state. If external object relations are too threatening, if contact with other people is hurtful or potentially hurtful, and if there is zero tolerance for pain and hurt, there's hurt aversion, pain aversion because the inner structures are fragmented, they're dysregulated, they're labelled, there are numerous self-states. The whole thing is a precarious house of cards which is going to disintegrate. The whole edifice is going to crumble under the slightest pressure from an external object. Paranoia and depression are defenses against the schizoid state. The schizoid state is a defense against external object relations, so we have a defense against a defense. If external object relations are too threatening, you could choose to not have external object relations at all. That's of course possibly the psychotic state, but there are compromises. Narcissism is one such compromise. Paranoia and depression is another such compromise. It's the next best thing. You can have external object relations, but you can have internal object relations. In schizoid state, there's no ego, there's no external object relations at all. In the paranoid, depressive, narcissistic states, there is object relations, there is object relations with external objects, but they are internalized. They are converted into internal objects in order to maintain full control, avoid abandonment, avoid persecution in the case of the paranoid, or avoid guilt in the case of the depressive, to avoid negative emotionality. So let's sum it up. A child who has been exposed to a bad dead mother, bad dead father, bad caregivers, but a child who did not experience as a baby and a toddler, did not experience proper, happy, loving object relations with external objects.  So such a child has several solutions available to him. Number one, such a child can become schizoid. He can cut off the world, he can disengage from all humanity, he can lock himself, withdraw, abandon everything and everyone, and this is actually to choose death, to become the undead, to become zombified, to go back to the womb, to be unborn. Solution number one, solution number two, he can become a narcissist, he can become a paranoid, he can become depressive. These three solutions, what they have in common, is that object relations is maintained. There is the inner schizoid core, there is the inner emptiness, there is the absence, the person has been unborn, the person went back to the womb, is undead, is a zombie, but desperately tries to cling to the vestiges and remnants of a world. Desperately wants to be in touch with another human being, wants to feel loved, wants to experience intimacy, somehow, even if it's a mild, pale version of the original, a pale imitation, so be it, he wants it desperately, so he rejects the total schizoid solution.  And then internalizes these external objects who are interacting with the false self, internalizes them so that he can maintain full control over them, so that they don't betray him, they don't persecute him, they don't accuse him of anything, they don't cheat on him, it's by internalizing the external object, the narcissist makes sure that this object, who used to be external and now is internal, will never abandon him, never betray him, never stab him in the back, never persecute him, will never hurt him, will never cause him pain, pain that he cannot tolerate, modification, so these are the two mechanisms and they are common in paranoia and they are common in depression as well. Internal objects can be persecutory, for example the inner critic or the sadistic superego, but the narcissist experiences these persecutory objects as external, remember the narcissist confuses internal with external, he internalizes external objects, he internalizes you for example, but he still experiences you as an external object, though you had become an internal object, though he is interacting exclusively with the internal object, his experience of this is internal object is wrong, erroneous, he believes this internal object to be external, now if the object is persecutory, it creates paranoia, because even though it's an internal object that is persecutory, it is projected, it's experienced as external and this creates paranoia and paranoia creates aggression, defensive aggression similar with love, with emotions, the narcissist internalizes you, supposing you are his intimate partner, supposing he is attracted to you, saturated with you, wants you, wants you in his shared fantasy, so first of all he directs you to the false sense, he redirects you to the false sense, that's the decoy, that's the protection, that's the firewall, that's the shield, no pain, no hurt, one, two, he internalizes you, he takes a snapshot, internalizes you and from that moment on he continues to interact with internal objects, but he experiences you as external, he mistakes the internal object for an external object and gradually you can become the secretary object, in which case he will develop paranoia and he will seek to destroy you, this will provoke aggression which will be directed at you, even though it was the internal object that had generated the persecution, he will punish you because he mistakes the internal object for you and mistakes you for the internal object, he doesn't realize he has an internal object, he thinks it's you and when the internal object engages in any dynamic, he attributes this dynamic to you, he projects it onto you, if he's persecuted by the internal object he says you are persecuting me, if he's accused by an internal object, if he feels guilty because he's accused by an accusatory internal object, he says you're accusing me, he attributes it to you, he says you're criticizing me all the time, you're accusing me all the time, if he's loved by an internal object, he similarly would attribute it to you, if he's idealized by an internal object, he would also say you're idealizing whatever the internal object does within the narcissist, because he mistakes it for you, he will attribute to you via a process of projection, the schizoid chooses the safety of withdrawing, of avoiding reality, of denying access to external objects, but the schizoid also has no access to internal objects, for example the internal object representing his mother, and his only solution is what Guntrip and Fehrbern and others call identification, identification the other solution is incorporation, in other words schizoids because they don't have access to external objects, they cut all external object relations off, they're not in touch with people, they're solitary, they're lone wolves, okay they also don't have access to internal objects, so what they try to do, they try to merge, they try to fuse, they try to assimilate, they try to disappear, they already disappeared, they're absence, they're emptiness, so they try to integrate, to become one with an existing object, they are an absence in search of a presence, non-entity in search of an entity, and this is going back to the womb, going back to the womb for example is assimilating the external object that his mother and the internal object that his mother which are inaccessible, by going back to the womb the schizoid becomes one with these objects again, and going back to the womb is of course an allegory, a metaphor, by withdrawing into confined spaces, this is the core function of the pathological narcissistic space, all confined spaces where the narcissists and the schizoid feel safe, they are womb substitutes, will come in a minute to the codependent and the borderline, because they choose an identical solution, merger, fusion, assimilation, going back to the womb, the narcissist chooses the pleasure, not the safety, but the pleasure of approach because approach allows him to master external objects via grandiosity, via exploitive entitlement and via internalization, so the schizoid chooses to, because he has no access to objects internal or external, he chooses to become the object, if you have no access to objects the next best strategy is to become the object, because anyhow you don't exist, you have nothing to lose, you want to become the object, so the schizoid wants to become his mother by going back to the womb, the borderline and the codependent want to become the intimate partner, merger and fusion and codependency, borderline, schizoid states, assimilation, they are all second best solutions, I can't have access to external objects because I'm terrified of what may happen, I'm afraid of the pain, abandonment, I'm afraid of abandonment in borderline personality disorders, I don't want external objects, I don't want external objects, no thank you, I don't have access to internal objects because everything there is disorganized, discombobulated, chaotic, fragmented, I don't have proper access to internal objects, so what I will do instead, I will merge with an object, I will fuse with an object, I will become an object, another object, I will become my intimate partner, I will become my mother and that way I will get to live, I will get to survive and I will get to experience reality and even object relations safely, simply by vanishing and reappearing, born again, the narcissist is reborn, born again as the grandiose false self, the borderline, the schizoid, the codependent are reborn, born again via the agency of another person, usually an intimate partner, frequently an intimate partner that stands in for a parental figure, mother or father, all these solutions are regressive of course, they're all infantile, they're all a child's solutions but these people never grow up, all these people, narcissists, schizoids, borderlines, codependents, they never grow up, these are children coping with adult issues, with children's tools and instruments, with the children child's capacity of comprehension, with the child's insights, almost non-existent, so when you see these solutions they are of course infantile and regressive, they are a child's solution, codependency and borderlines exactly like the narcissist, they are composites, remember the narcissist solution is I'm going to be schizoid, I'm going to disappear, I'm going to become an absence, but before I do that I'm going to create a false self and via the false self by proxy, vicariously, secondhand, I'm going to experience reality, the world and I'm going to experience external object relations, borderlines and codependents have a similar compromise, a similar composite solution, merger and fusion are actually a compromise, they are a composite solution because they allow the borderline and the codependent to feel both safe and pleasurable, they provide pleasure and they provide safety and this is accomplished via pseudo-psychosis, that's why Kernbeck said that borderlines are borderline, they're on the border with psychosis, in codependency as well as in borderline there's pseudo-psychosis because they do exactly the opposite of the narcissist, you see all these three, actually all these five, the narcissist, the paranoid, the depressive, the borderline, the codependent, all five were faced with a grave life and dangering threat, the schizoid state, all of them faced the possibility, the distinct possibility of self-inflicted extinction, terrified, they all chose different solutions, the narcissist solution was to internalize external objects and thereby control them, that's a solution, what you can, what you control cannot hurt you, the borderline codependent chose exactly the opposite solution, they externalize internal objects, the mother's womb that the schizoid, schizoid wants to go back, wants to go back to, the codependent borderline externalized the mother and her womb, they externalize internal objects and they mistake external objects for internal objects exactly like the narcissist, so it gives them a sense of safety and a sense of security and pleasure because they are inflationary, what the narcissist does, he takes the world and swallows it like Kronos in the Greek mythology, he swallows external objects and they become internal and he feels safe and he has the pleasure of interacting with external objects by other force, the borderline and codependent expand themselves like the big bang, they go out, this is called hyperreflexivity, it's common in psychotic disorders as well, they externalize internal objects and then they get confused, they think that their internal objects are actually external exactly like the narcissist, so one of them swallows and assimilates the world, one of them is assimilated in the world, one of them renders everything external, internal, that's the narcissist and the borderline and codependent render everything internal external, they kind of disintegrate, evaporate and become one with the world, it's not the world, it's the intimate part, so the borderline and codependent solution is I'm going to disappear and reappear in my intimate partner's mind and body, I'm going to merge with my intimate partner, I'm going to fuse with my intimate partner, it's all very religious because there's a process of dying in resurrection and this is probably the power of the biblical narrative, because dying in resurrection are the core principles of mental illness, at least in cluster B personality disorder, but I think in many other situations like paranoia and depression, so attempting to cope with an impossible, threatening environment, people, children come up with solutions that involve dying in one way to gratify the parent because the parent is rejecting, the parent's message is I want you dead, I want you to die, you're a nuisance, you're, I don't know what, you're disappointing, you're frustrated, I don't want you, I don't love you, I want you to die, so the child says okay mommy, I will die, I become schizoid, but I don't want to die, I want to be in touch with the world, I want to be in touch with, so they come up with these composite solutions with these compromises and they become the world, or the world becomes them and they confuse external and internal all in desperate attempts, desperate attempts to maintain hold on reality and interact with other people and in this sense being abandoned, abandonment is the equivalent of birth, auto rank suggested the concept of traumatic birth and in the minds of these personalities, narcissistic, borderline codependent, being abandoned is the equivalent of being born, but they don't want to be born, they want to be dead, they want to be the undead, they want to be dead but in touch, so the borderline is dead inside, the codependent is dead inside, but their solution is I will accept that I'm dead inside, but I will live outside and how will I do that, I will disappear and reappear, resurrect, be reborn as my intimate partner, the narcissist solution is I'm dead inside, I accept it, it's painful but I accept it, I'm gonna reappear, I'm gonna resurrect as the false self, that way I'll be in touch with reality, but being abandoned when these people are abandoned, the solution falls apart and it's like they went back to the womb, they did, they went back to the womb and now they have to exit again, they have to be born, they have to be, they're forced into the world and into external object relations not mediated via the solutions or compromises that they had come up with as children, this is the process of modification, abandonment causes modification by eliminating the false self, by eliminating the persecutory object in paranoia, by eliminating the accusatory object in depression, by eliminating functional internal objects and replacing them with the same thing from recognizable external objects, so in the case of the depressive, the accusations come from a real life person, not from his inner object, in the case of a paranoid, he's really persecuted by a real person conspired against, malice, in the case of the narcissist, he suffers narcissistic injury and humiliation at the end of a real life person, so abandonment is when these defenses are shattered in a process called this decompensation, all the defenses shut down and all the internal objects are demolished because they critically depend on the operation of these defenses, they are either demolished or inactivated, at that moment the narcissist for example cannot operate any grandiose defense, his false self is shut off, so he has no grandiose defenses, he's not got like anymore, he's a mere mortal, vulnerable, fragile, so the narcissist has no grandiose defenses and can no longer control, manipulate his internal objects because they are equally shut off or even destroyed, so he's absolutely back to the first months of life or the first two years of life when he had been terrified by a rejecting hateful dead mother, because at that time before he had come up with a narcissistic schizoid solution, during these years before he had invented the false self, it was raw terror, raw horror and abandonment or any other crisis like being cheated on or bankruptcy or divorce or what they do they disable the defenses and they deactivate or destroy the internal objects, at that second the narcissist feels that his world is spinning out of control, external objects are no longer internal, they cause him pain and he cannot master them, tell them what to do, control them and he falls apart, this extreme anxiety, decompensation, acting out and in many cases there is a self-state, the protector self-state, usually a secondary or primary psychopathic self-state and this self-state comes forward, comes forward for example the borderline, when the borderline is subjected to rejection, abandonment, humiliation, real, imagined or anticipated, the borderline brings forward a self-state, a psychopathic self-state, it's a secondary psychopath, it's a psychopath with access to empathy and emotions but it's still a psychopath, it's impulsive, reckless etc, disempathic, so empathy is suspended, so the protector self-state takes over in such a case in order to avoid modification but it usually doesn't work actually, modification is only minimally delayed, a major object relations crisis, major crisis with an external object such as abandonment, cheating and so on is bound to bring modification, so what are you therefore, what's your role as the narcissist intimate partner, you are there to facilitate this solution, the narcissistic solution, you are there to serve as the narcissist womb, as his mother's womb, you are the womb, I want you to understand how critical, supremely critical your role is, now the narcissist would deny this because he is a schizoid remember, at core, the core of the narcissist, the non-existent core is absence, schizoid absence, so if you interrogate the narcissist they would tell you she's interchangeable, she's dispensable, she's disposable, she's like a bus, they come and go every 10 minutes but really your function, your role in the narcissist life is regulatory and life sustaining, let me put it this way, if you modify the narcissist, this is the closest that he comes to suicide because he becomes effectively a borderline, dysregulated emotions and everything, all these defenses crumble and we know that when these defenses crumble, narcissists develop borderline traits as do victims of complex trauma by the way, so you are there in the narcissist's life within his shared fantasy, shared fantasy is a controlled space because the narcissist can't take chances with you, he can't have you improvising, he can't rely on your good will, judgment, moods, affects, cognition, no, no way, he's not going to trust you with anything ever, he's going to take you by the hand, he's going to convert you into an internal object and he's going to embed you firmly in the ground of the shared fantasy, that way he feels safe but within the shared fantasy, your main function is to be the womb of his mother, the place where he can go to when he is in the schizoid state, you are the womb, you are the found and source of the oceanic feeling of safety that he experiences when he is with you, never mind how much he abuses you, never mind how much he fights with you, never mind how much he says he hates you and he does, still you are the womb, you are the safest, most holding, unconditionally accepting place where he can shed some of his narcissistic defenses and indulge in or experience fearlessly the schizoid state, you have another function of course, secondary narcissistic supply, your function is to affirm the reality and the veracity of the false self, you tell the narcissist the false self is not false, it's true, it's real, so you have two functions, the most important one, you are the safe zone, you're beyond the comfort zone, you're a safe zone, it's to you that he goes when he needs to let go and become a schizoid, you are his schizoid sanctuary and the second thing is you uphold and buttress and so forth, his grandiose false self because it's the only way that he can have any relationship with you, you're an external object, he has relationships with external objects only via the false self, it's not safe to have a relationship directly with you, it needs to be mediated, filtered, firewalled, evaluated, assessed, accessed, reframed, whatever, via the false self and its grandiose fantasies, remember that the narcissist misperceives you as an external object when actually he had internalized you already, in order to guarantee your functioning, in order to control you, manipulate you, prevent abandonment, the first thing the narcissist did was snapshot you, took a snapshot of you and internalized you, but he mistakes you for an external object, there's a confusion in his mind, he thinks you're external when actually he's interacting exclusively with your representation in his mind, that because you're external in his mind, because you're external in his mind, wrongly, you have the power to tell him, you have the power to report to him about reality, you are in other words the narcissist's reality testing, you're the gauge, he refers to you for reality testing and the most critical question in his mind, am I nuts, am I insane, is the false self real and you are there to say, yes dear, it is real, you are a genius, you are amazing, you sort of accumulate, you record past narcissistic glories and recount them to him, sick transit, narcissus mundi, sick transit gloria nazisi, put it this way, so you are, look how many critical functions you have, you are his safe refuge and sanctuary, where he can be himself, where he can be, where he can be a non-entity, where he can be an absence, himself means no self because he has no ego, where he can vanish, knowing full well that he will rematerialize, it's like teleportation, you're the teleportation chamber, you are the one who confirms to him and assures him that the false self is not false, but real, you're his reality testing, nothing is more important, you're the mother, you're the mother in this sense, you're the womb, the narcissist internalizes all external objects, they said so, so if we take this principle you begin to understand that your existence in the narcissist mind is very, very bizarre and peculiar, take for example the famous Madonna whore complex, the Madonna whore complex is not a splitting defense directed at external objects because narcissists don't interact with external objects, they internalize them, they interact only with internal objects, so it is meaningless to say that the narcissist regards some women as Madonna's and some women as whores, it's meaningless because it does not regard women, end of story, he regards representations of women, he interacts with internal objects that stands for women, but these internal objects are very little to do with you, they go through a process of idealization and it's a mess, it's not you, so what is the Madonna whore complex, it's an internal splitting, not external splitting because there's no external object relations with the narcissist, there's no contact with external objects, so it must be an internal splitting as Gantrim had observed, the self is split, the non-existent self, I mean it's difficult to wrap your hand, your head around this, the processes, psychodynamic processes, they're split, the narcissist splits himself to all body and all mind, all mental, similar reminiscent of somatic and cerebral, yes, so all body and all mental, the all body part interacts with horish women, it doesn't have anything to do with judging these women, it's not that the narcissist is like well I'm going to look for horish women, it's that his body part interacts with women who are classified as horish internal objects and his mind part interacts with women who are classified as Madonna internal objects, they're both internal objects, the narcissist is auto-erotic, he has sex, he loves, he's libidinally invested, he's emotionally affected, all the processes are auto-directed, self-directed, so he cannot have anything to do with women even during sex, but he splits himself, internal splitting, that's an example of how bizarre the narcissist world is. Now you, I said that earlier, I said that you're a fetish, to remind you the sexual fetish is originally, the fetish is when the savage saw something as the embodiment of his god, so it could be an object and the savage said well god is in this object and that's a fetish, Freud discusses this in three contributions to the theory of sex, 1905, so when you have a propensity to regard or treat other people, caregivers, parents, intimate partners as objects to objectify them, that's fetishism, when the narcissist converts you, objectifies you into an internal object, he's fetishizing you, he's treating you as a fetish, now fetishism is an inevitable phase of personal development and growth during the formative years, six months to three years, psychoanalysis and object relations theories teach us that we outgrow the fetishistic immature way of relating to external objects to the human environment, instead what replaces fetishism is empathy, when we perceive others as human beings, full fledged human beings, not objects and yet some people, narcissists for example, but not only narcissists, I mentioned paranoics, I mentioned border lights, I mentioned co-dependence, they're all the same, these people remain fixated in the fetishistic phase, they do not progress into full fledged adulthood and arguably the most ostentatious manifestation of this retardation is sexual, there's a paraphernalia called fetishism, but there is mental or psychological fetishism and it is equally rampant and equally egregious, in sexual fetishism there are three types of fetishes, inanimate object, body part or reified trait, so classic fetishes, sexual fetishes react to a specific object or specific body part or specific trait or quality of a person, the narcissist is exactly the same, he transforms you into an object and then he reacts to your traits, to your body parts, anyone who has ever had sex with a narcissist will note the narcissist's inordinate focus on specific body parts, you know, feet, breasts, the narcissist reduces his intimate partner, his female intimate partner or his intimate partner, into an assemblage of organs, assemblage of body parts and then he chooses some of these body parts as erotic, erogenous zones and he is aroused by these body parts actually, not by the totality, this sense is a fetishist, that is of course sexual fetishism, we have objective fetishes, these are fetish, people who fetishize objects, we have somatic fetishes who fetishize body parts and we have abstract fetishes who fetishize a personality trait or a body trait, the same with psychological fetishes, the narcissist fetishizes your body parts, fetishizes you as an object and fetishizes certain traits, this process of fetishizing the traits is what is called idealization, it's when you convert, when you invest emotionally and according to Freud and many others, right, there's no difference between emotional energy and sexual energy, when you invest emotionally in a specific set of traits, this is idealization, when you elevate them emotionally to a privileged position, that's idealization, so people who prefer auto erotic, partialist, anonymous sex, they are also fetishes, with the fetish being their own bodies or the organs of their sex partners, so the narcissist behaves this way in sex, is focused on his gratification, his body, he uses your body parts, he masturbates with the body in effect, but also outside the bedroom, he uses you for gratification, he reduces you, he reduces you to a set of traits, one, two, three traits, four traits and you have these traits and he can do this because he is not interacting with you, he's interacting with an internal object and he can design and redesign this internal object as he sees fit, he's in total control, so this is a pathological attachment to a fetish, but this is an internalized fetish, because the narcissist is auto erotic, even his fetishism is directed inwards, not outwards, normal fetishes direct their arousal, their sex drive outwards, narcissistic fetishes direct everything inwards, so they're going to fetishize an internal object and the idealized traits of this internal object and it's going to carry over to the sex as well, and so in the absence of the fetish, most fetishes are sexually dysfunctional, same with the narcissists, in the absence of the fetishized, idealized internal object, he becomes dysfunctional and the circumstances surrounding the fetishistic sexual encounter are not very material and similarly anyone can serve as an intimate partner or a source of supply, it's a kind of tunnel vision, it's very similar to the autism spectrum disorder, schizophrenic or somatophon disorders, it indicates an underlying mental health problem or trauma or process, okay the narcissist fetishizes you, internalizes you, he reduces you to self traits and so on and then he uses you, he uses you to uphold his false self, to establish reality testing and to become the safe zone where he can be himself, him non-self, a schizoid and this is actually your role, when you abandon the narcissist or threaten to abandon him and when you cheat on him, when you betray him as he sees it and so on, everything falls apart and he is modified, same process in borderline, same process in codependency, we can ask okay, if it's the same process in all three, aren't these three one and the same, no of course not, massive differences, I suggest that you watch relevant videos but this particular process, these defenses against the schizoid state exist in all three disorders but remember the narcissist solution is an exact opposite, the diametrical opposite to the borderline codependent solution, all three fetishize the intimate partner, all three idealize the intimate partner but the narcissist chooses to assimilate her, to swallow her, to convert her into an internal object and the borderline and codependent want the intimate partner to do it to them, they want to become an internal object in the intimate, inside the intimate partner, they want to go back to the womb but to a specific womb, a functional womb, a womb which will provide external object relations, the narcissist wants to go back to the womb but again a specific womb, a womb that will uphold his view of himself, the false self, grandiosity, so they all want to go back to the womb because they are driven by the schizoid engine, they're driven by the schizoid core but they resist this drive, they strike a compromise with the schizoid state, they say please, we will become absent, we will disappear, we promise, we will not exist anymore but please let us experience objects, relationships with objects, with other people, please and we will do it in a way that will satisfy you because we will disappear in the process of having a relationship with an external object, we will disappear by becoming the false self, we will disappear by merging and fusing with an intimate partner and we will disappear by developing extreme dependence on an intimate partner, the disappearing act is the schizoid part, it's the sacrifice, the human sacrifice to the schizoid god, schizoid idol, the what's left are the dysfunctional solutions, that these children had found in desperate attempts to not disappear, to somehow remain rooted or planted in reality, to keep one foot in reality, to somehow, somewhere with someone have a fleeting ephemeral touch of contact like a butterfly, simulated external relationships, these people crave, crave intimacy and love, crave other people, they just can't, they feel threatened and they had become schizoids early on and the borderline veneer, the codependency veneer, the narcissism veneer, these are all camouflages, they're all compromises struck with the schizoid core, allowing the person, the non-person, the non-entity to pretend in a make-believe world that she or he is in touch with other people, is loved, is held, knowing deep inside that it's a doomed effort, a doomed effort because ultimately the schizoid wins all narcissists and life, all narcissists and life alone, decomposing, decaying, ruminating and brooding on past glories, pathetically trying to recapture them and recreate them, all narcissists, all borderlines, all codependents, end up losing the battle and becoming full-fledged schizoids.


I'm Jim Proser, I'm from the University of Aberdeen, where I'm a soil microbial ecologist and I've also been FEMS Publications Manager for the last six years, and for my hero, I have chosen Professor Michael Bazin. Mike Bazin was a lecturer during my undergraduate degree in microbiology at Queen Elizabeth College, and he instilled in me the importance of mathematical modelling and theoretical quantitative approaches to microbial ecology. This has influenced my own research to this day, and I think it is essential to adopt those sorts of approaches to make real advances in our understanding of microbial ecology and other branches of microbiology. Unfortunately, Mike Bazin passed away some years ago, but his influence on me and I'm sure many other of the people he taught is still felt today and is important for the advances in microbial ecology in the future.


He's truly the cruise director. We're here to talk about secure wireless networking. Primarily building secure 802.11 networks. How many people here have a deployed 802.11 network? That's good. Now, this doesn't count in the airport in your kitchen. Hands. Hi, that's my look-it. How many people here use 802.11 X? Like five? Left. How many people here use left? That's what we expected. Alright, so background for those of you who don't have 802.11 networks deployed, I'm just going to go over the few basic wireless technologies. 802.11 B, I'm not going to go into too much depth. We'll talk about it for the rest of the presentation. But our other common choices are 802.11 A, which is just coming out, and 802.11 G, which is the next protocol that will replace 802.11 A. They are both, for most purposes, 100% equivalent to 802.11 B. Louder? Louder? Do you have a sound guy who can turn this up, please? Thank you. Do you have a mic? Is it better? Can you hear me? Alright, much better. Thank you. Okay, so we have 802.11 A, which is a 5GHz variant of 802.11 B. It's actually newer than 802.11 B. 802.11 G, which is the same performance as 802.11 A, but in the 2.4GHz band, and that's a bad idea for reasons we'll go into later. Then we have Bluetooth. Now, the only reason I put Bluetooth in here is people have asked me about Bluetooth. How secure is Bluetooth? Can we put our LAN on Bluetooth? Bluetooth doesn't really do much. It's not useful for real networking. You can have a wireless earpiece for yourself, and that's about it. Seriously, how many people hear of a useful Bluetooth device? We have one hand. What is it, sir? What do you do with it, man? He says he has a compact flash radio. He says they're doing some kind of vaporware thing, and it's not... Is it on the market? Oh, okay. Alright, so we've got one. Alright, so 802.11 B. 802.11 B is important because right now it's cheap, it's widely available, it's very, very well supported. You can find standards, you can find hardware that will work with pretty much every platform you've got, and it's just generally useful. It's effectively its wireless ethernet. If you do a raw frame dump, you're still looking at 802.3 frame dumps that look real familiar, but they push the signal out over a 2.4 gigahertz wireless signal. It's roughly the same frequency as your microwave oven, and it will cook you. Ken was talking a few minutes ago about a one-watt amp. There were reports of headaches the night they did that. It's a bad idea. Casey's crazy. So 2.4 gigahertz. You push theoretically 11 megabits. Now Ken noted that you don't actually ever get 11 megabits, you get five if you're doing pretty well, and your signal drops off if you've got something annoying like a tree in the way. So really you can expect something about half of ethernet speed. Why is that? Particle overhead. Another issue is that when a packet is missed, it's retransmitted. There is some link layer retransmit strategies. So what ends up happening is if the connection isn't clear, packets need to go over multiple times. It basically reduces your total throughput. So basically you end up in a situation where the lower your signal strength, the lesser your bandwidth. Also, it's not full duplex. So anybody here still have to administer a network with old coax ethernet? Nobody. You're lucky. Well, it's coming back. Performance blows. 802.11a is fixing that just by providing, by brute force, higher bandwidth. And 802.11g is similar. They're both 54 megabit instead of 11. So you'll get maybe 20 megabits of realistic performance. Now the basic security that everybody hears about, on the box, is WEP. Wireless equivalent privacy. It's basically RC4 reheat for every packet. And the idea is to be as secure as an ethernet network. WEP comes in two variants, 64 and 128 bits. Pretty much everybody here probably uses 64. If you do use 128, there is... Am I correct? No point? Not at all? As far as the WEP cracking, it doesn't matter, really. Whether you use 64 or 128, given the way that most of the access points sequence the initialization vectors. Basically, theoretically, you should need a few more packets to break the 128, but in practice, it doesn't matter. Hold on. Why would you know this? I happen to be the author of AirSnart, which was not mentioned at this point, but... Yeah. Please call guy. The last security measure we have is 802.1x. 802.1x is pretty common. Microsoft's deployed it. They did a pretty good job with that. 802.1x provides you with a number of features. First and foremost, you can... Can you hear me? Okay. Can you hear me now? So 802.1x is useful because it lets you negotiate a WEP per client. It also lets you re-key faster. It saves you against AirSnart, basically. If you rotate your key every two minutes, AirSnart will currently not be effective. I'll go into that a little bit more in a minute. So radio physics in two minutes. Who here is a ham operator or has a lot of experience with wireless networking? Not too many people. About 10. Okay. Point one, RF signals behave like light. There are things that cast shadows. Things with water in them are high on the list. People, trees. Trees are the big, annoying one. If you live in somewhere like Seattle, it's pretty green. But also buildings, concrete, steel, coated glass. And you see the green or blue colored office buildings. Those also provide a pretty decent shield against the 2.4 gig signal. Signals also diminish rapidly over distance. That's sort of the quick 3D graph of signal strength over distance. As you get further away, the signal drops off very, very rapidly.  Next question. Units of distance. I made it generic. Yeah. Who here is paid attention in physics class? Wow. I'm surprised. Law of inverse squares. Sound familiar? That's what's responsible for this. That's all I graphed here. And then as I said before, metal, stone, and water are the three classes of materials that you have to worry about. So skyscrapers, trees. Pretty much anything concrete. You go into a tunnel, you lose signal. Hardware. We have a couple large classes of hardware. You have the access points. This is the infrastructure that most of you are probably deploying. The access points that we've been using for Seattle Wireless, which I forgot to mention I am somewhat involved with. We use RG-1000s. They're about 60 bucks. Airports. You go to the higher end. You have the gear or blue center, whatever they're calling themselves these days. You have the AP-1000, AP-500 items in that product line. Those provide a bridge between your Ethernet network and your 802.11 network. You also have client devices. This is a Cisco Aeronet card PCI, but most of the interfaces you'll see are PCMCA interfaces and USB. Client devices come from Lucent or Gear, Cisco, Proxim. Those are probably the top three manufacturers. Of those three, they all use different chip sets. You have chip sets from Intersill, which makes the Prism chip set. Popular because it will work with the host AP code. How many people are familiar with host AP? Not too many. Go look it up. It's fun stuff. Cisco, of course, has their own chip set, which is not compatible with anything else. And then you have a gear, which has the Hermes chip set, which is what is emulated by the Prism 2. You have antennas and amps. These are the things that you attach to your radio to violate FCC regulations. You've got omnidirectional antennas and directional antennas. Those are two larger classes for directionals, which are the most interesting for doing building-to-building stuff. You pretty much have... We've got dishes, which typically will look like a big barbecue grill. I'll have a picture later in this presentation. You also have a fishbone-looking thing, which we call a yaggy. Those are pretty much... What else? We have the Pringles cans. Contrary to what Ken says, they actually work pretty well. 14 DBI's, reasonable. What else? I think that's it. Yeah, you're using the barbecue grill, right? Yeah, you can get it for 60 bucks. Where did you get it? Hyperlink? 60 bucks from Hyperlink, you can get a 24 DBI directional dish. It's an old Primestar dish. What's that? It's an old Primestar dish. It says, old Primestar dishes work. Yeah, but you gotta look around for those.  Yeah, he's saying you can take them from your neighbors. Am I correct to say that? Yeah, stand up, please. We all know who's... No, the guy behind you. Oh, come on, come on. We can bring you up on stage afterwards. Then you have an ample question. What's a good omni? Honestly, I don't use the omnis that much. We mostly use rubber ducts that come attached to access points. Hyperlink does sell omnis that look large like PVC pipes attached to wire. I've never used an omni, so... I've never used an omni. Yeah, indoors usually you end up having more problems with signal obstruction than anything else, so you just want to scatter more access points. Yeah, in general, if you've got a direction, if you're doing an interbuilding link, if you have a directional end, even in a really small little rubber duct type omni, you generally get fairly good signal strength. I know we're doing about a half a mile interbuilding link with a directional and just the actual omni that ships on the card, and we're getting really good signal strength. We can easily push 8 megabit over it, so it's pretty reasonable. Is that 8 megabits real throughput? No, okay, it didn't accept. And then amplifiers. Now, amplifiers I'm not going to go into too much. The reason being that if you want an amplifier to be truly useful, you have to have one on both ends of the connection, and if you have mobile clients, which is a typical scenario, you don't have an amplifier on both ends of the connection. Correction, if you have a 200 milliwatt prism card, it may be useful to put an amplifier on your access point, but typically it's more expense than just gathering more access points, and you run into more problems with worrying about having personnel near the radios. 2.4 gig is not good stuff. You might as well open up your microwave and let it run. So, typical network topology. This is what most companies deploy in a highly simplified form. Who here has a network that looks substantially different? Yeah, they didn't think so. Now, typically when people who don't think add wireless, they attach an access point to their client network and say, hey, we can plug all our laptops in with wireless cards and run our network. You can use your printers, you can use your file servers. It'll all work the same as if they were just Ethernet clients. Now, does anybody here see the obvious problem with this? Yeah, go ahead. Yeah, he says you don't have a perimeter, which is exactly the problem. Or you do have a perimeter, you just have a new perimeter for every access point, and most people don't put firewalls there if they're deploying like this. That's what I usually recommend is you just treat it like it's another public network, roughly as hostile as the public internet, which it is, unless you're a DEF CON, which in case it's worse. Although it doesn't work either. But separate IDS, separate firewall, put all your access points outside of that. And with that, with the firewall, you want to add a VPN and not trust any of the underlying security built into 802.11. So, you know, use PPTP is probably the most popular with Windows clients for only the reason that it's very easy to configure. IPsec is somewhat better as far as theoretical security, but who here has ever tried to do IPsec on mobile clients?  Yeah. Horrible, he says. Yeah. It's been my experience. And PPTP is generally good enough. If PPTP is not strong enough to protect your data, you probably shouldn't be on wireless anyway. So, we have a couple types of intruders. You've got the unintentional intruder, which is a pretty new type with wireless. You've got the opportunist, and then you've got the targeted attacker. So, first off, the unintentional intruder.  And in this case, you know, Windows comes and says, hey, there's a wireless connection available. Okay. If you didn't turn on a web, on your network, they don't even have to try. Windows will prompt them for everything they need. And you may think, well, he doesn't know what he's doing, so how much damage can he do? I'll get into that in a moment, but it basically comes down to a liability issue. The other class of unintentional users is, if you're in a big office building, you don't own the whole thing. You may have neighbors who pop onto your wireless network accidentally. I know people who do this, or I don't know people who do this.  And Windows XP and macOS X are the two system shipping right now that make this the easiest. Then you have the opportunists. And I also don't know any of these people. They typically run tools like Net Stembler, D Stembler. I don't know, is Hikari here? No. He's probably playing CTF. Good for him. Basically, these are tools. Who here is not familiar with Net Stembler? If you're not familiar, you're not familiar. Okay, we've got two people. For these two people, Net Stembler is a Windows application. It works with an orinoco card. And basically what it does is it lists all access points in your vicinity.  You get a pretty little signal graph showing you the information you need to hunt down the access point. Opportunists have the same liability issues as the unintentional intruder, just more so. An unintentional intruder may pop in. Question. Oh, correct. Okay. Somebody's pimping out Kizmet. I'm sorry. I forgot to mention Kizmet. His point was that Net Stembler will only find access points that advertise themselves. Most access points do this by default. In fact, I think I'll do. But it is possible to turn off the beacon that advertises an access point.  But Kizmet, as he points out, will find those networks just by sniffing raw frames and looking for traffic sent to a wireless network. So right, liability issues. Your unintentional attacker or unintentional intruder, what he'll be doing is maybe signs on to Nap Street. He's like, hey, you guys have a T1. Great. Bye-bye bandwidth. I mean, it only takes one user. 8 or 11 is more than fast enough to saturate a T1. If you've got a T3, you probably have bigger problems when somebody's on your network like this. But this liability issue, if they download child pornography, pirated software, pirated movies, pirated music, especially with the recent legislation, you don't want that being traced back to your network and not have some kind of sacrificial lamb to offer up to the feds. And if some Joe random on the sidewalk signed on to your network, that's the problem you've got. Opportunist intruders will tend to come seek out your network explicitly to do these sorts of things. Maybe they're not very technically savvy, but they'll send a little bit sketchy and they'll sign on to your network and use your bandwidth and your identification to use it or to engage in these activities. You can also just run IRC bots and wear servers off your net. I've seen this. It's pretty amusing. But obviously, nobody here wants this on your network. But for those of you who are looking for new places to host stuff, there are a lot of companies that hand out routables. I probably shouldn't say this. I'm not going to name names, but walk around with nets down where you'll find them. Okay, so you have your targeted intruders.  There aren't very many around. I've heard a number of security professionals making the point privately, of course, on front of customers that there is no such thing as a black hat. I would respectfully disagree.  He knows who you are. He knows what you've got, and he's coming to take it. They'll typically have four knowledge of your network, and when they've got whatever it is they want done, they'll leave, which makes them very hard to find. They won't keep going until you get caught. And for this reason, they're the hardest to detect of the three types of attackers. Your best solution here is to lock your network down as tight as you possibly can and make sure you have full-time security professionals like most of yourselves. So we have three classes of attacks that you'll see from these intruders. You have passive attacks, which I'll get into. Wireless segment attacks, which are active attacks that are restricted to the 802.11 network. And you have a full compromise, which is somebody's compromised the previous two, and now they're walking up the line into your wired network. So passive attack, cracking web. This is the most popular one. It's gotten the most publicity. Air Snard. A number of other tools do this as well. I won't list them all. They keep having new ones every couple months. Cracking web is pretty easy. Contrary to what a lot of people think, there's no CPU really involved. You can have an IPAC with a proper software and a wireless card, and you stick it in the bushes outside somebody's building. You come back a couple days later. You've got a web key. It's a passive attack. There's no way to detect it without physically controlling access to your premises. So you have a more than technical problem. The second problem is passive sniffers. If you do not use web or you let your web key stay static long enough for somebody to crack it, you'll have somebody recording all your traffic. This is pretty self-evident. Who here has had problems with their network traffic being taken off the wire? Not many. Who here would know? You must be paranoid. Wireless segment attacks. We call these a barbecue grill. You've got a couple of these. You're using them for business too, right? Yeah. They're 24 DBI usually. Pretty nice. About 60 bucks. Get them in the mail. Put them together in about five minutes. I'm going to take over here because I've got some of these things that are new. So I'm just going to do this little section here. Okay. So basically the wireless segment attacks that we have here. The first one is the direct client attacks. These are when you're on a network that doesn't have any security. Maybe it doesn't have web, whatever. This is basically the one that people consider us often, which is basically attacker comes on to your network. And instead of attacking your infrastructure, they just attack another client. Maybe it's some Windows box. It's got some open shares. It's got some problems like that. Basically the clients in the wireless network may assume that the network they're on is going to be pretty safe from having any attackers on it. And if you don't have any higher levels of security on your network, that's not going to be true. Another wireless segment attack is the men in the middle of attacks. There's a number of different types of these. The first one is people putting up access points. If you've got a bunch of unclued users, and somebody else starts putting up access points near your facilities, chances are some of your users will end up on their access points. If they've got the same SSID, most people won't notice. And if they can route packets back into your network, which they can if your network is open, they can men in the middle all connections. Most of you have probably played with men in the middle in SSL, SSH. Yes, how many people have men in the middle of one of those protocols? Was that? Oh, how many people are men in the middle of those protocols here at DEF CON right now? Oh, come on, admit it. I know you're out there. You can say they can't get on the wireless to do it. That's true, unfortunately. So men in the middle, the easy one is somebody gets an extra access point, tweaks a few settings, and puts it online near your user's question. How close? As far as the signal reach, usually a few hundred feet is the maximum range. If you're using special equipment, oh, that's where I was going with that antenna. Okay, so you use one of those antennas, which you bought for 60 bucks, or a Pringles can, which you built for six, seven dollars. Most of it going to the can of Pringles. You can sit in a park a couple miles away, and you can pick up signal. They have a two or three degree beam width, so you can be pretty precise about picking out targets in the middle. And another point of the directional antennas is that they do also direct the signal that you transmit as well so that you can do some men in the middle attacks from a distance because you can overpower a local omni with a directional, even with a card with a reasonable power level. And of course then you can always get to the point of amplifying the card and so on. So could someone theoretically do a rogue access point attack from across the streets? Absolutely. Another man in the middle of attack of relevance is, I'm sure some of you are probably aware of the ability of ARP spoofing, which is basically a layer two attack. It's a pretty nasty attack, and normally it can be done only on a given Ethernet segment, which is usually fairly well controlled because it's a wire that's in your building. Now at this point when you've got a wireless network up, if you don't have a web or something on it at the minimum, anyone can use these an ARP man in the middle of ARP spoofing techniques on any of the clients on your network. So basically it opens up another dangerous possibility. I'm going on to the denial of service. Unless you have any other management stuff. I'm going on to the denial of service. We discussed the rogue access point in the man in the middle part, which is a rogue access point is indirectly a man in the middle attack of this sort, maybe slightly different. Anyway, denial of service, basically denial of service is more or less impossible to prevent completely in any wireless network using a frequency based mechanism because basically worst case scenario, there's a lot of simpler ways to do denial of service. You can send a lot of packets, you can do things like that, but the worst case all you have to do is generate a lot of noise in the given frequency range in the local area. I mean, if someone's got a leaking microwave and starts cooking a burrito, it'll take out any nearby wireless networks and we've actually seen that happen in practice. The other fun one is you get one of these dishes and you get an old microwave. You take the microwave apart, take a cyclotron, attach to the dish, point a target, turn it on. You'll cook the radio. There's nothing you do to protect against this. Sorry, IPF is not good enough. Right, so basically that's a fundamental limitation of all wireless networks. If DOS is absolutely not acceptable, then basically you can't use a wireless network because they all can be DOS and it's pretty much theoretically impossible to prevent that sort of attack. Now, we haven't discussed exactly what EO21X does to a large degree, so let me give a little quick intro on it. Basically, EO21X is a mechanism which allows client-based authentication on a wireless network. Actually, EO21X is not specifically for wireless. The EO21X standard was actually made for port-based authentication on Ethernet 802 equipment. Why 802 is better? Because the web can have the same key. Right, so one of the things about 802.1X, the advantages of it over just a straight-up web is that it's actually a per-user, per-port authentication. Per-port originally was referred to a port on a switch or on a router, but in this case it refers to a macros or machine. Now, the advantage is 802.1X can be used to negotiate a web key, which is specific to that user. Now, with standard web, one of the problems with the security model of standard web is that there's a single web password that is used by the entire network.  Now, one of the users, you no longer want to have access. Maybe they're an employee and they no longer work for the company. Basically, every other one of your users has to switch to a new web key because there's one key for the entire network. Now, 802.1X fixes that problem by it has the ability to dynamically create a session web key that is specific between that user and the access point. So if you've got multiple users, they each get their own web key. The web key is different from one session to another. You can have authentication take place at a fixed interval so that the web key changes from time to time. By changing the web key, you, of course, get rid of the passive attacks on the RC4 problems, which is what Air Snored and other tools similar to it exploit. So basically, 802.1X fixes most of those issues. Now, as far as attacks go, which is what we're really covering here, there is a number of attacks on 802.1X in relation to certain authentication mechanisms. Now, one of the things about 802.1X is that it supports EAP to do authentication, which is basically a general mechanism that allows you to use any number of different actual authentication mechanisms. You can use a clear text password, not a good idea. You can use MD5 passwords. You can use TTLS. Now, some of those mechanisms were designed for EAP over wired networks, and the security model doesn't work with the way 802.1X is designed in that, basically, if you use certain types of EAP authentication, particularly the MD5 one, some other ones, basically everything except for TTLS for the most part, you'll end up having a problem in that once the user has authenticated onto the network, you can send the user a disassociated packet, kick them off, take their MAC address, and now you're talking on the network. Now, of course, by exchanging a web key, you alleviate that problem, but not all of the... 802.1X doesn't always distribute a web key. Only certain versions do, and so that's another thing that you need to make sure to do to prevent the attacks on 802.1X. But, basically, 802.1X that doesn't distribute a web key and that uses a non-two-way authenticated authentication mechanism is attackable. There's a number of different protocol attacks. There's some timing attacks. Those have been overhyped a little bit because if you're using a good EAP and you're using a web session key, those attacks are removed, so... One point I want to make is the one advantage of 802.1X is you can authenticate people as they sign onto your network, and we do have a question, yes. It's hard to track. I know Cisco does currently. All the big-name vendors, they'll have two lines. Apple has airport stuff, that's all consumer, but all the corporate lines, if you go to a Lucid and you go for an AP line, they all support 802.1X. 802.1X support is actually very easy to add. You don't actually have to do most of the hard work on the access point. You let your... Oh, Raka? You let your upstream authentication server handle all the heavy work, so far this is pretty long, and interoperability is pretty good. Although, if you go with Cisco, go all Cisco, it'll make your headaches much fewer. Oh, but the point I wanted to make, when you deploy 802.1X, a good thing to do is to add another tunneling layer on top of that, because that way you prevent session hijacking. A large software company in Redmond does this, and I'm actually pretty impressed with their implementation. PPTP, 802.1X, all over Cisco gear, all the light. Where does they're dropping all that for a gear, for what it's worth? But using something like PPTP, even though it's relatively weak, will protect your connections from hijacking. So now, unless you have anything else on 802.1X, I'm going to go into the active web attacks. These active web attacks have been... There's a number of them. There's two that I'm going to discuss in particular. Now, there's actually some documents published about these, even before the original RC-4 flaw that Airstart is based on. Now, the interesting thing is after all the RC-4 flaw, they became kind of forgotten, because they were the early version of attacks. They're harder to exploit because they require writing raw radio frames. Basically, just for those of you who are interested and you don't know this, with 802.11B, there's actually another frame level. I mean, you've got your IP headers, and underneath that you've got your 802 headers or your standard ethernet header frame. But in the case of 802.1X, there's an additional radio level frame, which is specific to 802.11B. There's a radio level frame, which most of the cards by default won't give you. They'll give you the ethernet level frame and you don't see the radio frame. There are certain cards into monitor mode, which is what tools like AirSnow or the Kismet use. And you can read the radio frames. Now, I've been talking to a couple of people about writing radio frames. I haven't done too much research into it. You can do some more into that. But basically, it's an issue which these active web attacks require. And I think that that's part of the reason that they've gotten a little less coverage. Now, as far as the actual attacks, basically, there's two really big ones that are relevant. The first attack is a known plaintext attack. Basically, it involves a person off-site. I'm going to go kind of into a little bit of the technical detail of how the attacks work, but not too much, and then I'm going to explain how that affects everyone for the people who don't care about the technical detail. So first, a little quick technical detail. Now, the first attack is a known plaintext attack. What you do is you're from another location on the Internet. Now, we're going to assume, for the time being, that you've got an 802.11 network which is connected to the Internet and that you can get packets to the 802.11 network from the Internet to be transmitted. So maybe they've got a Class C and they've got the 802.11 on Internet-rotable Class C. If it's behind a net, there's some ways you can get around it. I'm not going to go into that. Basically what you do is you, from an external location on the Internet, you send a packet to the wireless network. Now, you send a known payload in some way that you can recognize your packet when it comes across encrypted. A good example might be choosing unusual size. Now, when you see that packet come across the network and you have the known plaintext, you can use the known plaintext to generate basically what's called the cipherstream for a particular IV. Now, what that basically means is once you've got that, you can then send packets to the network, even with a web-encrypted network, even with 802.1x, and have your packets be accepted by the network. Basically, so if you can send a packet in from outside with a payload you know, you can basically, any point after that, send data on the 802.11 network and have it accepted. Even if you're not authenticated, I mean basically, this would allow you to send data from a wireless location without the permission of the people who use it. Now, there's a separate attack, which is also an active attack, which you can use to listen to data on a web-encrypted network. And basically what it involves is you listen for a packet, which is encrypted. You then make modifications to the encrypted packet, and then you make modifications to the checksum. Sorry, your question? Yes? The question was, if the Web Key changes, is this attack still valid? If the Web Key changes, you do have to send a new packet from the Internet and get a new plain text, a new Cypher stream, but basically you can do it in one packet. So unless you're changing your Web Key insanely often, it's still a problem. If you're changing the Web Key every 20 minutes, then yes, every 20 minutes, you have to perform the attack again. Basically, you can attack a network immediately. It doesn't take any packet collection, any Airstorm tools like it take a long time to collect enough data to crack the Web Key. With this mechanism, basically, you can start right in sending packets on a web network without a lot of work at all. It's actually pretty easy to attack. The bottom line is you can grab a packet off the network. First you send one, inject one of your own packets into the network from outside. Set it up encrypted. You flip some bits. You can drop it back on the network immediately. That was the second attack I'm talking about, actually, which is basically the way to listen to a network with Web, because that lets you send another network with Web. The way you listen to a network with Web is you receive an encrypted packet. Then you modify the encrypted packet without knowing what you're modifying. You basically do blind modification to certain areas where you know protocol information is stored, like the to address of the IP. If you happen to know where it was originally addressed to, you can modify it in such a way that it's now addressed to somewhere else. Then you can, because of the way the checksum is, modify the checksum so that the packet will be considered valid and retransmit it on the network. Basically, what happens is you get an encrypted packet. You make some modifications to it so that it changes where it's destined to without necessarily being able to read the packet. Then you dump it back on the wireless network. It gets decrypted and sent to you somewhere over the Internet. That one's a little more complex of attack, but basically if you have a machine on the Internet which you control, you can basically listen and read and write to a Web encrypted network. Now, there's currently no tools that I'm aware of out there that do this. I don't know if anyone is actually actively working on them. It's a fairly difficult problem due to the raw radio frames, but there are attacks that do exist. I suspect at some point someone will write the attacks. Most of the fixes to Web purely on rotating Web keys will probably at some point become damaged. How was it? Guess. If you want to flip some bits to change the destination of the packet, how do you know? If you know that they're knatted, it's usually pretty easy to guess IPs. You can re-inject the same packet over and over again and just brute force it. You only have to find the IPs once, and then once the Web key changes, you don't have to redo. Basically, if they have a Class C that's routable, you can look them up on the Internet and find out what that Class C is and modify it to Class C that you control. Like you said, if they're knatted, it's probably 192.168. Dot one dot. Yeah, exactly. Basically, it does require a little more manual labor, a little more sophisticated attacker. That's something like Air Snow that's just run and work. Blue shirt, question. Yes, it has been for quite a while. Right. It's useful for exactly one thing, and that is preventing people from accidentally signing onto your network. Yeah, and actually, Web is valuable in the sense that it does reduce the random wandering around, net stumbling, want to get on the net people, and it makes it annoying for a sophisticated attacker. By all means, deploy Web whenever you can. However, basically, currently, no, there may be some extension, say, to 1x or to Web, that will fix this problem as well. In fact, the IEEE is currently working on a new security standard, but they've been arguing over that for a long time and they'll probably continue arguing over it for some time to come. Now, PPTP or a VPN sort of solution for wireless security will make this not an issue, because those basically assume that the network that you're going over is public which, so they're not having to solve. Question? I saw some of the handouts. We had a question. Green shirt? Alright, right on. Yeah. Well, what's up next? Oh, okay. Somebody fully compromised your network. This is pretty simple stuff. They own some of your work. They own some of your clients maybe, steal your authentication information. Then, the next step is they need to compromise either your VPN box or your firewall upstream, assuming you have one. If you don't have one, it's not an issue. And then they start attacking your upstream hosts. This isn't really merit much discussion. They can print to your printers, pull files off your file servers, attack anything they could attack if they're sitting at one of your desks. So, the big deal with this is, somebody's got a directional antenna and they're sitting offsite, but they can get themselves bridged onto your network. They can do a man-in-the-middle attack against one of your wired hosts, talking to the internet or another wired host. That is, I can sit with a laptop a mile away and pretend to be your gateway and take all of your traffic. And that's bad. Because even if you've got a policy of not trusting your wireless hosts, and steal every file that moves on and off your file server, pretty much any other piece of data. Plus, I can do SSH and SSL man-in-the-middles. Who here has had a problem with SSL man-in-the-middles? Well, you seem to create problems, man. Yeah, you do. So, very few people. But it is an issue. If somebody goes to the trouble of compromising your network to that extent, they will get, yes, keep your network secure Quick Solutions, VPN, PPTP and IPsec. Who here is not familiar with both of those? Good. This is better.  Enable Mac filtering. Mac filtering is pretty weak. It's the sort of thing that somebody like Microsoft uses when they do a wireless product demo on stage for future reference. Next time they launch a new version of Windows. Check for rogue access points on a routine basis. There are tools to do this. Net Stumbler is a good one. Just do a walk around of your area and make sure that you know every access point that's up and you control it. And also carefully monitor all your logs. Yes. The question is, can you isolate the attacker and send them something like a virus? I was going to say, whoa, yeah, take over as AOL account. Yeah. Should I say anything here? Really? Yeah, you can kind of find them. The advantage of wireless is if you know what you're doing, you might be able to actually physically find them and meet space and beat them down. Other than that, no. It's just like somebody plugged into an open ethernet jack on the side of your building. Good luck finding them. You know what the IP address is. It's still IP. I mean, what are you going to do to them? You don't know? You can DOS them. Great. DOS your network. So, yeah, secure wireless network. The wireless is another border, just like the internet. Do we have anything else we wanted to add, like big deal stuff? No. For more information, you can ask my email address and his email address and a website that doesn't exist yet. In a day or so that will contain links to all the papers that have come out, obviously for problems, the other ones I was talking about, a bunch of other different attacks for people who want real deep technical info. Still good to questions? Yeah. That site will be up just as soon as the wireless network here works. Make sure the wireless network gets working again. Maybe set up a slightly protected network for people who actually... Questions? Yes. You can transmit as far as you can receive. You get a directional antenna in your good shape. Pringles can antennas take an hour to build. So, if you're really strapped for cash, questions? Yes. Sorry, I can't hear you. The question is, how secure are they? They're secure as any of their other products. I believe FX actually gave a talk on attacking embedded devices. I actually missed it, but usually they have pretty weak IP implementations if they have remote administration. You can do things like... Remember the code red versus Cisco 675 thing? A couple of you. You can usually knock over hardware like that pretty easily, especially if it's from, like, Linksys. 8021, whatch? Oh, Vaporware standard, one of them. There's many. More questions, yes. It depends what you're looking for. If you're looking for easy stuff, you're better off with an Omni. Like, if you're in San Francisco for a meeting and you realize that you don't have a net connection, you don't want to pay... What do they call it, T-Mobile now? Yeah, whatever, Starbucks. You get out an Omni or just your card and walk around the streets and realize that there are, like, 3 billion open access points. Actually, if you've got time and you're looking for more interesting stuff, like, in Seattle, you can go up on a hill, get an directional antenna to start scanning downtown. It depends what you're up to. Yes, a green shirt. What's that? Air stored under BSD. I have a question. Oh, is there air stored under BSD? I believe there's another tool under BSD. Is your car in here? I've never seen this before. No, yes, no. There's... Yeah, it's part of BSD air tools, along with de-stumbler, et cetera, et cetera. The guy in the back there.  Oh, you're Gandhi, right? No, sorry. You're Joe. Ah, okay, whatever. I was drunk. Oh, the question is triangulation of physical location. It is possible to triangulate physical location with directionals. In fact, actually, we've been kicking around a project just for fun of setting up a couple directionals, having them scan from a couple different locations downtown, Seattle, and then put up access points in a three-dimensional map where they're located. Generally, any kind of triangulation thing is slow and fairly difficult. If you've got an attacker and you want to find out where the attacker is coming from, it's probably not going to be real easy, but if you've got some time, you can triangulate. Well, yeah, because of the threat spectrum and pointing it out here, it's harder to pick up with any kind of standard, just pure radio equipment. You have to basically use NATO 211 equipment to even tell what you've got. And then you end up having to use the signal strength that thing returns. Right. What's that for you? Because a bunch of PhDs wrote that. Yeah. You can get signal strength off most cards. Yeah, basically, you get signal strength for most of the existing cards. The current cards have signal strength support, so you could just basically use the card. You could aim a directional around. I'm not talking about the time-based triangulation. I'm talking about a directional antenna-based triangulation. Yes, that's true. Any other questions, yes, about which? Right? Leap. Leap is a Cisco standard, which is basically a Web-key rotation standard. It's reasonable. It's basically an earlier implementation that's similar to what NATO 211X became. Again, there's those two attacks which may eventually be real that it would be susceptible to other than that, it's a pretty good standard. It's superior over straight web. Certainly, it's per user. It's similar to what NATO 211X and what it's capable of. So, thank you everybody. We will be reachable at... What are we going to be? CTF area, or the bar, or the largest concentration of alcohol in the premises, like Caesar's Challenge tonight. Oh, and by the way...