Janji Politikus

14 April 2020

Why (I Believe) WADA Was Not Hacked By The Russians

Disclaimer: This is my personal opinion. I am not an expert in attribution. But as it turns out, not many people in the world are good at attribution. I know this post lacks real evidence and is mostly based on speculation.

Let's start with the main facts we know about the WADA hack, in chronological order:

1. Some point in time (August - September 2016), the WADA database has been hacked and exfiltrated

2. August 15th, "WADA has alerted their stakeholders that email phishing scams are being reported in connection with WADA and therefore asks its recipients to be careful" https://m.paralympic.org/news/wada-warns-stakeholders-phishing-scams
3. September 1st, the fancybear.net domain has been registered

   Domain Name: FANCYBEAR.NET
   ...
   Updated Date: 18-sep-2016
   Creation Date: 01-sep-2016

4. The content of the WADA hack has been published on the website
5. The @FancyBears and @FancyBearsHT Twitter accounts have been created and started to tweet on 12th September, reaching out to journalists
6. 12th September, Western media started headlines "Russia hacked WADA"

7. The leaked documents have been altered, states WADA https://www.wada-ama.org/en/media/news/2016-10/cyber-security-update-wadas-incident-response

The Threatconnect analysis

The only technical analysis on why Russia was behind the hack, can be read here: https://www.threatconnect.com/blog/fancy-bear-anti-doping-agency-phishing/

After reading this, I was able to collect the following main points:

It is Russia because Russian APT groups are capable of phishing
It is Russia because the phishing site "wada-awa[.]org was registered and uses a name server from ITitch[.]com, a domain registrar that FANCY BEAR actors recently used"
It is Russia because "Wada-arna[.]org and tas-cass[.]org were registered through and use name servers from Domains4bitcoins[.]com, a registrar that has also been associated with FANCY BEAR activity."
It is Russia, because "The registration of these domains on August 3rd and 8th, 2016 are consistent with the timeline in which the WADA recommended banning all Russian athletes from the Olympic and Paralympic games."
It is Russia, because "The use of 1&1 mail.com webmail addresses to register domains matches a TTP we previously identified for FANCY BEAR actors."

There is an interesting side-track in the article, the case of the @anpoland account. Let me deal with this at the end of this post.

My problem with the above points is that all five flag was publicly accessible to anyone as TTP's for Fancy Bear. And meanwhile, all five is weak evidence. Any script kittie in the world is capable of both hacking WADA and planting these false-flags.

A stronger than these weak pieces of evidence would be:

Malware sharing same code attributed to Fancy Bear (where the code is not publicly available or circulating on hackforums)
Private servers sharing the IP address with previous attacks attributed to Fancy Bear (where the server is not a hacked server or a proxy used by multiple parties)
E-mail addresses used to register the domain attributed to Fancy Bear
Many other things

For me, it is quite strange that after such great analysis on Guccifer 2.0, the Threatconnect guys came up with this low-value post.

The fancybear website

It is quite unfortunate that the analysis was not updated after the documents have been leaked. But let's just have a look at the fancybear . net website, shall we?

Now the question is, if you are a Russian state-sponsored hacker group, and you are already accused of the hack itself, do you create a website with tons of bears on the website, and do you choose the same name (Fancy Bear) for your "Hack team" that is already used by Crowdstrike to refer to a Russian state-sponsored hacker group? Well, for me, it makes no sense. Now I can hear people screaming: "The Russians changed tactics to confuse us". Again, it makes no sense to change tactics on this, while keeping tactics on the "evidence" found by Threatconnect.

It makes sense that a Russian state-sponsored group creates a fake persona, names it Guccifer 2.0, pretends Guccifer 2.0 is from Romania, but in the end it turns out Guccifer 2.0 isn't a native Romanian speaker. That really makes sense.

What happens when someone creates this fancybear website for leaking the docs, and from the Twitter account reaches out to the media? Journalists check the website, they see it was done by Fancy Bear, they ~~Bing~~ Google this name, and clearly see it is a Russian state-sponsored hacker group. Some journalists also found the Threatconnect report, which seems very convincing for the first read. I mean, it is a work of experts, right? So you can write in the headlines that the hack was done by the Russians.

Just imagine an expert in the USA or Canada writing in report for WADA:
"the hack was done by non-Russian, but state-sponsored actors, who planted a lot of false-flags to accuse the Russians and to destroy confidence in past and future leaks". Well, I am sure this is not a popular opinion, and whoever tries this, risks his career. Experts are human, subject to all kinds of bias.

The Guardian

The only other source I was able to find is from The Guardian, where not just one side (it was Russia) was represented in the article. It is quite unfortunate that both experts are from Russia - so people from USA will call them being not objective on the matter. But the fact that they are Russian experts does not mean they are not true ...

https://www.theguardian.com/sport/2016/sep/15/fancy-bears-hackers--russia-wada-tues-leaks

Sergei Nikitin:
"We don't have this in the case of the DNC and Wada hacks, so it's not clear on what basis conclusions are being drawn that Russian hackers or special services were involved. It's done on the basis of the website design, which is absurd," he said, referring to the depiction of symbolically Russian animals, brown and white bears, on the "Fancy Bears' Hack Team" website.

I don't agree with the DNC part, but this is not the topic of conversation here.

Alexander Baranov:
"the hackers were most likely amateurs who published a "semi-finished product" rather than truly compromising information. "They could have done this more harshly and suddenly," he said. "If it was [state-sponsored] hackers, they would have dug deeper. Since it's enthusiasts, amateurs, they got what they got and went public with it.""

The @anpoland side-track

First please check the tas-cas.org hack https://www.youtube.com/watch?v=day5Aq0bHsA , I will be here when you finished it. This is a website for "Court of Arbitration for Sport's", and referring to the Threatconnect post, "CAS is the highest international tribunal that was established to settle disputes related to sport through arbitration. Starting in 2016, an anti-doping division of CAS began judging doping cases at the Olympic Games, replacing the IOC disciplinary commission." Now you can see why this attack is also discussed here.

My bet is that this machine was set-up for these @anpoland videos only. Whether google.ru is a false flag or it is real, hard to decide. It is interesting to see that there is no google search done via google.ru, it is used only once.
The creator of the video can't double click. Is it because he has a malfunctioning mouse? Is it because he uses a virtualization console, which is near-perfect OPSEC to hide your real identity? My personal experience is that using virtualization consoles remotely (e.g. RDP) has very similar effects to what we can see on the video.
The timeline of the Twitter account is quite strange, registered in 2010
I agree with the Threatconnect analysis that this @anpoland account is probably a faketivist, and not an activist. But who is behind it, remains a mystery.
Either the "activist" is using a whonix-like setup for remaining anonymous, or a TOR router (something like this), or does not care about privacy at all. Looking at the response times (SQLmap, web browser), I doubt this "activist" is behind anything related to TOR. Which makes no sense for an activist, who publishes his hack on Youtube. People are stupid for sure, but this does not add up. It makes sense that this was a server (paid by bitcoins or stolen credit cards or whatever) rather than a home computer.

For me, this whole @anpoland thing makes no sense, and I think it is just loosely connected to the WADA hack.

The mysterious Korean characters in the HTML source

There is another interesting flag in the whole story, which actually makes no sense. When the website was published, there were Korean characters in HTML comments.

https://web.archive.org/web/20160913013727/http://fancybear.net/

When someone pointed this out on Twitter, these Korean HTML comments disappeared:

https://web.archive.org/web/20160914231209/http://www.fancybear.net/

These HTML comments look like generated HTML comments, from a WYSIWYG editor, which is using the Korean language. Let me know if you can identify the editor.

The Russians are denying it

Well, what choice they have? It does not matter if they did this or not, they will deny it. And they can't deny this differently. Just imagine a spokesperson: "Previously we have falsely denied the DCC and DNC hacks, but this time please believe us, this wasn't Russia." Sounds plausible ...

Attribution

Let me sum up what we know:

It makes sense that the WADA hack was done by Russia, because:

Russia being almost banned from the Olympics due to doping scandal, it made sense to discredit WADA and US Olympians
There are multiple(weak) pieces of evidence which point to Russia

It makes sense that the WADA hack was not done by Russia, because:

By instantly attributing the hack to the Russians, the story was more about to discredit Russia than discrediting WADA or US Olympians.
In reality, there was no gain for Russia for disclosing the documents. Nothing happened, nothing changed, no discredit for WADA. Not a single case turned out to be illegal or unethical.
~~Altering the leaked documents makes no sense if it was Russia~~ (see update at the end). Altering the leaked documents makes a lot of sense if it was not Russia. Because from now on, people can always state "these leaks cannot be trusted, so it is not true what is written there". It is quite cozy for any US organization, who has been hacked or will be hacked. If you are interested in the "Russians forging leaked documents" debate, I highly recommend to start with this The Intercept article
If the Korean characters were false flags planted by the Russians, why would they remove it? If it had been Russian characters, I would understand removing it.
All evidence against Russia is weak, can be easily forged by even any script kittie.

I don't like guessing, but here is my guess. This WADA hack was an operation of a (non-professional) hackers-for-hire service, paid by an enemy of Russia. The goal was to hack WADA, leak the documents, modify some contents in the documents, and blame it all on the Russians ...

Questions and answers

Was Russia capable of doing this WADA hack? Yes.
Was Russia hacking WADA? Maybe yes, maybe not.
Was this leak done by a Russian state-sponsored hacker group? I highly doubt that.
Is it possible to buy an attribution-dice where all six-side is Russia? No, it is sold-out.

To quote Patrick Gray: "Russia is the new China, and the Russians ate my homework."©

Let me know what you think about this, and please comment.

Update: As TheGrugq pointed out, Guccifer has been found to alter documents https://www.reddit.com/r/EnoughTrumpSpam/comments/4uyih3/russian_hackers_altered_emails_before_release_to/?st=IUJDLSIE&sh=e195e908

More articles

Hacking PayPal's Express Checkout

Do you know what is happening in the background when you buy something in an online shop using PayPal?

In this post we will tackle the following problems:

How can PayPal's API be tested?
How does PayPal's Express Checkout work? You can find the detailed report here.
How can we debit more money than authorized?

How PayPal's API can be tested?

PayPal's Sandbox API

PayPal offers a feature called PayPal Sandbox Accounts, which mimics the production API. The basic idea is that a normal user/shop can test the API and make transactions without actually transferring money. This is the perfect tool for developers to test their API integration.

Access to all messages

The next question is how to get access to all messages. All browser-related messages can be inspected, intercepted, and modified via BurpSuite. The main problem here is how to get access to the server-to-server exchanged messages: the messages exchanged between PayPal and a shop. In order to solve this problem, we deployed our own shop. For this purpose we used Magento, which already has a PayPal integration.
Once we have our own controlled shop, we can enforce Magento to send all request through a proxy.
In the following picture you can see our setup.

Test suite for analyzing PayPal's API [1]

In order to capture the traffic between our Magento hhop and PayPal we proceeded as follows:

We configured Magento to use a proxy running on localhost:8081.
We connected the proxy port on the virtual machine with our local machine via SSH remote port forwarding by issuing the following command

ssh -N -R 8081: localhost :8081 <IP of Magento shop>

We configured BurpSuite running on our local machine to listen on Port 8081 for incoming requests.

Now, we were able to see the entire traffic.
Please note that we uses our own, custom Magento shop in order to be able to test Paypal's API.

PayPal's Express Checkout

An overview of the checkout procedure is depicted in the following:


PayPal's Express Checkout [2]

Step 1: Magento tells the PayPal API where to redirect the user after authorizing the transaction via the parameter RETURNURL and requests a token for this transaction.
Step 2: The PayPal API provides Magento with the token.
Step 3: Magento redirects the user to PayPal's website. The redirect contains the token from the previous step.
Step 4: The user authorizes the transaction. As a result, he will be redirected back to Magento (RETURNURL) with the token.
Step 5: Magento issues a request to the PayPal API to get the transaction details.

Step 6: Magento signals the PayPal API to execute the transaction.

Step 7: Magento serves the success page.

A more detailed view of the protocol and all parameters is shown on page 16 in the full version. We will concentrate only on step 6 and the parameters relevant for the attack.

The Attack

The goal of the attack is to let a shop (in our case Magento) debit more money than authorized by the PayPal user. The core of the attack is Step 6 -- DoExpressCheckoutPayment. Let's get a deeper look at this message:

Magento can raise the authorized amount and debit more money from the user's account

The shop sends the token, which was issued in the first step of the protocol and identifies uniquely the transaction through all steps.
The PayerID referring to the user that authorized the payment.
The AMT defining the amount, which will be transferred.
The API Credentials authenticating Magento on PayPal.
The Version pointing to the release number of the API.

As one can imagine, the core problem we found was the change of the AMT parameter. This value can be freely chosen by the shop, despite the fact that the user has authorized a different amount.

We tested only the SandBox API, but refused to test the production API in order to avoid problems. We promptly contacted PayPal's security team and described the problem hoping that PayPal can and will test the production API against the attack.

The response of PayPal can be summarized as follows:

We don't get any BugBounty since we only tested the Sanbox API. (Fair enough)
In the Production API PayPal this flexibility is a wanted feature. Thus, PayPal allows a merchant to charge for shipping and/or other expenses different amounts. Any malicious behavior can be detected by PayPal. In case of fraudulent charges the consumer are protected by the Buyer Protection policy.

... but the Sandbox API was nevertheless fixed.

Authors of this Post

Daniel Hirschberger
Vladislav Mladenov
Christian Mainka (@CheariX)

[1] BurpSuite Logo
[2] PayPal Express Checkout

12 April 2020

The Art Of Video Games: Super Smash Bros.

Image used for criticism under "Fair Use."

"I've heard legends of that man,
Alone he rushed into his enemies,
How he saved his homeland,

I've heard legends of that man,
He ran the breadth of the land,
Ruining all he touched to rubble,

I've heard legends of that man,
I've heard legends of that man,

Revered by many, I too, revere him,
Feared by many, I too, fear him,

Now, that man,
Is near to me,

Now, that man,
Stands by me,

Now, friends are with me,
Some, once heroes,
Some, mortal enemies,

And as we face one another in battle,
We shine ever brighter."

The Super Smash Bros. series, whatever iteration you've played, serves as more than just a fighting game, but as a tribute to all that Nintendo has accomplished thus far. Nintendo is to video games what Disney is to animation. Both excel at crafting revolutionary entertainment for audiences of all ages, with reputations of high quality and satisfaction. The characters brought about by these companies have also entered the public consciousness of storytelling and art. Many, need no introduction.

The lyrics you've just read belong to the theme of Super Smash Bros. Brawl, a version of the series for the Nintendo Wii. The song was composed by the ineffable Nobuo Uematsu of Final Fantasy, whose lyricism has graced "Aria di Mezzo Caraterre", "The One-Winged Angel", and "Liberi Fatali." His theme brings a rather mature and exalted mood to the game. The roster of Nintendo characters aren't simply ones who have been made up on the spot, but world-famous icons who's feats have entered the annals of video game history, Mario, Luigi, Kirby, Link, Samus, Pikachu, Donkey Kong, Zelda, Fox McCloud, Bowser, Pit, Peach, Marth, Ganondorf, Mewtwo, and even R.O.B. The Robot. The song is reminding players that they are fighting with and against the characters who've helped to craft video games as we understand them. That is something to be both honored and feared. Manaav Goyal of Always Nintendo, has spoken on the variety of interpretations in these lyrics,

"The story behind the song is one that can be interpreted in many ways. A clear one is that the lyrics are in the point of view of one of the fighters in the game, stating how these are noble heroes, who I am willing to fight with and against. Another interpretation could be that the song is about the fierceness of the fighters in the game. The song is in E major, which as stated by Austrian composer Anoton Bruckner, "is frequently associated with contemplation." This statement mirrors the song well, as the story does follow a man observing his relationship towards the champions, and what they truly are to him."

As far as fighting games go, and I've played my share, the Super Smash Bros. series is something special. For one, there is no bar of HP that determines how many hits one can take. Rather, each hit you take racks up a percentage, the higher your percentage, the more likely you are to be thrown out of the arena. The battle is won by the person who can throw his opponents out of the area x number of times (depending on the number of lives one has). So the game becomes a strategy of knocking the others out of the arena as fast as possible. This can helped or stalled by the various arenas, which include the Mushroom Kingdom, Pokemon Stadium, and Hyrule Castle. Numerous items can also be picked up or thrown, from Pokeballs, to Fire Flowers, to Hammers, to Ray Guns. Pokeballs being my personal favorite, if only for their random variety. Though what truly makes Super Smash Bros. worthwhile, and arguably one of the finest fighting games out there, is the multiplayer option. Games can devolve into a four way battle royal, in which it can be difficult to tell who is hitting what and where. This chaos can allow for a number of things to happen, and at times, the winner won't always be clear cut. I have to admit that I usually button mash when I play, which can be fun at times, but strategy is what will save you in the long stretch.

Super Smash Bros comes from the mind of Masahiro Sakurai, who also directed the Kirby series. Satoru Iwata, the current director of Nintendo, reflected on the creation of the series with Sakurai in an interview. The prototype was initially called Dragon King: The Fighting Game, the idea of using Nintendo characters came in when Sakurai realized that for the 64 console, a degree of character development was needed. Since Nintendo already had a set of popular characters, Sakurai thought it expedient to select from them instead of making new ones from scratch. The usage of Nintendo characters was initially met with resistance by fans, since making these beloved heroes fight one another didn't sound very appealing. History has proven otherwise. Even non-Nintendo characters who have appeared on Nintendo systems were later added to the roster, Sonic, Mega-Man, Solid Snake, and Pac-Man. Sakurai has emphasized how Super Smash Bros is supposed to resemble a once-in-a-lifetime experience, a game that changes every time you play it, as he said, "The appeal of Smash Bros. lies in the fact that it offers ever-changing entertainment born of chance and player improvisation..."

Nintendo has come a long way since its humble beginnings in 1889 as a company that sold hanafuda playing cards. With their leap into video games during the 1970's, well, you know: Donkey Kong, NES, Super Mario Bros, Nintendo Power, Duck Hunt, Legend of Zelda, Metroid, Punch-Out, SNES, Super Mario Bros. 3, StarFox, Game Boy, Pokemon Red and Blue, Nintendo 64, Ocarina of Time, Majora's Mask, GameCube, Fire Emblem, Game Boy Color, Super Metroid, Pokemon Silver and Gold, Game Boy Advance, Final Fantasy VI, Nintendo DS, Mario Kart, Chrono Trigger, Nintendo Wii, Twilight Princess, et cetera, et cetera.

It is also said that the word "nintendo" means "leave luck to heaven", well, maybe there's something to that.

Bibliography

Goyal, Manaav. "Behind the Notes: Super Smash Bros. Brawl Theme." Always Nintendo, June 21, 2014. Web. http://alwaysnintendo.com/behind-notes-super-smash-bros-brawl-theme/

Sakurai, Masahiro. Interviewed by Satoru Iwata. "Iwata Asks: Dragon King: The Fighting Game." Nintendo. Web. http://iwataasks.nintendo.com/interviews/#/wii/ssbb/6/0

Sakurai, Masahiro. Interviewed by Satoru Iwata. "Iwata Asks: Super Smash Bros Brawl: Once In A Lifetime." Nintendo. Web. http://iwataasks.nintendo.com/interviews/#/wii/ssbb/6/2

"Super Smash Bros. Brawl Main Theme - Lyrics." YouTube, June 29, 2014. Web. https://www.youtube.com/watch?v=YtyQ7HqHlqs

09 April 2020

The Seven Habits Of Highly Effective People Part 1: Summary Of The 25Th Anniversary Edition

INTRODUCTION: WHY 7 HABITS?

This will be a long post, as I'll be summarizing Stephen Covey's The Seven Habits of Highly Effective People through the first 3 Habits. The last 4 Habits will be covered in a separate post to be more "organized".

After using self-compassion, I noticeably felt better. I recall in this past post,

that I tried reading Stephen Covey's The Seven Habits of Highly Effective People, but couldn't even do the first exercise due to fatigue. But now that I'm in a much better place, I decided to go through the book again.

I completed the entire book when I had way more energy in College, and really found it eye-opening and helpful. However, the lessons didn't stick, otherwise, I would've remembered and continued with these habits to this day.

These habits can be very difficult to follow as it takes a lot of due diligence, willpower to not do what you want in the moment, but to work on what you find worthy, meaningful and important.

You can feel demoralized as you continue to slide back into bad habits. You may even feel negatively towards yourself, and feeling like a failure for not being an "effective" person.

That's why it's absolutely imperative that you practice self-compassion. There are going to be many days where you'd rather sleep in and not exercise, and you may berate yourself.

However, if you're kind to yourself, you'll validate these universal feelings, indeed, animals tend to use the least amount of energy, evolutionary speaking! We try to conserve energy in the face of scarcity.

Using self-compassion, you will then say, but I'm a truly worthy person, so I'll commit to exercising after work. You can walk up and down the stairs for 10 mins, or walk around the house for 10 mins as alternative. Some movement is better than none!

Therefore, if you didn't do the one habit that would make an enormous difference in your life, with self-compassion on your side, you'll just pick yourself up and do light exercise later on in the day!

Carl Rogers noted that having unconditional positive regard is the key to change, and an important ingredient in making things work for you.

Additionally, you must have energy. When I was exhausted, I couldn't accomplish anything. So exercise, getting a good night's sleep, eating fruits and vegetables, and so forth can help with energy.

Why follow the 7 Habits in the first place? Because of Covey's work, future self-help books base their principles on his work - namely, one book will be on empathic listening, another on synergy, and so forth.

Further, I found the book not only profound but practical, as it outlines steps that can help you reach your goals, in a principled manner. Covey gives you exercises to act on these positive habits.

Through these exercises, you will find what you value, not what society, family and friends say you should be. Then, the book helps you to live in line with your own truths, again in a principled way.

Again, do these habits with self-compassion, recognizing that it's very hard work. Even Covey mentioned that it's difficult in his Foreword to the 2004 edition. He writes, "I have personally found living the 7 Habits a constant struggle...Because I sincerely work and struggle every day at living these principle-embodied habits, I warmly join you in this adventure" (p. 20). And this is the man who wrote the book!

Because of self-compassion and seeing ourselves as worthy, we want to live with integrity and principle. After all, we don't treat our precious things with contempt and carelessness, but rather with care. Likewise, when we value ourselves, we want to take care of ourselves, we want to be happy and pursue purpose and meaning in our lives, in a principled way.

I'm summarizing the 7 Habits as I find it's in sore need of an update for people of diverse backgrounds. It appears that Covey is writing to the upper white middle class families. Even so, "don't throw the baby out with the bath water", but rather focus on the principles of what Covey is expounding.

FOREWARD TO THE 25th ANNIVERSARY EDITION

In this Foreword, Covey acknowledges that our problems and pain are universal, and solutions will be based upon universal, timeless, self-evident principles.

These principled solutions stand in contrast to common thinking of modern society as outlined below.

BODY:
Cultural tendency: continue with unhealthy lifestyle habits; treat health problems with surgery and medication.

Principle: prevent diseases and problems by incorporating healthy life choices. Such as the tried and true sleep hygiene, eating healthy, exercising, meditation, preventive medical checkups, and so forth.

MIND:
Cultural tendency: watch television, "entertain me"

Principle: read broadly and deeply, continuous education

HEART:
Cultural tendency: use relationships with others to advance your personal, selfish interests

Principle: deep, respectful listening, helping and serving others brings greatest fulfillment and joy.

I found the above compelling because when people think about being an "effective" person, they think you need to manipulate and use others to get ahead of the game, seek and gain power and money to abuse others to get what you want and need.

This book proposes the exact opposite, that by following principles of honor and integrity to the best of your abilities, it can help solve painful problems, bringing you joy and contentment, as it aligns with universal truths.

Instead of using and abusing others, Covey calls for having utmost respect, listening and understanding others deeply, without judgment. By doing this, you move toward empowering not just the person, but yourself.

INSIDE-OUT AND OVERVIEW

The Seven Habits of Highly Effective People focuses on Character Ethic as a way to be an effective person. You must start first with your self, with your paradigms, your character and your motives.

For Covey, Character Ethic is the foundation of success - you can only experience enduring happiness when you integrate these principles.

The major principles are:

Fairness
Integrity and Honesty
Human Dignity
Service
Quality or Excellence
Potential/Growth
Patience, Nurturance and Encouragement

By following these principles, you're following the correct roadmap. You may falter, but you can always consult the map and find your way back - there's always opportunities to do so to exercise these principles!

Following is a great description of a person who fell off the map and got lost, not using principles as a guide post, in the words of Erich Fromm:

Today, we come across an individual who behaves like an automaton, who does not know or understand himself, and the only person that he knows is the person that he is supposed to be, whose meaningless chatter has replaced communicative speech, whose synthetic smile has replaced genuine laughter, and whose sense of dull despair has taken the place of genuine pain. Two statements may be said concerning this individual. One is that he suffers from defects of spontaneity and individuality which may seem to be incurable. At the same time, it may be said of him he does not differ essentially from the millions of the rest of us who walk upon this earth.

I appreciate this quote, because this is what we all go through, and suffer, being a universal condition. However, we can change course by steering ourselves toward universal principles.

Do these principles make sense? They do, if we look at the negative of these timeless principles.

Being unfair, judgmental, deceptive, manipulative, not wanting to "git gud" (gamer terminology), being nasty and impatient to others - this doesn't lead to success in the truest sense.

Malignant narcissists, who have those negative qualities, can be extremely successful financially, often ending up as CEOs. Because they'd do anything to get ahead, they can cut corners and make quick gains, pushing their way to the glass ceiling. But they're very miserable, having no meaningful, loving relationships or connections with anyone.

Please be advised that human beings and all mammals are hard-wired to have connection with one another. We're social animals. When we're cut off or don't have a sense of belonging, that brings about true suffering.

But being fair, open, honest, improving upon yourself, encouraging and helping others - these things make people happy and able to connect with others in a fulfilling way.

Some of the negative habits to combat:

procrastination
impatience
criticalness
selfishness

Procrastination definitely makes you less effective. What's interesting is that the last 3 negative habits lead to disconnect from others. What this book is steering us toward is to have positive connections with others to be successful.

The book explains how you can achieve principled habits, but of course, have self-compassion if you go back to bad habits. Covey admits that having good habits involve tremendous process and commitment.

Covey notes that habits are the intersection of knowledge, skill and desire:

Knowledge is the theory and paradigms of what to do.

Skill is how to do it.

Desire is you want to do it.

The 7 Habits are incremental and integrated approach to developing personal and interpersonal effectiveness. As you go through the habits, you move from dependence to independence, and finally to interdependence.

When we reach interdependence, we can combine our talents and abilities and create something greater together, compared to independently, achieving more success and becoming more effective together. Two heads are better than one.

When you share yourself deeply, meaningfully with others, you may have access to the vast resources and potential of other human beings.

Habits 1 to 3 help you move from dependence to independence. This is your Private Victory.

Habits 4 to 7 help you move from independence to interdependence. This is your Public Victory.

Although you need to achieve independence before you gain interdependence - you have to learn how to crawl before you walk - it may take many years, even a lifetime to "master" habits 1 to 3. However, you can also work on habits 4 to 7 concurrently!

HABIT 1 - BE PRO-ACTIVE

Being proactive means that you take responsibility for your own life. Our behavior is a function of our decisions, not our conditions.

Reactive people are often effected by their physical environment. If the weather is good, they feel good. If the weather is bad, they feel bad.

However, a proactive person carries their own weather with them. Whether it rains or shine, doesn't matter, because proactive people are value driven, and their value is to produce good quality work, being kind to others, and so forth, regardless of what's going on.

Covey mentions the proactivity of Victor Frankl, Holocaust survivor, who founded Logotherapy, and author of Man's Search For Meaning, which I wrote about here.

Despite the atrocities, Frankl chose how he acts, and found meaning in the suffering, and helped others to find their own meaning.

We all can't be Frankl. Indeed, if one of my hair strands is out of place, I feel that I can't stream as well. However, we can start slowly and have minor victories when we act positively rather than reacting.

Suppose it's raining outside, and as a result your arthritis is really acting up. You can chose to stay at home and be in pain and miserable. Or you can have compassion and acknowledge your pain. Then you may problem-solve, give a middle finger to the crappy weather, and go out with your friends.

Covey uses the model of circle of influence - those are the things you have control over, such as being patient, kind and understanding. Around the circle of influence, you have circle of concern, which you don't have control over such as the weather, politics and such.

When you're proactive, you use your energy in working on your circle of influence, instead of reacting negatively to things you can't control, and then blaming others for your problems.

You have direct control by working on your habits, such as the Private Victories of Habits 1, 2, 3. Indirect control problems are solved by changing our methods of influence - Public Victories of Habits 4, 5, 6. No control problems can be dealt with accepting the way things are, even though we don't like it.

Here's an example on how you can expand your circle of influence, by working on yourself and how you respond.

Your boss tends to be critical of others, but doesn't have a verifiable DSM-V personality disorder, so you can work with her. Instead of complaining about yet another mistake she pointed out, you start trying to understand her and what she's looking for.

Instead of avoiding her at all costs, or just saying "yes" to whatever she says to "get her off my back", you instead truly listen to what she wants and expects. Actually, she may be taken aback if she sees you actively searching out her advice when you have a question about the project, since she notices that people avoid her like the plague.

Because you truly understand what her vision is and you're able to implement it as a result, she will be impressed, and come to you for more of the "plum" projects.

You're clearly proactive in this situation. Instead of blaming her for being "bitchy" and saying, "if only she were more understanding, my work would be better", you decide to understand exactly what she wants, getting all the specifics so you can easily implement.

However, your other coworkers start getting jealous, one actually calls you a "brown noser" to your face. Instead of reacting, you have the wherewithal to tell him that you're not brown nosing, you're just following these particular steps that she finds useful and that's how you can "get ahead". By giving him these valuable tips, he can take it or leave it.

If he's "not convinced", you continue to make positive overtures toward him. Seeing that you're actually genuine and authentic, he starts using your tips, noticing that they actually work, and you gained an ally.

The other coworkers eventually follow suit. You turned an unpleasant work experience into a positive one.

Now the issue here is if your boss actually has a verifiable personality disorder. She completely belittles and insults others, lies about her employees to cover herself, fires employees indiscriminately, and creates a truly toxic environment.

You have a family to feed, so you can't quit your job, even though your wife and children are begging you to leave for your health.

However, even in this dire situation, you can be proactive. Take notes whenever she says something demeaning to you or another person. Make sure you write down the exact day and time this occurs. If you have good reflexes, you can also record the toxicity on your smartphone.

On the weekends, you and your wife scour the internet for job opportunities. If you get fired, you can hire a lawyer, armed with scores of exceptionally detailed notes, which is every lawyer's wet dream for a lawsuit.

If you manage to not get fired, once you find another job, you can put in your 2 weeks notice.

How can you tell if you're proactive or not? If you're reactive you use "have" statements. If you're proactive, you use "be" statements.

Reactive statements examples:

I'll be happy when I have my house paid off...
If only had a boss who wasn't such a dictator (use the techniques above instead)...
If I had more obedient kids...
If I had my degree...
If I could just have more time to myself...

Proactive statements examples:

I can be more patient
I can be more wise
I can be more understanding
I can be more resourceful
I can be more diligent

The Application Suggestions are:

For a full day, listen to your language and to the language of the people around you. How often do you use and hear reactive phrases such as "If only," "I can't", or "I have to".
Identify an experience that have behaved reactively. How could you respond proactively. Create this experience vividly in you mind, picturing yourself responding in a proactive manner.
Select a problem from work or personal life that is frustrating to you. Determine whether it's direct, indirect, or no control problem. Identify the first step you can take in your Circle of Influence to solve it and then take that step.
Try the 30-day test of proactivity. Be aware of the change in your Circle of Influence.

HABIT 2: BEGIN WITH THE END IN MIND

The following exercise will help define what you find truly valuable in your life.

Imagine yourself at a funeral, the whole procession. What would you want your loved ones (family and friends) and coworkers to say about you during your eulogy?

Those will be your values and what you consider important.

When I tried that exercise, I wanted people to say some positive things that I'm not. One is "she's someone who honors commitments" but I tend to cancel social engagements.

Therefore, through this funeral exercise, I know I need to work on only making promises that I can truly keep and really following through, as one of my core principles.

The other interesting thing is that nowhere in the eulogy did I want someone to say that "she valued her freedom" because that sounds "bad". However, when I really looked deep into myself, choosing only three things I value most, they are:

Freedom
Love
Growth

The last two showed up in the eulogy, but my most valued, Freedom, did not. Even so, I find that I can't be authentic if I don't have freedom.

Therefore, do the eulogy, which is crucial, but in a separate list, find three things that make you happy.

A lot of us, in the happiness list, would put down being wealthy. As studies show, materialism doesn't lead to happiness, so being wealthy isn't your value.

Instead, write down why you want to be wealthy. What comes up mostly is you want money so you can travel, eat amazing foods, go to concerts and experience other unique activities and events.

Therefore, I would say that you value rich experiences, and that could be something you can work toward.

It's important to come up with your unique mission statement. It will change as you consider things more, as you get older, as you go through different milestones in life, and such. But at least you have a blue print as to what you're aiming for.

Do the funeral exercise - it can be rather eye-opening to see where your values really lie.

Next, with this "End in Mind", you want to focus on what you want to be (character), and to do (contributions and achievements), and put that in your life mission statement.

Since this funeral exercise is so open-ended, as well as mission statements being equally open-ended, and I struggle in pinning things down, the Franklin Covey mission statement builder was quite helpful.

I would do the funeral exercise, and then the mission statement builder.

Once armed with this knowledge, you have your own blueprint as to how you want to live your life, not how others perceive you.

You want to make sure that you follow your vision and values, which is your Circle of Influence, and the more you work, the more your Circle of Influence expands. That's where you want to focus your attention on.

You want a Principled Center. By focusing our lives on correct principles, we create a solid foundation, that doesn't fluctuate based on people or things that constantly change, and are quite fickle.

Alternative Centers

Covey next lists alternative centers that we tend to have, rather than a Principled Center. These are spouse, family, money, work, possession, pleasure, friend/enemy, church/institution and self-centeredness.

Let's take work-centeredness as an example of why not having a Principled Center is problematic. When you're work-centered, your personal worth is determined by your occupation. You're only comfortable when you're working. You make your decisions based on the needs and expectations of work. You tend to be limited by your work role. You see your work as your life.

The other alternative centers are equally problematic. But having a principled center, you aren't being acted upon by other people or circumstances, rather you make your decision based on looking at the whole picture, factoring in work, family and other needs to come up with the best solution.

Covey gives a good example of an alternative center versus principled center approach. Your husband was looking forward to this concert for the past month or so. But at the night of the concert, your employer calls you to do some prep work for tomorrow's 9 AM meeting.

If you're spouse-centered, you go to the concert with your husband. Or you may feel you have to work instead, but very anxious about his response, justifying your decision and protecting yourself from his disappointment,

If you're money-centered, you'd call your husband to cancel the concert b/c this could lead to a potential raise.

Covey goes down the other alternative-centered options which we won't outline here, but the principled-centered option makes the most sense.

A possible outcome using the principle-centered approach is to communicate to your husband and boss, whom you both have a strong connection. You genuinely want to prepare for this meeting because you value your boss's effectiveness and you want to contribute to the team (proactive) rather than staying at work to get the edge on someone else (reactive).

You want to go to the concert with your husband because you both were committed to this for the past month or so, and this is your husband's favorite band growing up.

You chose what is ultimately most valuable to you in your mission statement, which happens to be your relationship with your husband, when you did your eulogy.

Therefore, you tell your boss that you'll come in early in the morning to prepare for the meeting because you care about the welfare of the team, and go to the concert with hubby.

Application suggestions:

Record funeral impressions.
Write down your roles.
Begin work on your personal statement, this tool can help.
Circle all the alternate centers that you tend to follow
Start a collection of notes, quotes and ideas you may want to use as resource material for your mission statement
Identify a project you'll face, and envision how to solve this using a principled center approach.
Share the principles of Habit 2 to loved ones and/or work group, and suggest that together, being the process of a family and/or group mission statement.

HABIT 3: PUT FIRST THINGS FIRST

The answers to these questions will direct you during Habit 3.

Question 1: What one thing could you do (something you aren't doing now) that, if you did it regularly, would make a tremendous positive difference in your personal life?

Question 2: What one thing in your business or professional life would bring similar results?

For the first question, I came up with 3: going to bed and getting up at the same time, exercising, and eating more fruits and vegetables. For the second question, being more organized by using to-do lists.

Covey poses that Habit 3 is the practical fulfillment of Habits 1 and 2.

Habit 1 says, "You're in charge". It challenges you to realize, "that's an unhealthy program I've been given from my childhood, from my social mirror. I don't like that wrong script, I can change it".

Habit 2 shows us what's most important to us.

Habit 3 is the exercise that you do to become principle-centered, and how you carry out what's most important to you. Covey describes a time management matrix.

Quadrant 1 are important and urgent such as crises, pressing problems, deadlines.

Quadrant 2 is important but not urgent.

Quadrant 3 are non-important but urgent such as interruptions, some calls, some mail, some meetings.

Quadrant 4 are not important and not urgent such as trivia, time-wasters.

Write down all of your roles, such as personal, parent, spouse, employee and for each one, write down the essentials such for each of these roles - that will most likely be Quadrant 1, 2 and 3 concerns. Exercise would fall under your personal role, Quadrant 2.

If you, like most families, work multiple jobs, and you find that you don't have time to have dinner with your children (I would say this is a very basic Quadrant 2 issue), look again at your roles list. Delegate any Quadrant 3.

If still pinched for time, look at your roles again, weeding out the unimportant positions. If you see one as being PTA member, then I'd quit, since your values are with your children (Habit 2).

If work is getting in the way, then cut unnecessary expenses to reduce work hours. I often see families struggling to make ends meet (leading to multiple jobs). Come to find out I see their children (as young as 5-years old) with the latest, largest iPhone ($1,500), when all they really need is clamshell for emergencies ($30).

In other words, resist the urge to keep up with the Joneses. It's not worth working multiple jobs for all these unnecessary luxury items.

Here's an example that often comes up:

A mother brings in her daughter ("Jill") as she's severely depressed. Jill is concerned about her mother because she works too many hours, and her health is declining as a result. Further, they can't spend time together, which Jill says also makes her depressed. She spends her time alone in her room while her mother works. If that's not depressing, I don't know what is.

It was obvious that their relationship is their most-valued principle (Habit 2), so Quadrant II is working on their relationship.

When I asked the mother why she's working full-time and then Uber after work and on weekends, she reports that she has to pay bills (Quadrant 1 Urgent) and buy things for Jill to make her happy (allegedly Quadrant 2).

Jill then mentions that she doesn't even want these things, which include the mother paying for Jill and her friends to go out to eat, hair extensions, fancy manicures, smartphones, and so forth. We calculated that it comes to $1000/month. Uber = $8/hr, so that's 31.5 hours/week.

Since Jill convinced the mother that she'd rather spend the time with her, foregoing the luxuries, the mother agreed to quit Uber altogether and keep the full-time job.

Jill went even further and agreed to do almost all the chores (Quadrant III), so that they both can spend even more time together, which is their Quadrant II, most important values.

I saw them 2 weeks later and Jill was beaming with joy - so not only did her depression go away completely, but she's very happy having all these special moments with her mother.

In other words, cut out the crap and focus on what's meaningful to you.

Click here for Part II - Public Victories.

The How of Happiness Review