April 19, 2025

10 thoughts on “TECH 581 W Computer Network Operations: Laboratory 2, Team 2”

  1. Unlike the group’s last lab report, this lab report’s literature review read more like a list. The group did not cite the references in the proper APA 5 format. The group did clearly state the points that they agree with in the articles but failed to answer all of the questions required for the literature review. I felt that some of the articles did not get enough attention or they were not scrutinized as the rest of them. The Active Reconnaissance tool table was not complete. It was missing the entire column where the tools are placed into their proper dimension of the McCumber cube. Only one tool was found to be in layer 6, I would like to have seen some more tools in this layer.
    I liked this group’s tools for layer 0. I thought that they were unique and actually fit quite well with the active reconnaissance tools. The group stated that there were no problems or issues with this lab, but right after the active reconnaissance tools table the group states “The use of this active recon taxonomy is not in and of itself without issue. As pointed out in the lab obscuring the true source of the recon tool (aka system hosting the tool being used) can also be quite valuable.” This should have been places into the proper section and elaborated on and go into more depth about the issue. The group did state that the TCP/IP model can have 4 or 5 layers in it, but failed to state which side of the argument that they agree with and why. I liked that the group separated the different SCADA models and compared them with the OSI and the TCP/IP models. I also like that the group described the models after displaying the graphs. It was nice to see that the group cited the places that they found the different models from. It looks like the group copied and pasted a paragraph from their methods section and put it in the findings section two paragraphs later. I agree with the group’s placement of the SCADA models in correspondence with the OSI model as well as the TCP/IP model. This group’s lab report was better structured than their first lab report was. The group just needs to makes sure that they include all parts of the lab exercise. I am looking forward to this group’s next lab report to see how they work together to get a cohesive lab report.

  2. The literature review lacks any cohesion and is simply a list of the articles that were provided with the lab exercises. This literature review, specifically for this group, is a step in the wrong direction from last week where the articles were treated by the topics that they addressed. At the end of each article’s summary is a paragraph summarizing the author’s ideas and agreeing with them. The literature review doesn’t mention the lab assignments or tie any of the articles to any of the exercises in the lab. Some of the literature summaries are poorly written, one example would be Matt Bishop’s paper on Security Plan for Red Team Testing where the review states: He goes on to describe proprietary as “the vendor and the Secretary of State agree that the information or device is proprietary…”. Is this defining proprietary?
    The methods section lacks a lot of detail as to what specifically was going to be done in the lab exercises but did give a general overview of what was going to be done and how it was going to be accomplished. The methodology about the active reconnaissance taxonomy only mentions that the Backtrack tools were used, while this is a large repository of tools to use, it would’ve been better to include some tools from some other sources.
    The findings paragraph about the active recon tools is almost verbatim what the methodology section’s paragraph was. The table with the active recon tools is a little difficult to read with each tool occupying one row, the McCumber cube coordinates were missing from the table, and links to each of the technical tools would have been helpful. The anti-forensics methods were interesting but only looked at what Professor Liles had posted in his anti-forensics post, some additional sources would’ve been good to see.
    The TCP/IP and OSI comparison detailed the five layer TCP/IP model but only described Comer’s view of the five layers without any mention of the four layer model and why there was discussion between the two competing views. The SCADA comparisons were well laid out in the tables with the detailed descriptions about each of the protocols.
    The conclusion made an excellent point about the relationship between SCADA systems and standard penetration testing. SCADA systems could allow an attacker to use tools that target TCP/IP systems and cause a kinetic, and possibly dangerous, effect.

  3. Team 2’s abstract did a good job of explain what they were going to do in their lab Their literature review was well organized which made it easy to read and helped to convey what the authors were trying to say. The methods section discusses the process of how the lab was completed. In regards to their Recon tool table they were missing the column that that showed the McCumber cube hierarchy. I think there are a lot more recon tools they could have researched and found to complete their table. Layer 0 was very light. I thought the way the group organized the different SCADA models and compared them with the OSI and the TCP/IP models was excellent. They did have a findings and answers section and seemed to answer the required questions. I agree with the group’s placement of the SCADA models in correspondence with the OSI model as well as the TCP/IP model. As with some of the other groups I’m surprised they didn’t have any issues, particularly in finding additional recon tools. I agree with their conclusions. Overall their paper was good.

  4. The group starts off with an abstract that does a nice job of quickly explaining what reconnaissance is and the two types of reconnaissance there are. The abstract also briefly explains what will be involved in this lab. The next part of this groups paper is the literature review. The group takes each article and does a review on them individually. The group does a nice job in explaining the ideas behind the articles. The problem with these reviews is that they don’t explain how these articles ties into this lab and the other articles. The group does mention the theme or topic of each article and also the research methodology of each article. They also do mention a research question if the article has one. Next the group goes into the methodology of the way they approached the lab. The group explained each step of the lab in a short but complete description of that step. The one thing that I did not see in the methodology that should have been there was the explanation of aligning the tools to McCumber’s cube along with aligning the tools to the extended OSI model. In the next part of this group’s paper they talk about the findings they got from this lab and the answers to the questions in the lab. The first part of this section talks about how they setup their lab using the Backtrack tool suite built into a virtual Linux environment. They did not detail how they did this though. After that section they show the table that they constructed for the active recon exploits. This table was not that extensive. I believe that they could have found more to put into this table. Another major thing missing from this table is the alignment to McCumber’s cube for each of the tools. The table also did not contain any anti-forensic tools that should have been included in with the active recon tools. The group did explain how the lab is set up to accompany anti-forensics at the end of the table. Next the group tackled the question of whether there should be four or five layers in the TCP/IP model. According to this group there should be five layers to the TCP/IP model. They argue that there are four layers that are major software layers that build on a fifth hardware layer. They say that there has to be a fifth layer to get the information to the requester, but this connection might not be TCP/IP though. The group also provides a table depicting the alignment of the TCP/IP model to the OSI model. Next the group discusses the alignment of different SCADA protocols to the TCP/IP model and the OSI model. They start off with a brief explanation of why the SCADA models do align to the OSI model. Then they go into the different protocols. In each explanation they briefly explain how each layer fits into the OSI model, but they do not explain any details of each layer. They go over some of the most important aspects of each of the protocols, but again they do not go into details. They talk about the SCADA protocols given in the lab and they also cover the PROFIBUS protocol and the RP570 protocol. Next they mentioned that they did not encounter any problems in this lab. Last they concluded the lab. In the conclusion they talk about how the table that they created with the active recon tools would help aid in future labs. Then they talk about how they gained better incite on the TCP/IP model and how device automation systems could become vulnerable. Last they explained that with a little “outside the box” thinking could penetrate a SCADA system and be used to do great damage to a plant, factory, or even a distribution of water and electricity.

  5. This lab write up was nicely structured. The literature review was in depth, and covered each article quite nicely. I also thought that the section which addressed anonymization techniques was interesting. The tables for active tool listing and the TCP/IP and SCADA stacks were clear, and easy to read. The dialogue which discussed the TCP/IP controversy and the SCADA protocols with their exploitability was significant: it presented well chosen and useful information. Overall, this was a very solid report with a lot of subject coverage.

    That is not to say that I did not find a number of areas which could benefit from more attention. With regard to the literature review: I found no direct relation to the lab exercises mentioned for any of the articles. A short description of how the team felt the articles reviewed addressed areas of the lab exercise (if at all) would address this deficiency. Additionally, similar to the first team’s approach to the lab, I found no mention of how this team determined what ‘active reconnaissance’ actually was, and what properties defined a tool grouped into this category. This becomes an issue, as several tools in the tool chart are of a questionable nature with regard to classification in this category.

    The inclusion of such tools as ‘Gooscan’ and ‘lanmap’ are unsatisfactory without a rationale for their inclusion. As mentioned in a prior review, ‘Gooscan’ is almost certainly passive in nature-just because ‘scan’ appears in the tool name does not mean it is an active scanning tool. Additionally, having experimented with ‘lanmap’, I found no way to cause it to act in an ‘active’ way. It is a tool which builds a graphical depiction of the network ‘as information is overheard’: it does not broadcast to or ‘ping’ any network hosts to accomplish this. I would therefore call it a ‘passive’ tool, and find it erroneous to include it in a table of ‘active’ tools-unless, of course, a specific reason exists for its inclusion, but this is nowhere to be found. I also wonder in these regards to the inclusion of tools such as ‘psk-crack’, which is an offline cracker with no network connectivity functions.

    The discussion on anonymization tools is interesting, and draws heavily on Professor Liles’ article. I would comment that the Tor network, or onion routing systems (as currently implemented) are not ‘impossible’ to compromise, they simply make it ‘very’ difficult to correlate specific connections to a single origin. As mentioned in the Tor network documentation, organizations with sufficient resources, in theory, could monitor specific input and output nodes, and make accurate assumptions about usage patterns-I would not consider this perfect anonymization with respect to network connections, but rather merely ‘of low risk’ for an attacker to use. Furthermore, I would suggest that the encrypted ‘VM on USB key’ is of limited worth with respect to an active attack. If such a device is used on a host located within the target’s premises, nothing is gained, as the attacker must be physically present: and so therefore exposes himself to a high risk of direct capture. If the encrypted ‘VM on USB key’ system is used from a remote location, no real risk is mitigated in this case, either. As a remote attacker primarily seeks to hide his whereabouts, and this encrypted ‘VM on USB key’ is actually designed to defeat forensic investigation; I would submit that it is ‘far’ too late for the attacker if forensic investigation is being done on the machine used for a remote attack: his connection anonymization means has failed, and he is already caught, or very close to it. I would add that this encrypted ‘VM on USB key’ has very specific application in the referenced article: to a traitor passing information to some other party; in the role of attack it accomplishes little.

  6. The lab starts off with the abstract defining what is going to be done within the lab and they unlike the other groups add passive attacks along with the idea of active attacks. This gives me the question is it possible to be active while being passive? I would think yes because even though the attacker is waiting there is still that time where they are actively collecting information. Just that question made me want to know more about the group’s thoughts with this idea. Next they go into the literature review and do a good job at describing the Literature/papers, and how it relates and their thoughts on the different information presented to them. Again this group also did split the reviews up instead of creating a more cohesive literature review that would spark differences between the papers and create more questions that would make the group think about when dealing with the topics presented. The group then goes onto describing their methodologies and how they went about the lab outside of the literature. The group describes what tools they where using for the active reconnaissance and why they where being used. This was a well added point to their lab because some of the other ones left me with the question on why they did not put that aspect in. The team was able to describe the methods that they used well which they carried over to the findings and results sections. Here they used various tools and plotted them within a table. They where able to plot the various tools they used into the first table comparing the tools and what level of operation. They also compared the OSI, TCP/IP, and SCADA protocols in different tables. Breaking the tables down allowed the readers to take out the clutter and get a better understanding of each protocol and its relations to the OSI seven layer model. After each table they where also able to explain why they put the layers in the locations presented. This gave me a better understanding on what their thought process was behind the placement. It also gives the question is there a possibility that some of these protocols may be placed differently? Is there something that can be argued when dividing the line of the protocols and essential breaking down the protocols to the OSI model into fewer layers? The team then goes onto state that they had not issues with the lab and go into the conclusion. They conclusion gave me an ending thought when they stated that SCADA protocols should not be used within the IT fields standard realm of practices. Will the comparison of SCADA protocols and the OSI model eventually lead into another area when thinking about the equipment that is used? They are communication protocols and Information Technology is about the sharing of information. So will the field start to relate more with the combination of SCADA and OSI? This sparks a good conversation and may eventual happen.

  7. The literature review is NOT a list of articles. Your team presents a thorough synopsis of each of the articles in the literature review, but you don’t relate the content to the lab. You fail to evaluate the information presented. The methods section does a good job of telling the reader what you did in a repeatable manner. In this section the group states that NESSUS is an example of an active scanning tool. Is it? Your results section is on the thin side. Do your Tools map to the McCumber cube? How? Could the same tool work on more than one layer? When discussing the TCP/IP stack, you tell me what Comer thinks about the TCP/IP model, but what do you think? What is your reasoning? How does it compare to what other people think? The discussion of MODBUS only includes one version of the protocol. Are there others? How do they interact? Does DeviceNet always align as clearly to the OSI as presented in your work? PROFIBUS and RP 570 are very similar. Why? It would be nice to see the SCADA protocols compared to each other as well as OSI and TCP/IP. You had no issues with the lab? The group’s conclusion does a good job of summarizing the process and telling the reader what was gained. I would have liked to see a more detailed discussion of the SCADA protocols, but overall the lab flowed well.

  8. I reviewed the lab report for Team 2 and found several misspellings, such as using there instead of their, or namp instead of nmap. I was also a bit confused about using the word agnostic when describing the TCP/IP physical connection. There were also a few sentences that didn’t make sense, such as ” The installation of the active recon tools was rather simple since the all of the tools that were defined by team two in lab one were the tools of the backtrack tool suite”. This sentence could have used some revision to make more sense. I would have also liked to have seen an attempt to describe how the article on automated red teaming may apply to our lab assignment. Unfortunately, I was unable to furnish a more thorough review due to my work schedule that past few days.

  9. I think that group 2’s write-up for lab 2 was good overall. The abstract for this lab was good. The literary review was adequate. Group 2 answered almost all of the required questions. The group did not discuss how the reading related to the lab, and did not discuss whether or not they agreed with each reading. All of the citing for the literary review was done well. The table containing the penetration testing tools was adequate. More depth could have been put into how these tools are actually installed. What if you needed to make your own Live CD or install these on a computer that BackTrack is not compatible with? I think the group could have gone into more depth about why they chose the 4-layer plus 1 TCP/IP model. What about the DoD model or the 5-layer model? How are these not correct? Also, do these layers match up exactly with the OSI model? Or is it fuzzy where layers like the session and transport layers meet? When dealing with SCADA, what about the Kinetic layer? When dealing with the DeviceNet protocol, what about the Pseudo Transport Layer? Is it really its own layer or does it exist in another layer?

  10. In the abstract , team 2 was able to differentiate active tools from passive by stating” This is based on whether the network being targeted could be aware of the efforts (active), or could not be aware of the efforts (passive).” The group then gave an overview of the laboratory assignment. I did not understand what was meant by the statement” The focus these activates being the TCP/IP model and how they relate to SCADA systems.”

    In the literature review, the group needed to address the theme of the articles and relate the articles to the lab. The group also needed to relate the articles to each other. In the first article, About Penetration Testing group seemed to accidently confuse author’s names when the group stated “ The article, About Penetration Testing by Matt Bishop of the University of California, Davis, talks about red teaming and what red teaming is.” In the article Three Different Shades of Ethical Hacking: Black, White and Gray when he said “I think my network is secure, therefore, it is secure, no matter what the security experts may say “ he was stating a common view held by management, not himself(Hafele, 2004).

    Team two gave an overview of what was to be done in the lab within the methodology section. Team 2 differed from other teams in that they went into a brief explanation on some of the active reconnaissance tools that they installed onto their virtual machines. I had to disagree with the group in their claim that NESSUS was available on the backtrack ISO, for my team was not able to locate it within the ISO and had to install it on a different virtual machine. When the setup of the active reconnaissance tools table was described, the McCumber cube requirement was not mentioned. This lab required to categorize the tools in relation to both the extended 7 layer OSI model and the McCumber cube.

    Team 2’s active reconnaissance table seemed to be missing the McCumber cube column to describe how the attack tool or method fits within McCumber’s Cube. I was not sure how Telescopes and Binoculars could fit into the Kinetic layer. The team appeared to struggle with finding active reconnaissance for the extended OSI model table. However, there were a few layers that all of the groups seemed to have found a limited selection of tools. Team 2 gave a brief explanation of anonymity by using the example of an encrypted write blocking USB storage device containing a Virtual Machine image to boot on a system.

    In the OSI and TCP/IP alignment section Team 2 sided with those who thought the TCP/IP model should have five layers instead of four due to the importance of physical connections, thus aligning the five layer version to the OSI model.

    Within the SCADA protocol section, which aligned the SCADA protocols individually to the OSI model MODBUS, DNP3, and DeviceNet were aligned and their layers were explained .Team two also included the Profibus and RP570 SCADA protocols.

    The team did not encounter any problems in the lab, as stated in their issues section and then gave an overview of the lab again in the conclusion.

Comments are closed.

Related Stories

blog_EDU23

A story about public education and outcomes

Sam September 13, 2024
CMPNG197

High-tech lay offs as an indicator of future tech companies demise or failure

Sam May 25, 2023
GNEWS095

Reading and irony

Sam February 16, 2023

You may have missed

blog_SBUS015

How High Tariffs Could Drown the Mid-Tier Yachting World and Leave American Cruisers Stranded

Sam April 5, 2025
SBUS001

The Hidden Storm: How Trump’s Latest Round of Tariffs and Economic Shifts Are Sinking the Mid-Sized Yacht Market

Sam March 29, 2025
IMG_5437

Sailing Through the Ages: How Cruising Has Changed Over the Last 20 Years

Sam March 27, 2025
IMG_8204

Plot twist: Same song second verse – chemo cycle 3

Sydney Liles March 26, 2025