Tech 581W Computer Network Operations, Laboratory 1: Team 1

9 thoughts on “Tech 581W Computer Network Operations, Laboratory 1: Team 1”

1. The groups abstract covers what the lab is for and how it is important. The abstract said that the paper will detail the steps in creating this lab, but the paper didn’t cover the steps that they took in actually creating the lab. The abstract said also that they would talk about the operating systems that will be used, but the paper doesn’t explain which ones that they used. Then the abstract concludes with describing how important it is to get this lab done correctly the first time. This group did a good job in reviewing the readings and relating them with the current lab. In each reading the topic and theme of the paper was identified and also how it pertained to the current lab. The research question of each reading was identified and compared to the other readings. The supporting data was identified. The group tried to find any errors or omissions but didn’t find too many. The only thing that I did not see done was the identifying of the methodology and how it could be used to answer the lab questions. The group also did a nice job in citing their work at the end of the literature review. As for the next part of the lab the group quickly went over how they set up the lab and didn’t go into any details on how their lab was set up. The group didn’t give a step by step procedure on how they were to set up their lab. In the next section the group set up the table that was used to detail out each of the tools that are going to be used in the penetration tests. The group did a good job in assembling the table to compare and contrast the tools in relation to the McCumber cube to show how most of the tools were labeled under technology and not policies or human factors. On problem is that the group could have come up with some more exploits or tools for a couple of the layers like the Physical and the Data Link layers. The group was able to answer the question of why most tools fell under the Technology category in the McCumber cube. I agree that almost all the tools that are going to be used are going to be in the Technology category. This should be viewed by the other groups in this lab. The group could have done a better job in answering the question on whether the table shows a bias or not. Next the group described some of the problems they had with the lab. The group said that one of the problems was the number of tools. The group didn’t explain the exact problem they had with this enormous amount of tools. The group next said that they had some problems with setting up the virtual machines. They didn’t explain the problems that they were having with setting up the virtual machines. They said after testing them they solved the problem, but this didn’t explain the solution to well. They also said that one of the issues that they were having was communication with each other. One statement that the group did make that was a good statement was the one about how the first lab is the important lab because it is the basis of all the other labs. I agree with this statement in that all the other labs are going to rely on how this lab is set up. If this lab is improperly set up then more work is going to be needed in the future to make upcoming labs work properly. Also the first lab sets the pace in the class and shows how things are going to run and gives you a window into how to work all the other labs.

2. Team one prepared an informative, direct literature review that directly related all the articles to the assigned lab. There is little evaluation of the material. The only other major flaw I can find in the team’s review is that you missed the fact that the Gula paper is a vendor white paper, and likely contains an agenda.
   The methods section needs more fleshing out. What were the steps to prepare the lab? You say the team followed instructions but you don’t say specifically what they were. I’m unclear about the blank areas in the table. Do they show that some tools fit more than one coordinate set in the cube? I disagree with the team’s placement of tools in “Layer 0” The tools do have a kinetic effect, but are physical in nature, and have nothing to do with the transmission of electronic signal into physical force. Your findings suggest that the “computer” is easier to attack than policy or procedure. What is it about the nature of the “computer” that makes this so? In the issues section, the team says there was a problem starting the VMs. Can you elaborate? What was done to solve the problem? In your conclusion, the team says that most tools are geared toward technology, but then go on to say that hackers can be those who attack with non-technological means. Is it possible to be both?

3. The first team presented a complete and well thought out lab exercise. The lab met most of the requirements as per the syllabus. There were no real apparent issues or problems that stuck out at first examination. However, there were a few items that could be improved upon. The abstract did not meet the requirements of the syllabus in terms of length. The literature review read more like an annotated bibliography than a true literature review. Each paper to be read for the week was listed individually, notes taken by the reviewer were listed, and then the literature review questions posted in the syllabus were answered. There was no direct correlation or comprehensive synthesis of the state the literature. Besides a few issues with the literature review, the penetration testing taxonomy was very complete and seemed to agree with results as per the other labs in this course. There are a number of places were team 1 agrees with the other teams these include the findings in the literature review on how the DETER test bed plays at part in the creation of the VMware lab. They also agree on the apparent errors in the coffin article as well as the issues that seem to come up in Gula piece. Their penetration testing taxonomy does mach up rather well with the rest of the class, and contains an adequate number of tools. The answers to the questions asked do also seem to match up with the answers presented by the other teams, in terms of why the attack tools work on the technology vector of the McCumber cube. The technical merits of the position that team one has taken well thought out and complete. They explain how they built their lab, as well as the answers to the questions that were asked in the lab. Since the actual technical portion of the lab was rather simple, mainly just giving four VMs their correct IP addresses, every team did the same thing here. Team 1 approached the lab a lot like how the other teams approached the lab. They performed a literature review that was close to the other literature reviews. They worked through the steps of the setting up the VMs, like the other teams, filled out the taxonomy like the other teams, and answered the presented questions, like the other teams. This is because that is the format presented in the syllabus for completing the labs. Where they differed slightly was in what tools they placed at layers 8 and 0 of the taxonomy, as well as their approach to directly stating the objectives of each reading, and then presenting how that reading did or did not fit in with the rest of the readings, the level of scholarship in the readings, and how it worked with the lab. The only enhancement that can be made is in the cohesion of the literature review. They do not need to find any additional materials, other than maybe on working better as a team, and their methods are sound.

4. The literature review was a bit disjointed. I felt as if it was only looking at each article in the context of the lab work instead of looking at all of the articles together as a whole in the context of the lab work. Some of the formatting in the bibliography section was not correct, some lines were spaced incorrectly. There was some unnecessary capitalization in the literature review as well. In one of the papers reviewed, It Takes a Thief: Ethical Hackers Test your Defenses, an error is mentioned in the paper but no further details are given about the error or even a page number of where to find it.
   In the literature review, there was an article mentioned that talks about the necessity of building test environments but that is never tied with the activities in this lab. Showing how the readings were tied in to the virtual lab activities would have been helpful. The article Cyberattacks: A Lab-Based Introduction to Computer Security, makes mention of being tied to the lab but only that “this information is applicable for the current laboratory because it indicates to the reader about the importance of cyberattack and malware awareness.” While this may seem obvious (but can’t always be assumed with Prof. Liles) more detail and examples should be given to tie it to the lab activity.
   Some items in Layer 0/Kinetic are not categorized properly. I’m not sure if “weather” or “natural disasters” are tools that can be used in a kinetic attack against a system as they are (almost) impossible to control. If weather were a tool in an attack against a system, I’m also fairly certain it would not be an attack against policy.
   One major omission from the matrix was the inclusion of links to any of the tools. It’s hard to determine which tools are programs and which are actions an attacker might take. In the quick-changing world of exploit tools, it would also be helpful to provide links because often, tools change sites or names or move around and it can be difficult for someone to try searching for those tools and ensure they’re coming up with the same on you used in your matrix.
   In the matrix, the blank sections for some of them McCumber cube coordinates seem to indicate that there aren’t any tools for those items. The literature taught us that in circumstances of penetration testing, when the testers weren’t able to break in to the network, it didn’t necessarily mean that the network was unbreakable, just that it wasn’t breakable at that point in time with that attacker’s particular skill set, I think the same would apply here and should be noted in the issues section if these are going to be left blank. On that note, the issues section of the document is a little weak. Mention is made of problems building the virtual machines but no details are given so that anyone attempting to reproduce the lab could learn from them. Also, an issue is raised with communication between three group members. How was that worked out? How do you communicate among the three members of the group? Other groups could learn from this and it could help out how they communicate amongst themselves.
   Overall the grammar, formatting, and punctuation had some issues, the literature review lacked cohesion, and the issues and conclusions sections were weak.

5. First, I will relate the things I thought were good or intriguing about this lab write-up. I thought that this group did a reasonable job of connecting the material in the provided literature with the lab exercise itself. I also agreed with the statement that one of the problems was the sheer number of tools that ultimately appeared to be required for the lab–this was a problem that was most assuredly common to all the teams. Finally, I am intrigued by the assertion that “natural disaster and weather” fit into the McCumber cube model / OSI classification tool chart. It gives one pause for thought–certainly these forces can present opportunities for exploitation, however I am unconvinced of their ultimate utility, as they are notorious for being inconsistent in their behavior and timeliness. I would submit that any entity gaining the ability to control these forces would need no other tools than these. Until this is possible, I would view them as unplanned opportunities, but would not go so far as to rely on them as useful tools. An interesting view on the matter by this team, nonetheless.

   Now, unfortunately, it is my academic duty to be critical. I was a bit taken aback by the predominately negative tone of the literature review section. I too have done reviews for other classes which examined style, formatting, and number of sources, etc. However, I suggest that this was not really the intent of a ‘review’ for a technical class such as this. Nearly all the academic papers that I have read, in my humble opinion, could be considered to be liturgically flawed in at least some minor way–yet I find this a non-issue with regard to overall content (usually of substantial worth) which is presented in the paper. Indeed, I was amused (for various reasons) by the phrase “All… [the authors] …did was look at what others have done and made an opinion about it, without doing much work of their own.” I would ask the question: is that not ‘really’ what we as masters students are all doing in this lab? Some would go as far to say that very little new ‘real’ primary research happens in this day and age, that nearly everything ‘new’ being published is just a different interpretation or rehash of other’s prior research. I, myself, do not feel qualified to offer up an opinion as to whether this is true or not, however.

   Additionally, in the most gracious manner possible, I wish to comment that I considered the content in this report a bit ‘lean.’ I realize the time constraints that many of us are operating under, and I realize that the execution of the lab was relatively uncomplicated; however, a few more details may have been in order for thoroughness. Also, the answer to the ‘why technology’ question seemed to miss the point. The answer “…because these tools are used for attacking a computer” is analogous to saying “I use a hammer because it’s a nail,” which really assumes that the listener knows why a hammer works for a nail-and so truly explains nothing. Furthermore, I do take exception to the assertion that “the best way to attack humans is in person.” I would counter that such technological ‘tools’ such as indirect fire weapons (i.e. artillery), or airborne weapon systems (both conventional and the occasional nuclear device) are nearly always far more ‘effective’ at ‘attacking’ other humans (with the option of being totally indiscriminant) than an ‘in person’ attack: the question is whether anything useful is gained. To be fair, I believe that ‘exploit’ was meant rather than ‘attack,’ and I would be much more inclined to entertain that statement as correct-semantic choice can make all the difference in the world.

   Finally, there were some noticeable gaps in the tool listings-I understand time constraints, but there were some very ‘large’ gaps. Now, I am no expert on networking technology, but I have read a few books on the matter: the classification of the tools looked, well, random. There is definitely room for opinion on some of the OSI layer fit for the TCP/IP suite, however: tools for SNMP in layer four (a layer seven protocol in most opinions), A TFTP tool in layer two (also generally considered layer seven), DNS tools in layer three (also seven in most literature I have seen), NetBIOS/BEUI tools in layer two (no lower than layer three in most regards), ICMP tools in layer four (most certainly belonging in three), and the list goes on. It would be dishonest if I said that I thought this was well researched, in that a simple web search yields a wealth of information on these issues. I would rather not touch the McCumber classifications: in my opinion, generally those tools which target data moving on the network are “transmission” type tools, and those which attack host based services are after static “storage” or compromising “processing,” but I think there is room for differences. In this case, being many tools are ‘well’ out of place-I think it pointless to critique classifications resulting from initial incorrect assumptions.

6. Overall, group 1 had a fairly good paper. The introduction was well written and a good lead into the remainder of the paper. The literature review was very thorough, however not always accurate with what the article stated. I particularly liked the synopsis of the article on fault injection and that it mentions that anomalies in the environment can cause faults within the software system. The review of “Building a Cyberwar Lab:Lessons Learned”, and how it discussed how the system was put together, and how it relates to our own lab was also very good. It was a very good review of “Broadening the Scope of Penteration-Testing”, very detailed.

   In the literature review, however, it mentions that Arces article discusses “previous cases of people attacking a system and getting fired for it”. In actuality, the document discusses the irony that Dan Farmer was fired from Silicon Graphics for releasing the scanning tool SATAN, and that now systems administrators may get fired for not scanning their networks. The literature review also discusses applying the OSI 7 layer model in that article. However, the article only mentions general classes of hacker tools in the section “Understanding the attacker’s toolkit”.

   The author lists a very large set of tools, some of which were missed by the other groups. However, many seemed to be simply placed on the list to increase the size of the content without reviewing the functions of the tools. One example of this is placing network scanning tools at the application level of the OSI model. In my opinion network scanning tools should be placed at the network layer (layer 3) or transport layer (layer4) of the OSI model, since that is the initial area of attack. Some examples follow.
   Netenum is a program that pings the network to find available hosts. I believe that it would be better placed in the network layer (layer 3) of the OSI model rather than in the application layer. Amap is a network penetration testing tool. As such I believe it should be put into the transport layer rather than the application layer of the OSI model.
   Unicorn scan works introducing a stimulus into and measuring a response from a TCP/IP enabled device or network. Because it is acting on the TCP protocol, I believe that it should be placed on layer 4, the transport layer.
   PBNJ is also a network scanning tool, and therefore don’t believe that it belongs in the application layer. I believe it would either go into layer three, the network layer, or layer four, the transport layer.

   One glaringly obvious mistake on the part of the author was placing Zenmap in the application area. Zenmap is a graphical user interface for nmap, a network scanning tool. Ironically, the author placed nmap in the network layer while Zenmap was placed in the application area. They are basically the same program, one with a command line interface and the other with a GUI interface.
   There were also some tools listed that were not attack tools at all. For example, Privoxy is a proxy server designed to help protect the user’s privacy. Another example is Proxytunnel. Proxytunnel isn’t an attack tool either. It is a utility for sending HTTPS encrypted data across a network. There are others that I believe are either misclassified on the OSI 7 layer model, or misclassified as attack tools.

   As a whole the document had many good points. However, some of the errors reflected the rushed nature with which the document was completed. I can certainly relate to that dilemma. Perhaps in the future the author will have more time to check things like tool descriptions and the accuracy of article reviews.

7. Along with the abstract I agree that teaching students about network environment threats is an important part of an information technology track. They had good literature reviews on the reading but did not see where they answered the questions. Is there a differenece between Ethereal and Wireshark? They used wireshark in there matrix chart. Protecting against known attacks is simpler then the unknown attacks. Showing students the different known attacks against a network environment can also show them the ways to protecting themselves from such attacks, such as in a virtual test lab environment as mention. The article by Mary Micco and Hart Rossman built a Cyberwar lab for there students to learn such ways in a protected environment. Unfortunately, not mentioned is that they only used one operating systems, Linux Red Hat 7.1 and if they were attacking just clients and or servers. The reading did not indicate that any of the labs required having Red Hat 7.1 server however in our lab requirement we had to have different clients and a server.
   In the methods section was one line about receiving virtual machines from Nick Pendergast’s however indicating what virtual machines were used would be a great benefit to know.
   Your matrix chart has a nice format. After review past layer 8 there seem to be tools there were missing but the layer and McCumber Cube coordinate are present.

8. Within the literature review section Team 1 addressed the topic, listed the research question if the article had one, and acknowledged if the articles had any errors or omissions, compared the theme of the articles to each other, and at times addressed the methodology used. However, the supporting data part of the review seemed very minimal at times and the review of some of the articles did not relate the article to the lab. In the Bill Coffin article the group said that they found an error or omission, but did not go into any detail to explain what the error was. In the Martin Mink and Felix C. Freiling article it was not necessary to point out that the higher likeliness for the students to become criminals with the knowledge they have obtained and thus “will not raise but rather decrease the overall level of security in the Internet because the author’s of the article already had pointed out that the statement was flawed.

   The group did a good job with their method section by giving a brief overview of the lab and presenting the questions that are to be addressed by completing the lab.

   There were a few discrepancies discovered in the section that had the exploits table. The table was missing the technology column, which would explain what particular technology that exploit or attack tool would effect. Some of the sections such as the people layer did not contain the required number of 30 exploits. I could not figure why the team included blank spaces in the table for the McCumber categories that did not contain any tools. It was implied that there would not be any attack tools or exploits to attack people or policy in McCumber’s cube below the eighth layer of the OSI model. However, I liked the efficiency of your group by placing all of the related tools into one single box. While some attack tools could be used to attack different layers of the OSI model depending upon their functionality, some of the tools appeared to be in the wrong layers. One particular example was Yesinia, which it said on its website affects the Data link layer. The kinetic layer appeared to contain exploits that would affect the Physical layer. Was the Kinetic layer for exploits that used computers to physically affect another computer or a system or machine that were connected to a network such as devices connected to SCADA controllers? Technically a bio-chemical attack would not affect computer devices themselves but the human operators that use them.
   I was somewhat unclear on what your team meant when the team stated:” Since many of the tools can go into multiple categories, there is a bias towards what must tools will attack. “I agree that some tools could fit into multiple categories, but their attacks are limited to doing a certain function or functions, so there is a definite service or protocol that the attack tools will affect.

9. To start the group began and gave their abstract. This was well designed and gave a good understanding as to what the lab was about and an overview as to what was going to be done. They then go onto the literature review. They do a nice job at reviewing each piece of literature and explaining the papers/articles while they go through them. Just like some of the others is that doing an overall comparison of the literature to each other will set a topic that can be thought about when someone is reading the lab. The one big thing that through me off was the location of there bibliography as this is to be put at the end of the document as per APA5 rules. This was not the only group that had a little trouble with citations but again help can be found at this website for future labs. ( http://owl.english.purdue.edu/owl/printable/560/) It is a good tool to have when creating labs or papers in APA 5 format. After the literature reviews they go into discussing the methodologies and what is to be done to create the lab environment. The did however not explain the lab environment enough and was vague on what the actual setup. It just says that one of the partners setup the lab per the instructions. How was it setup and what was used to set it up. Include what virtual machine where used and what is the environment of them. One thing that I had noticed going over the lab a couple times was that they left one of the questions out that needed to be answered between ethereal and wire shark. This was part of the requirements of the lab and is missing. They then go onto there table and it needs to be worked on. I do not know what happened but there are blank spots in the table where there is a coordinate for the Mccumber cube but there is no tool for that location. In the make sure to review any submissions before putting them onto the blog as it is a different format then any word processor. They did do a good job at categorizing what tools they had it just sticks out as the table is incomplete with the blank spaces. After the table they then go onto there findings and what they found while doing the lab. Next they go onto issue that they had occurred and did a good job explaining that they had an error this is what was done to resolve the issue. The last part was their conclusion and explained the purpose of the lab and why they where doing it but what was there also anything learned from the lab that may have not been know before. Overall the group had some issue with formatting and citation, but they did accomplish what was to be done. In the future labs the feed back from the peer reviews will be able to help this group create a more refined and complete lab.

Comments are closed.