Develop a broad vision, an architecture, and a detailed plan of action that follows a life cycle concept for Developing IT Compliance Program for Alibaba

Discussion: Should be between 250-to-300 words. 

DUE DATE: Wednesday End of Day USA time (3 days from now)

Reply: Is nothing but just additional 100-150 words on same topic but as a different paragraph. (I won’t send any replies to you and then you send info on that. NO) 

DUE DATE: Saturday End of Day USA time (6 days from now)

Topic:

Many business environments have both visible and invisible physical security controls. You see them at the post office, at the corner store, and in certain areas of your own computing environment. They are so pervasive that some people choose where they live based on their presence, as in gated access communities or secure apartment complexes. Alison is a security analyst for a major technology corporation that specializes in data management. This company includes an in house security staff (guards, administrators, and so on) that is capable of handling physical security breaches. Brad experienced an intrusion—into his personal vehicle in the company parking lot. He asks Alison whether she observed or recorded anyone breaking into and entering his vehicle, but this is a personal item and not a company possession, and she has no control or regulation over damage to employee assets. This is understandably unnerving for Brad, but he understands that she’s protecting the business and not his belongings.

When or where would you think it would be necessary to implement security measures for both?

Please make your initial post and two response posts substantive. A substantive post will do at least TWO of the following:

• Ask an interesting, thoughtful question pertaining to the topic
• Answer a question (in detail) posted by another student or the instructor
• Provide extensive additional information on the topic
• Explain, define, or analyze the topic in detail
• Share an applicable personal experience
• Provide an outside source that applies to the topic, along with additional information about the topic or the source (please cite properly in APA 7)
• Make an argument concerning the topic.

At least one scholarly source should be used in the initial discussion thread. Use proper citations and references in your post.

For this assignment, please complete the following:

Provide  a reflection of at least 500 words (or 2 pages double-spaced) of how  the knowledge, skills, or theories of this course have been applied or  could be applied, in a practical manner to your current work  environment. If you are not currently working, share times when you have  or could observe these theories, and knowledge could be applied to an  employment opportunity in your field of study. 

REQUIREMENTS:

Provide a 2 page double spaced minimum reflection (i.e. no less than 2 full pages of content). This does not include the required APA Cover Page and reference page.

Use of proper APA formatting and citations. If supporting evidence from outside resources is used those must be properly cited.

Share a personal connection that identifies specific knowledge and theories from this course.

 
Review the section on Linear Development in Learning Approaches.  Discuss how learning changes over time impact organizational culture.  What is the impact of this cultural change on the success of IT projects?

Review the Roles of Line Management and Social Network and Information Technology sections.  Note the various roles in the organization and note the similarities and differences within each role.  Also, note how innovation technology management shapes how we communicate amongst coworkers within an organization.  

BLCN532 Lab 1

Set up your development environment

V2.0

Introduction

This course introduces students to blockchain development for enterprise environments. Before you can develop software applications, you need to ensue your development environment is in place. That means you’ll need all the tools and infrastructure installed and configured to support enterprise blockchain software development projects. 

In this lab you’ll set up your own Hyperledger Fabric development environment and install the course software from the textbook. When you finish this lab, you’ll have a working development environment and will be ready to start running and modifying blockchain applications. 

The instructions in your textbook are for Mac and Linux computers. However, there is no guarantee that your installation of MacOS or Linux is completely compatible with the environment in which the commands from the textbook work properly. For that reason, I STRONGLY SUGGEST that you acquire an Ubuntu 16.04 Virtual Machine (VM) for your labs. Using an Ubuntu 16.04 VM will make the labs far easier to complete. 

The instructions in this course’s labs assume that your computer runs the Windows operating system. If you run MacOS or Linux, you can get Vagrant and VirtualBox for those operating systems and follow the gist of the “Initial setup for Windows computers”. 

Lab Deliverables:

To complete this lab, you must create a Lab Report file and submit the file in iLearn. The Lab Report file must be a Microsoft Word format (.docx), and have the filename with the following format:

BLCN532_SECTION_STUDENTID_LASTNAME_FIRSTNAME_Lab01.docx

· SECTION is the section number of your current course (2 digits)

· STUDENTID is your student ID number (with leading zeros)

· LASTNAME is your last name, FIRSTNAME is your first name

To get started, create a Microsoft Word document (.docx) with the correct filename for this lab. You’ll be asked to enter text and paste screenshots into the lab report file.

NOTE: All screenshots MUST be readable. Use the Ubuntu Screen Capture utility (see the lab video.) Make sure that you label each screenshot (i.e. Step 2.1.3) and provide screenshots in order. For commands that produce lots of output, I only want to see the last full screen when the command finishes. Provide FULL screenshots, NOT cropped images.

SECTION 1: Initial setup for Windows computers (Chapter 3)

Step 1.1: Install Oracle Virtualbox (Windows, Linux, MacOS)

Oracle Virtualbox is an open source virtualization environment that allows you to run multiple virtual machines and containers on a single personal computer. Virtualbox is free and it is easy to install. 

In your favorite web browser, navigate to: https://www.virtualbox.org/ and click the “Download Virtualbox” button. Click the “Windows hosts” link to download the main installation executable. You should also click the “All supported platforms” under the “Extension Pack” heading to download extra software support for devices.

After you download the two files, double click each one to run the install procedure. 

Step 1.2: Install Vagrant (Windows, Linux, MacOS)

Vagrant is a free virtual environment management utility. It makes the process of starting, stopping, and managing virtual machines easier. In your web browser, navigate to https://www.vagrantup.com/ then click the “Download” button, and click the version of the Windows executable you’d like to install. (Most of you should select the “64-bit” version.) 

Once you download the install program, double-click the file you just downloaded to install Vagrant.

If you want more information on Vagrant and tips on getting the most out of the software, navigate to: 

https://www.sitepoint.com/getting-started-vagrant-windows/ .

Step 1.3: Set up your Vagrant project

After installing all the pre-requisite pieces, you need to set up your Vagrant project. A Vagrant project defines your virtual machine environment and helps you organize your collection of VMs into a group that is easy to manage. 

We’ll use the Windows PowerShell as our Windows command prompt environment. PowerShell is a very powerful command line interface that is available on all Windows computers. 

To launch PowerShell, click the Windows key, type PowerShell, then click the Windows PowerShell menu entry. The figure below shows a portion of the Windows PowerShell command prompt window.

PowerShell uses your user’s home directory as its starting directory. In my case, C:Usersmicha is my home directory. For the rest of the lab, I’ll refer to this a %HOME%. Your %HOME% will be different. 

1.3.1: Remove existing Vagrant projects

Follow these steps ONLY if you already have a previous Vagrant project you want to remove: (Assume the project you want to remove is located in the %HOME%vagrantHyperledger directory.)

If you DO NOT have an existing Vagrant project that you need to remove, skip to section 1.3.2. 

1. PS %HOME%vagrantHyperledger> vagrant global-status

Note the id of the listed VM(s). You’ll use this id in the next command, in place of xxxxxxx.

2. PS %HOME%vagrant\Hyperledger> vagrant destroy xxxxxxx

3. PS %HOME%vagrant\Hyperledger> vagrant box remove ubuntu/xenial64

1.3.2: Create a new Vagrant project for Hyperledger

Launch PowerShell and enter the following commands: (Don’t type ‘PS %HOME%>’, that’s just the PowerShell prompt. Just type the characters in bold.)

1. PS %HOME%> mkdir vagrant

2. PS %HOME%> cd vagrant

3. PS %HOME%vagrant> mkdir Hyperledger

4. PS %HOME%vagrant> cd Hyperledger

5. PS %HOME%vagrantHyperledger> vagrant init kelly219design/ubuntu-xenial-16.04-gui-desktop-base

Make sure that you enter the line above as ONE LINE at the PowerShell prompt 

6. Go to the Blackboard site (ucumberlands.blackcoard.com) and login.

7. Navigate to this course (BLCN532) -> Content for this week, Lab01.

a. Download the Vagrantfile file and copy it to the %HOME%vagrantHyperledger directory. (This will overwrite the Vagrantfile that was already there.)

8. PS %HOME%vagrantHyperledger> vagrant up

NOTE: To stop your VM type vagrant halt in PowerShell

Section 2: Install Pre-requisites (Chapter 3)

Once you have an operating Linux VM, you can start to install the Hyperledger Fabric pre-requisites. In this section you’ll install all the software and configuration pieces necessary to run the class enterprise blockchain application in Hyperledger Fabric.

Step 2.1: Install pre-reqs

2.1.1: Install dev tools

1. If you haven’t started your VM, do the following:

a. Open Windows PowerShell, then navigate to your Hyperledger project directory.

b. PS %HOME%vagrantHyperledger> vagrant up

2. Login to your VM using the username: vagrant and password: vagrant

3. Click “Search your computer” (upper left corner icon), then type terminal.

4. Click on the Terminal icon to launch a terminal with a shell prompt.

You type all the following commands in your Linux VM (at the Terminal command prompt.)

Don’t type the ‘$’ character. That is the prompt character of a regular user to remind you that this is a command you should enter in Linux. When you see a ‘#’ character, that indicates you are in an elevated privilege shell. And the ‘>’ character indicates you’re in PowerShell. Pay attention to the prompt characters – they give you valuable information about your current context. 

5. $ sudo apt-get update

6. $ sudo apt-get install libltdl-dev

2.1.2: Install Docker-CE

You can find complete Docker-CE instructions/docs at: https://docs.docker.com/install/linux/docker-ce/ubuntu/

1. $ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add –

2. $ sudo add-apt-repository “deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable”

Make sure that you enter the line above as ONE LINE in Linux 

3. $ sudo apt-get update

4. $ sudo apt-get install docker-ce docker-ce-cli containerd.io

2.1.3: Install Docker compose

1. $ sudo curl -L “https://github.com/docker/compose/releases/download/1.23.2/docker-compose-$(uname -s)-$(uname -m)” -o /usr/local/bin/docker-compose

2. $ sudo chmod +x /usr/local/bin/docker-compose

3. $ docker-compose version

4. $ date

5. Create a screenshot of the results of steps 1 – 4 and paste it into your Lab Report File. 

2.1.4: Install business network pre-reqs

1. $ curl -O https://hyperledger.github.io/composer/latest/prereqs-ubuntu.sh

2. $ chmod u+x prereqs-ubuntu.sh

3. $ ./prereqs-ubuntu.sh

4. $ date

5. Create a screenshot of the results of steps 1 – 4 and paste it into your Lab Report File. 

>>> Logout (use the gear icon in the upper right corner) and log back in before continuing.

2.1.5: Install GO language

The next step is to install the GO programming language. You’ll use GO to write and modify source code files for the class blockchain application. 

1. $ sudo apt-get update

2. $ wget https://dl.google.com/go/go1.12.1.linux-amd64.tar.gz

3. $ tar xvf go1.12.1.linux-amd64.tar.gz

4. $ nano ~/.profile

5. In the nano editor, add the following 2 lines after the last line in the file:

export GOPATH=$HOME/go

export PATH=$PATH:$GOPATH/bin

6. Save your file and exit nano

7. $ source .profile

8. $ go version

9. $ date

10. Create a screenshot of the results of steps 1 – 9 and paste it into your Lab Report File. 

Step 2.2: Install source code and set up business network

In this step you download and install the class application source code and set up the business network. 

2.2.1: Forking and Cloning the trade-finance-logistics repository

1. In a browser (in Windows) go to: https://github.com/HyperledgerHandsOn/trade-finance-logistics

2. Sign up or log in

3. Click Fork

You type all the following commands in your Linux VM (at the command prompt.)

4. $ cd $GOPATH/src

5. $ git clone https://github.com/YOUR_GIT_ID/trade-finance-logistics.git

6. $ cd $GOPATH/src

7. $ mkdir -p github.com/hyperledger

8. $ cd github.com/hyperledger

9. $ git clone https://github.com/hyperledger/fabric.git -b release-1.1

10. $ cd fabric

11. EDIT FILES ***** 

a. $ nano Makefile

b. Find the line starts with CHAINTOOL_RELEASE (hint: use CTRL W to search)

c. Change the line you just found to this: CHAINTOOL_RELEASE=1.1.3

d. Find the line that starts with CHAINTOOL_URL (hint: use CRTL W to search)

e. Change the line you just found to this: CHAINTOOL_URL ?= https://hyperledger.jfrog.io/hyperledger/fabric-maven/org/hyperledger/fabric-chaintool/$(CHAINTOOL_RELEASE)/fabric-chaintool-$(CHAINTOOL_RELEASE).jar

NOTE: The line above should be on a SINGLE LONG LINE (don’t break up the line into multiple lines) 

f. Save the file (hint: use CRTL O to write the file)

g. Exit the nano editor (hint: use CTRL X to exit)

h. $ nano images/javaenv/Dockerfile.in

i. Find the line that starts with && curl -fsSL https://nexus.hyperledger.org 

j. Change the line you just found to this: && curl -fsSL https://repo1.maven.org/maven2/org/apache/maven/apache-maven/$MAVEN_VERSION/apache-maven-$MAVEN_VERSION-bin.tar.gz

NOTE: The line above should be on a SINGLE LONG LINE (don’t break up the line into multiple lines) 

k. Save the file (hint: use CRTL O to write the file)

l. Exit the nano editor (hint: use CTRL X to exit)

12. $ make docker

13. $ make configtxgen cryptogen

14. $ git clone https://github.com/hyperledger/fabric-ca.git

15. $ cd fabric-ca

16. $ make docker

17. $ date

18. Create a screenshot of the results of steps 1 – 17 and paste it into your Lab Report File. 

2.2.2: Generate network cryptographic material

1. $ cd $GOPATH/src/trade-finance-logistics/network

2. $ nano ~/.profile

change last line to this (all on 1 line, not 2):

export PATH=$PATH:$GOPATH/bin:$GOPATH/src/github.com/hyperledger/fabric/build/bin:$GOPATH/src/github.com/hyperledger/fabric/build/docker/bin

3. Save file and exit nano

4. $ source ~/.profile 

5. $ cryptogen generate –config=./crypto-config.yaml

6. $ date

7. Create a screenshot of the results of steps 1 – 6 and paste it into your Lab Report File. 

2.2.3: Generate channel artifacts

1. $ cd $GOPATH/src/trade-finance-logistics/network

2. Execute the follow commands OR run the trade.sh script (AFTER step 9)

3. $ mkdir -p channel-artifacts

4. $ configtxgen -profile FourOrgsTradeOrdererGenesis -outputBlock ./channel-artifacts/genesis.block

5. $ configtxgen -profile FourOrgsTradeChannel -outputCreateChannelTx ./channel-artifacts/channel.tx -channelID tradechannel

6. $ configtxgen -profile FourOrgsTradeChannel -outputAnchorPeersUpdate ./channel-artifacts/ExporterOrgMSPanchors.tx -channelID tradechannel -asOrg ExporterOrgMSP

7. $ configtxgen -profile FourOrgsTradeChannel -outputAnchorPeersUpdate ./channel-artifacts/ImporterOrgMSPanchors.tx -channelID tradechannel -asOrg ImporterOrgMSP

8. $ configtxgen -profile FourOrgsTradeChannel -outputAnchorPeersUpdate ./channel-artifacts/CarrierOrgMSPanchors.tx -channelID tradechannel -asOrg CarrierOrgMSP

9. $ configtxgen -profile FourOrgsTradeChannel -outputAnchorPeersUpdate ./channel-artifacts/RegulatorOrgMSPanchors.tx -channelID tradechannel -asOrg RegulatorOrgMSP

OR (Instead of typing the commands above, the author provides a script to do it all)

1. $ ./trade.sh generate -c tradechannel

Troubleshooting help:

· If you encounter problems with your blockchain network in this lab or future labs, the ./trade.sh script may help you resolve them. If you are getting errors when trying to launch or interact with your network, try these commands at the Ubuntu command prompt:

o ./trade.sh down # If your network is up and running

o ./trade.sh clean

o ./trade.sh generate -c tradechannel 

o ./trade.sh up

2.2.4: Launch the sample trade network

There are two ways to launch the sample trade network, using the docker-compose command directly, or by using the author-supplied trade.sh shell script. We’ll use the shell script in most of our activities. 

1. $ cd $GOPATH/src/trade-finance-logistics/network

2. $ ./trade.sh up

3. $ date

4. Create a screenshot of the results of steps 1 – 3 and paste it into your Lab Report File. 

Step 2.3: Verifying your business network

The last step in this lab is to verify that your business network is up and running.

1. Open a new terminal window in your Vagrant Hyperledger VM. Click “Search your computer” (upper left corner icon), then type terminal, then click the Terminal icon.)

2. Enter the following command:

3. $ docker ps -a

4. $ date

5. Create a screenshot of the results of steps 2 – 4 and paste it into your Lab Report File. 

6. The first column in the previous output is the “container-ID”. Find the container-ID for the orderer process, and use it for the following command: (Don’t type the “<” or “>” characters)

7. $ docker logs

8. Create a screenshot of the results of step 7 and paste that screenshot into your Lab Report File. 

Section 3: Wrapping up

Once you have your network up and running, the only step to complete is to learn how to properly shutdown your business network.

1. Shut down the business network in Linux:

2. $ ./trade.sh down

3. Exit from your Linux Terminal command prompt(s) (i.e. close any open Terminal windows.)

4. $ exit

5. In Windows PowerShell, shut down your Hyperledger virtual machine:

9.  PS %HOME%vagrantHyperledger> vagrant halt

10. Create a snapshot (NOT A SCREENSHOT) of your Ubuntu VM in VirtualBox. This allows you to easily restore to this point if you ever need to “undo” subsequent steps and return to a known point. 

a. PS %HOME%vagrantHyperledger> vagrant snapshot EndOfLab01

You should have 8 screenshots in your Lab Report File. Save your file and submit it in iLearn as a file attachment for the Lab 1 assignment. 

Congratulations! You have complete lab 1.

In this homework, you will do some data analysis using R for the Forest Fire Data described https://archive.ics.uci.edu/ml/datasets/forest+fires (Links to an external site.) The dataset is used to find the relationship between the burned area of forest fires and meteorological data.

Please provide your output only in .HTML format. Do not send the .rmd file.

I have already downloaded the forest fires data and added it to the files section.

https://classroom.ucsc-extension.edu/files/1144259/download?download_frd=1

1. Import the data into R.

• How many observations are there in the dataset?
• How many observations are there with a fire (i.e., area>0)
• How many observations are there with a rain (i.e., rain>0)
• How many observations are there with both a fire and a rain?

 2.Show the columns month, day, area of the all the observations.

 3. Show the columns month, day, area of the observations with a fire.

 4.How large are the five largest fires (i.e., having largest area)

 a.What are the corresponding month, temp, RH,wind, rain area?

 b.Add one column to the data indicating whether a fire occurred for each   observation (True for area >0 and False for area ==0) (Use Mutate function)

5.Create the following to display the outliers from the below vector.

    -plot 

   – boxplot

Also mention the numbers that are outliers in this vector.

(1,2,50,45,67,200,230,55,56,49)

6. Using the dplyr approach, perform the following actions from ‘iris’

  a) select the columns  Sepal.Length, Sepal.Width, Petal.Length,Petal.Width

 b) filter the iris data for Species = “setosa” or “virginica”

A three-tier web application architecture has been generically defined as the presentation, business logic, and data storage tiers. However, Amazon Web Services defines the three-tier web application architecture as the web, application, and storage/database tiers.

Write a paper comparing the generic three-tier web application architecture to that applied by Amazon Web Services.

Apply APA Edition 6 formatting.

Use at least three properly documented references (do NOT use wikis).

Correctly cite your references using APA Edition 6 formatting.

Your paper should be at least 500 words in length using good grammar.

Use complete sentences and paragraphs. Do not use bullets.

Both parts of this assignment need to be done. 

 In this lab, students need to conduct attacks on the TCP/IP protocols. They can use the Netwox tools and/or other tools in the attacks. All the attacks are performed on Linux operating systems. However, instructors can require students to also conduct the same attacks on other operating systems and compare the observations. To simplify the “guess” of TCP sequence numbers and source port numbers, we assume that attackers are on the same physical network as the victims. Therefore, you can use sniffer tools to get that information. The following is the list of attacks that need to be implemented. 3.1 Task 1 : SYN Flooding Attack ` ` User Server SYN SYN+ACK ACK Active TCP Connection ` ` Attacker Server SYN Spoofed Addresses SYN+ACK ` Legitimate User SYN No Reply Normal TCP 3-way handshake between user and server SYN Flood: attacker sends many SYN to server without ACK. The server is not able to process request from legitimate user 1 2 3 4 1 2 3 Figure 2: SYN Flooding Attack SEED Labs – TCP/IP Attack Lab 4 SYN flood is a form of DoS attack in which attackers send many SYN requests to a victim’s TCP port, but the attackers have no intention to finish the 3-way handshake procedure. Attackers either use spoofed IP address or do not continue the procedure. Through this attack, attackers can flood the victim’s queue that is used for half-opened connections, i.e. the connections that has finished SYN, SYN-ACK, but has not yet gotten a final ACK back. When this queue is full, the victim cannot take any more connection. Figure 2 illustrates the attack. The size of the queue has a system-wide setting. In Linux, we can check the setting using the following command: # sysctl -q net.ipv4.tcp_max_syn_backlog We can use command “netstat -na” to check the usage of the queue, i.e., the number of halfopened connection associated with a listening port. The state for such connections is SYN-RECV. If the 3-way handshake is finished, the state of the connections will be ESTABLISHED. In this task, you need to demonstrate the SYN flooding attack. You can use the Netwox tool to conduct the attack, and then use a sniffer tool to capture the attacking packets. While the attack is going on, run the “netstat -na” command on the victim machine, and compare the result with that before the attack. Please also describe how you know whether the attack is successful or not. The corresponding Netwox tool for this task is numbered 76. Here is a simple help screen for this tool. You can also type “netwox 76 –help” to get the help information. Listing 1: The usage of the Netwox Tool 76 Title: Synflood Usage: netwox 76 -i ip -p port [-s spoofip] Parameters: -i|–dst-ip ip destination IP address -p|–dst-port port destination port number -s|–spoofip spoofip IP spoof initialzation type SYN Cookie Countermeasure: If your attack seems unsuccessful, one thing that you can investigate is whether the SYN cookie mechanism is turned on. SYN cookie is a defense mechanism to counter the SYN flooding attack. The mechanism will kick in if the machine detects that it is under the SYN flooding attack. You can use the sysctl command to turn on/off the SYN cookie mechanism: # sysctl -a | grep cookie (Display the SYN cookie flag) # sysctl -w net.ipv4.tcp_syncookies=0 (turn off SYN cookie) # sysctl -w net.ipv4.tcp_syncookies=1 (turn on SYN cookie) Please run your attacks with the SYN cookie mechanism on and off, and compare the results. In your report, please describe why the SYN cookie can effectively protect the machine against the SYN flooding attack. If your instructor does not cover the mechanism in the lecture, you can find out how the SYN cookie mechanism works from the Internet. 3.2 Task 2 : TCP RST Attacks on telnet and ssh Connections The TCP RST Attack can terminate an established TCP connection between two victims. For example, if there is an established telnet connection (TCP) between two users A and B, attackers can spoof a RST packet from A to B, breaking this existing connection. To succeed in this attack, attackers need to correctly construct the TCP RST packet. SEED Labs – TCP/IP Attack Lab 5 In this task, you need to launch an TCP RST attack to break an existing telnet connection between A and B. After that, try the same attack on an ssh connection. Please describe your observations. To simplify the lab, we assume that the attacker and the victim are on the same LAN, i.e., the attacker can observe the TCP traffic between A and B. The corresponding Netwox tool for this task is numbered 78. Here is a simple help screen for this tool. You can also type “netwox 78 –help” to get the help information. Listing 2: The usage of the Netwox Tool 78 Title: Reset every TCP packet Usage: netwox 78 [-d device] [-f filter] [-s spoofip] Parameters: -d|–device device device name {Eth0} -f|–filter filter pcap filter -s|–spoofip spoofip IP spoof initialization type {linkbraw} 3.3 Task 3 : TCP RST Attacks on Video Streaming Applications Let us make the TCP RST attack more interesting by experimenting it on the applications that are widely used in nowadays. We choose the video streaming application in this task. For this task, you can choose a video streaming web site that you are familiar with (we will not name any specific web site here). Most of video sharing websites establish a TCP connection with the client for streaming the video content. The attacker’s goal is to disrupt the TCP session established between the victim and video streaming machine. To simplify the lab, we assume that the attacker and the victim are on the same LAN. In the following, we describe the common interaction between a user (the victim) and some video-streaming web site: • The victim browses for a video content in the video-streaming web site, and selects one of the videos for streaming. • Normally video contents are hosted by a different machine, where all the video contents are located. After the victim selects a video, a TCP session will be established between the victim machine and the content server for the video streaming. The victim can then view the video he/she has selected. Your task is to disrupt the video streaming by breaking the TCP connection between the victim and the content server. You can let the victim user browse the video-streaming site from another (virtual) machine or from the same (virtual) machine as the attacker. Please be noted that, to avoid liability issues, any attacking packets should be targeted at the victim machine (which is the machine run by yourself), not at the content server machine (which does not belong to you). 3.4 Task 4 : TCP Session Hijacking The objective of the TCP Session Hijacking attack is to hijack an existing TCP connection (session) between two victims by injecting malicious contents into this session. If this connection is a telnet session, attackers can inject malicious commands (e.g. deleting an important file) into this session, causing the victims to execute the malicious commands. Figure 3 depicts how the attack works. In this task, you need to demonstrate how you can hijack a telnet session between two computers. Your goal is to get the the telnet server to run a malicious command from you. For the simplicity of the task, we assume that the attacker and the victim are on the same LAN. SEED Labs – TCP/IP Attack Lab 6 Note: If you use Wireshark to observe the network traffic, you should be aware that when Wireshark displays the TCP sequence number, by default, it displays the relative sequence number, which equals to the actual sequence number minus the initial sequence number. If you want to see the actual sequence number in a packet, you need to right click the TCP section of the Wireshark output, and select “Protocol Preference”. In the popup window, uncheck the “Relative Sequence Number and Window Scaling” option. The corresponding Netwox tool for this task is numbered 40. Here is part of the help screen for this tool. You can also type “netwox 40 –help” to get the full help information. You may also need to use Wireshark to find out the correct parameters for building the spoofed TCP packet. Listing 3: Part usage of netwox tool 40 Title: Spoof Ip4Tcp packet Usage: netwox 40 [-l ip] [-m ip] [-o port] [-p port] [-q uint32] [-B] Parameters: -l|–ip4-src ip IP4 src {10.0.2.6} -m|–ip4-dst ip IP4 dst {5.6.7.8} -o|–tcp-src port TCP src {1234} -p|–tcp-dst port TCP dst {80} -q|–tcp-seqnum uint32 TCP seqnum (rand if unset) {0} -H|–tcp-data mixed_data mixed data ` ` User Server ` Attacker Attacker hijacks the TCP session and sends “Z” to server on behalf of client Data: “A” Data: “Z” Seq No.: ? ACK 3-way Handshake Data: “B” ACK Sniffing Figure 3: TCP Session Hijacking Attack SEED Labs – TCP/IP Attack Lab 7 3.5 Task 5 : Creating Reverse Shell using TCP Session Hijacking When attackers are able to inject a command to the victim’s machine using TCP session hijacking, they are not interested in running one simple command on the victim machine; they are interested in running many commands. Obviously, running these commands all through TCP session hijacking is inconvenient. What attackers want to achieve is to use the attack to set up a back door, so they can use this back door to conveniently conduct further damages. A typical way to set up back doors is to run a reverse shell from the victim machine to give the attack the shell access to the victim machine. Reverse shell is a shell process running on a remote machine, connecting back to the attacker’s machine. This gives an attacker a convenient way to access a remote machine once it has been compromised. In the following, we will show how we can set up a reverse shell if we can directly run a command on the victim machine (i.e. the server machine). In the TCP session hijacking attack, attackers cannot directly run a command on the victim machine, so their jobs is to run a reverse-shell command through the session hijacking attack. In this task, students need to demonstrate that they can achieve this goal. 

1. Develop a personal “operative paradigm” based on a review of the paradigmatic assumptions and concepts involved in each of the three basic methodological approaches in organization and management research. First, a brief review of the three basic methodological approaches in organization and management research is conducted. Second, the preferred personal “operative paradigm” is covered based on the following components: assumptions, concepts, propositions, hypotheses, variables, and operational definitions.
2. The body of your paper should be 7–10 pages long, written in good APA, and with at least 10 references.