Hey Mike,

I feel disappointed in my marks for RIS4. I realize it was probably my fault for not giving you what you wanted but I feel like I had no options. I just felt like I was not able to see/gauge my answers/marks on test 1 before test 2 or the final exam took place. I guess I just feel like I had more of an understanding of what was actually happening behind the scenes technically but found it hard to explain it on paper because the topics we covered were soo wide and deep. For example, the one question about what could happen if an attacker took over a computer on LAN includes soo many attacks making it hard to fully explain. I don't like giving half-way answers because I feel like it would do the topic injustice. This meant that I would have had to fully include and explain every possible attack which could be a whole course by itself:

--Network Attacks
----DoS
------SYN Flooding, TCP Session Sniping (RST), CAM Table Overflows, Deauth Floods (void11), MIC Failure Floods (RenderMan, Joshua Wright, Church Of WiFi), MAC/IP Spoofing
----Remote Control
------Driver/Service Exploitation (Stack Smashing Alone Includes Huge Explanations, Heap Spraying, Format String/Integer Conversion Vulnerabilities), Stack Canary/NX Bit/ASLR Bypass, Return To libc Attacks, Shell Code Creation (x86 Assembly)
----Active Attacks
------ARP Cache Poisoning (dsniff, Ettercap, Cain And Able, Countering Attacks At Layer 2 By Eric Smith), SSL/TLS MITM/Strip (webmitm, sslstrip, Moxie Marlinspike), Rogue DHCP/DNS Servers, Packet Injection (Airpwn), Packet Modification (XSS/CSRF/SQL Attacks, Session Hijacking, HTML/java_script/Flash/Java/ActiveX Insertion), IDS/IPS Bypass Given Packet Fragmentation Attacks With Different Timeout Values Set (Dan Kaminsky), Evil Twin Attacks, Phishing Attacks
----Passive Attacks
------Packet Sniffing (tcpdump, Wireshark)
--Local Attacks
----Passive Attacks
------Keyboard Logging
----Active Attacks
------Pass-The-Hash, Password Hash Retrieval/Brute Forcing, Rootkits, Viruses, Malware, Adware, Badware, Spyware, DCHP/ARP/DNS/IP/Route Manipulation

This is just off the top of my head but the list seriously goes on and on (it's been a while since I've listened to some of the classic Defcon/RSA/Shmoocon/Toorcon talks so I've forgotten a bunch of attacks).

Lastly, I also feel like other students (not accusing or specifying anyone at all) simply copied and pasted what the group cheat-sheat had written down and they ended up receiving better marks than me. This made me mad because I actually tried to use the sheat only as a reference and then demonstrate what I actually know from memory. Im not trying to blame anyone I just wanted to get this off my chest is all.

Anyway, thank you for your time as always,
Jon.