how to prove that given cryptosystem is not IND-CCA secure? Let $m$ and $k$ be positive integers ($m$ bit plain text) ; let $Q$ be a family of trapdoor one-way permutations such that $f : \{0,1\}^k \rightarrow \{0,1\}^k$ for all $f$ in $Q$; and let $G : \{0,1\}^k \rightarrow \{0,1\}^m$ be a random oracle. Let $P = \{0,1\}^m$ and $C = \{0,1\}^k \times \{0,1\}^m$, and define

$K = \{(f, f^{(-1)},G) : f$ in $Q\}$

For $K = (f,f^{(-1)},G)$, let $r$ in $\{0,1\}^k$ be chosen randomly, and define

encryption of $x = (y_1,y_2) = (f(r),G(r) \oplus x)$, where $y_1$ in $\{0,1\}^k$, $y_2$ in $\{0,1\}^m$

decryption of $(y_1,y_2) = G(f^{(-1)}(y_1)) \oplus y_2$

The functions $f$ and $G$ are public key; the function $f^{(-1)}$ is the private key
Given two plaintexts x1; x2 and a ciphertext (y1; y2) where y1 = f(r) and y2 = G(r) xor xi
for a random i(1,2) a CCA can query the decryption of (y1; ~y) where ~y != y2. Upon
receiving the answer x, the attacker can recover G(r) = ~y xor x. Then the attacker can
compute xi = G(r) xor y2 and find i.