CCA security of this scheme Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly sampled from $\{0,1\}^\lambda$. How to prove that this scheme is not CCA secure? In particular, how can an attack be thought of?
I won't give the answer; here are some hints:


Suppose we have a valid cipher text $(A, B) = F(k, r), r \oplus F(k, m)$.  What happens if we modify the ciphertext to be $(A, B \oplus C)$ and get that decrypted?
How can we use this?  What can we do if we have two ciphertexts that encrypt the same message $m$?