Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we hacked Blackboard and changed our grades (2018)

bustbyte.no

Post reply on HN
Print view View original

21–30 of 94 posts

Re: How we hacked Blackboard and changed our grades (2018)

#21

Post by mikeyouse »

maxyme wrote: post #7
choeger wrote: post #5

Ok, I might be a little out of date with my web development knowledge, but my first question would not be about the origin but about the embedding itself. The user's input is rendered in the web frontend of blackboard? Why? And second, how did they actually exploit it? Presumably the authentication works by some kind of token, right? Is the client js generally allowed to perform http requests outside of the origin do…

The student's input is rendered for teachers to make it easier to grade submissions without opening them in an external tool. As someone who used blackboard in college I can tell you it's a mess. Neither teachers nor students like it. It integrates with a ton of 3rd party libraries to be "helpful" by embedding content like this but ends up with a ton of different, inconsistent and often broken experiences.

And they're extremely litigious on IP matters which makes competing with them a nightmare.

Re: How we hacked Blackboard and changed our grades (2018)

#22

Post by keanebean86 »

tomatohs wrote: post #9

When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked. 30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age. I reported this to our IT department and they were not pleased. They let me know they had the power to expel me bu…

You're way cooler than me. I just injected rainbow css banners into my BB posts. I was too scared to try anything else.

Re: How we hacked Blackboard and changed our grades (2018)

#23

Post by thefreeman »

choeger wrote: post #5

Ok, I might be a little out of date with my web development knowledge, but my first question would not be about the origin but about the embedding itself. The user's input is rendered in the web frontend of blackboard? Why? And second, how did they actually exploit it? Presumably the authentication works by some kind of token, right? Is the client js generally allowed to perform http requests outside of the origin do…

yes, client js can make requests outside of the domain as long as the recipient domain allows it with CORS headers.

Re: How we hacked Blackboard and changed our grades (2018)

#24

Post by nabergh »

When I was a high school sophomore, Blackboard allowed you to customize your student homepage with widgets, one of which was a "notes" widget which allowed you to save random strings which would be displayed on your page next time you loaded it. Fortunately, if you saved arbitrary html, it would be rendered so we embedded flash games for us to play during classes which allowed computer use.

Re: How we hacked Blackboard and changed our grades (2018)

#25

Post by onemoresoop »

teppifk wrote: post #20
onemoresoop wrote: post #17

Earlier quoted context omitted.

If you earned that grade honestly a few ideas may stay with you for your entire life and that may change your life, even if imperceptibly. Anything you study has the potential to make you a better, more well rounded, knowledgeable and less ignorant person.

> Anything you study has the potential to make you a better, more well rounded, knowledgeable and less ignorant person. This is a pretty meaningless sentiment. There are plenty of things one can study that will lead to more ignorance and less well-roundedness. In the extreme, this is pretty much how cults can operate. I believe it also applies to a number of subjects in mainstream universities, but I am not going to…

You already did. Why not choose the right university/curriculum that you're interested in? Or you have a problem with most of them?

Re: How we hacked Blackboard and changed our grades (2018)

#26

Post by tru3_power »

A while back I looked into blackboard and did some light black box security testing on a demo app. From what I remember it was like Swiss cheese. Ultimately I stopped looking because they didn’t seem too interested. Some of the good ones I found were arbitrary file I/O issues, a few IDOR related problems as well. None of this surprises me.

Re: How we hacked Blackboard and changed our grades (2018)

#27

Post by IG_Semmelweiss »

onemoresoop wrote: post #18
danaur wrote: post #8

Earlier quoted context omitted.

I don't follow could you explain?

What's the point of going to school then if not to expose you to things and make you a better, more knowledgeable, well rounded person? If only grades matter then you can buy a fake diploma and you're done with it. You may be aware that you don't need to go to college in order to be a software developer/hacker. But if you decide to do that then what's the point in faking the grades?

THis is a very disingenuous comment.

>>>>>> What's the point of going to school then if not to expose you to things and make you a better, more knowledgeable, well rounded person?

The point of U, which seems forgotten at this point, is that it enhances your career options. You are not learning for the sake of being "well rounded". You are learning because it may lead to a future career. Anyone that thinks you pay to become more well rounded, will failsthis test:

Would anyone willingly pay $6k-$30k to spend the time to take LIBERAL ART classes in an avg university for a year, if that institution is not credentialed ? The answer is a resounding NO. Because no one prioritizes such LIBERAL arts content, they prioritize the credentials (diploma) obtained or specific technical skills.

As such, there very little to no value (at least in the low $x000s) to said exposure. This reveals this exposure is not at the core of the value of U. It is only there as a relic of the past. There is no demand for it. If the supply of funds for higher ED was not subsidized, the majority of said courses would go extinct within a decade (and the universities that offer them)

>>>>>>If only grades matter then you can buy a fake diploma and you're done with it.

You are blatantly ignoring the risk associated with doing , which carries a lifetime of penalties. If one can eliminate said risk for 80k in subsidized debt, while having fun, drinking beer, and dare i say learning a thing or two, why not do it?

>>>>>>You may be aware that you don't need to go to college

yes, this is why enrollments keep going down and will continue to do so. But does opting out of U have to fight back decade-old cultural perceptions passed on by our parents and grandparents that college is the thing you are supposed to do to have a solid career. Setting that cultural expectation on fire will take some time, it won't happen overnight, and will certainly reshape U as we know it today.

Re: How we hacked Blackboard and changed our grades (2018)

#28

Post by Smithalicious »

_nickwhite wrote: post #15

When I was in college around Y2K, I took a "Foundations of Music" class offered online- an elective that taught, well, foundations of music, specifically how to read music. Students had to install this janky, low-quality, Windows Visual Basic application and do 100% of the coursework using it. This VB app would output a results file, and then we had to upload it to the professor. Well, I edited the file, and found th…

A moral of the story is that people will optimize for what's being measured, not what is intended. Machine learning does this even more so, with hilarious results.

Re: How we hacked Blackboard and changed our grades (2018)

#29

Post by TeMPOraL »

XIVMagnus wrote: post #10
tomatohs wrote: post #9

When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked. 30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age. I reported this to our IT department and they were not pleased. They let me know they had the power to expel me bu…

I have and forever will find it extremely stupid to threaten someone with expelling them for trying to HELP you do your job.

Me too, but unfortunately it's standard idiocy both in schools and in large companies. Whether you're a curious student or a white-hat pentester, it's still the case that if you find something and say something, you're treated as if you were the danger.

Re: How we hacked Blackboard and changed our grades (2018)

#30

Post by satyrnein »

onemoresoop wrote: post #18
danaur wrote: post #8

Earlier quoted context omitted.

I don't follow could you explain?

What's the point of going to school then if not to expose you to things and make you a better, more knowledgeable, well rounded person? If only grades matter then you can buy a fake diploma and you're done with it. You may be aware that you don't need to go to college in order to be a software developer/hacker. But if you decide to do that then what's the point in faking the grades?

If grades don't matter, why did you show up for the exam?
Post reply on HN