Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we hacked Blackboard and changed our grades (2018)

bustbyte.no

Post reply on HN
Print view View original

81–90 of 94 posts

Re: How we hacked Blackboard and changed our grades (2018)

#81

Post by HeWhoLurksLate »

bredren wrote: post #33

When I was in high school, the “good” PCs were locked with a boot password. Only upper level cs students could use them. It was somewhat annoying to have to get our teacher to enter the password each time it froze etc. Partially because higher level classes were all individual study and often math classes were in progress in the same room. So it could take a while to get the teacher’s attention. So one time some clas…

I did something similar with the family PC a while ago- we had a wireless keyboard, and after convincing my parents to type in the password from the living room, I asked them to "log it in" from their bedroom. Notepad saved the day, and for some reason, very soon after that all the parental restrictions disappeared on my account.

I still hate Vista, though.

Re: How we hacked Blackboard and changed our grades (2018)

#83

Post by hippich »

d--b wrote: post #82

This seems to require a lot of trial-and-error. How did they do it? Did they send tons of crappy content to their teacher before finding the vulnerability that passed the filter?

From the video it seems they had instructor's access.

But in the real life they could save a draft and view it a student to see if they can hijack the session.

Another perhaps lesson - if security really matters - perhaps instructors and students should have completely different decoupled apps to do the job. (security through obscurity)

Re: How we hacked Blackboard and changed our grades (2018)

#84

Post by speedyapoc »

tombert wrote: post #56
mdorazio wrote: post #52

Earlier quoted context omitted.

Yup. Another example of this is when I was in college and other students would go on ratemyprofessor or look up grade distributions for different professors and class options to pick the easiest ones. The thought of, you know, actually learning something even if it was hard wasn’t even a consideration - they just wanted the GPA. This continues in the working world as well, unfortunately. Many employees will optimize…

The "choosing the easy professor path" always bothered me too; I always felt that it was stupid to go to college just to get the receipt, so I purposefully didn't do the ratemyprofessor thing, though now I almost wish I had, since I ended up on academic probation and eventually dropping out...though that might have less to do with my class selection and more to do with me spending most of my time playing Minecraft, u…

Small anecdote: I always did worse in college with professors or courses that were looked at as “easy” because I was not motivated to put in effort. Courses that were looked at as hard or professors that were rated as tough tended to make me “respect the class” and subsequently do better and learn more.

Re: How we hacked Blackboard and changed our grades (2018)

#85

Post by gabcoh »

_nickwhite wrote: post #15

When I was in college around Y2K, I took a "Foundations of Music" class offered online- an elective that taught, well, foundations of music, specifically how to read music. Students had to install this janky, low-quality, Windows Visual Basic application and do 100% of the coursework using it. This VB app would output a results file, and then we had to upload it to the professor. Well, I edited the file, and found th…

Almost the exact same situation with a music app when I was in high school. It would record you play a piece of music and then grade how many notes you got right. It would literally just save your grade into a SQLite database that you could manipulate before uploading to your teacher.

Re: How we hacked Blackboard and changed our grades (2018)

#86

Post by Zhenya »

kirykl wrote: post #59

Years ago I had an internship, in the lab there was a couple airgapped PCs with some confidential stuff on them, at least above my pay grade of $0. I was bored and tried logging with admin/admin and it worked, basically giving me root level access. I reported it, IT security interviewed me and I wasn't allowed near the PCs for the remainder of my internship.

Seems like their punishment should have redirected at themselves.

Re: How we hacked Blackboard and changed our grades (2018)

#87

Post by will4274 »

_nickwhite wrote: post #15

When I was in college around Y2K, I took a "Foundations of Music" class offered online- an elective that taught, well, foundations of music, specifically how to read music. Students had to install this janky, low-quality, Windows Visual Basic application and do 100% of the coursework using it. This VB app would output a results file, and then we had to upload it to the professor. Well, I edited the file, and found th…

I have a similar story. 7th grade, online science test, multiple choice and essay answers. When you click submit for the test, it shows you (in a javascript alert window) "you got X/Y correct. your essays have been submitted" and then POSTs to another page (which submits the essay). After I saw this on the first assignment, I had an idea. On the second assignment, i turned off my internet, and it still told me how many i got right and wrong, but then 404ed when it submitted my essay. So then, I modified my answers until I got them all right, plugged my internet back in, and submitted the multiple choice and essays, now with all the multiple choice answers correct.

Re: How we hacked Blackboard and changed our grades (2018)

#88

Post by Johnny555 »

mdorazio wrote: post #52
Smithalicious wrote: post #28

Earlier quoted context omitted.

A moral of the story is that people will optimize for what's being measured, not what is intended. Machine learning does this even more so, with hilarious results.

Yup. Another example of this is when I was in college and other students would go on ratemyprofessor or look up grade distributions for different professors and class options to pick the easiest ones. The thought of, you know, actually learning something even if it was hard wasn’t even a consideration - they just wanted the GPA. This continues in the working world as well, unfortunately. Many employees will optimize…

Maybe the professors who gave the best grades are the best teachers and that's why the students got better grades. If one teacher gave half of their students an A grade, and another one gave half of their students a failing grade, that doesn't sound like a problem with the students.

Re: How we hacked Blackboard and changed our grades (2018)

#89

Post by [deleted] »

Johnny555 wrote: post #88
mdorazio wrote: post #52

Earlier quoted context omitted.

Yup. Another example of this is when I was in college and other students would go on ratemyprofessor or look up grade distributions for different professors and class options to pick the easiest ones. The thought of, you know, actually learning something even if it was hard wasn’t even a consideration - they just wanted the GPA. This continues in the working world as well, unfortunately. Many employees will optimize…

Maybe the professors who gave the best grades are the best teachers and that's why the students got better grades. If one teacher gave half of their students an A grade, and another one gave half of their students a failing grade, that doesn't sound like a problem with the students.

[deleted]

Re: How we hacked Blackboard and changed our grades (2018)

#90

Post by maaaats »

perryprog wrote: post #74
maaaats wrote: post #12

Earlier quoted context omitted.

We used It's Learning in "high school". It had login without https at the time, and on the school wifi it was then easy to listen and get other's credentials. Some people got hold of some teachers' credentials, and tried to remove or alter some minuscule data. One guy however, decided to sell grade-editing as a service to others. Of course it was noticed by the school, and it became a big deal with police involved an…

Must've been fixed. My school used It's Learning for a while until this year, and it was fairly secure. HSTS of course.

Yes, this was 10 years ago. I may even misremember, maybe it was a unsecured single sign on in front or something where the fault actually was.
Post reply on HN