Live data from Hacker News

How we hacked Blackboard and changed our grades (2018)

bustbyte.no

11–20 of 94 posts

Re: How we hacked Blackboard and changed our grades (2018)

#12
post #9

When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked. 30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age. I reported this to our IT department and they were not pleased. They let me know they had the power to expel me bu…

We used It's Learning in "high school". It had login without https at the time, and on the school wifi it was then easy to listen and get other's credentials. Some people got hold of some teachers' credentials, and tried to remove or alter some minuscule data.

One guy however, decided to sell grade-editing as a service to others. Of course it was noticed by the school, and it became a big deal with police involved and everything. Happy ending, though, the two people I know that was involved got master's in compsci a few years later.

Re: How we hacked Blackboard and changed our grades (2018)

#13
post #5

Ok, I might be a little out of date with my web development knowledge, but my first question would not be about the origin but about the embedding itself. The user's input is rendered in the web frontend of blackboard? Why? And second, how did they actually exploit it? Presumably the authentication works by some kind of token, right? Is the client js generally allowed to perform http requests outside of the origin do…

> my first question would not be about the origin but about the embedding itself. The user's input is rendered in the web frontend of blackboard? Why?

I think Blackboard sees this as a convenience feature, i.e. students submit assignments as, say, PDF documents and they can be viewed directly within Blackboard without the extra steps of downloading. Just silly that it works with anything that can interact with web API, but maybe that was requested specifically?

> Is the client js generally allowed to perform http requests outside of the origin domain?

EDIT: By default, yes, but I'm not sure what restrictions can be applied. (I'm misremembering how CORS even works so I took out my previous paragraph.)

In any case, Blackboard probably provided other tools they could use within the domain as well. For example they could probably trigger some sort of user-to-user private messaging and send the token in the body.

Re: How we hacked Blackboard and changed our grades (2018)

#14
post #9

When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked. 30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age. I reported this to our IT department and they were not pleased. They let me know they had the power to expel me bu…

I have and forever will find it extremely stupid to threaten someone with expelling them for trying to HELP you do your job.

I got in-school suspension for the last 1/3 of senior year in HS because I took screenshots of a shared network directory permissions problem.

Re: How we hacked Blackboard and changed our grades (2018)

#15
When I was in college around Y2K, I took a "Foundations of Music" class offered online- an elective that taught, well, foundations of music, specifically how to read music. Students had to install this janky, low-quality, Windows Visual Basic application and do 100% of the coursework using it. This VB app would output a results file, and then we had to upload it to the professor. Well, I edited the file, and found that it had a primitive CSV-like format where right answers were basically question1=1 and wrong answers were question1=0.

So theoretically, I could have just generated answer files for every single lesson for the whole semester- and a lot of them I did. BUT, I was scared that the final exam was going to be conducted on-campus, where it would be less tenable to be a dirty-rotten-cheating-scumbag.

So I actually had to learn the coursework, and learn how to read music and all its intricacies. (I do not play an instrument unless you count guitar chords.)

When the final exam came, instead of it being on-campus, the professor used the EXACT SAME VB application to run it. It took me about 5 minutes and I scored a 100% on it thanks to notepad.exe.

There's a moral to this story somewhere. I use notepad.exe a lot more these days than I read music, so perhaps it was foreshadowing an IT career?

Re: How we hacked Blackboard and changed our grades (2018)

#17
post #11

Changing your grades may look like a thrill now but in the long run you're only screwing yourselves.

Yeah earning that A in Sociology 101 really changed my life's trajectory.

If you earned that grade honestly a few ideas may stay with you for your entire life and that may change your life, even if imperceptibly. Anything you study has the potential to make you a better, more well rounded, knowledgeable and less ignorant person.

Re: How we hacked Blackboard and changed our grades (2018)

#18
post #8

Changing your grades may look like a thrill now but in the long run you're only screwing yourselves.

I don't follow could you explain?

What's the point of going to school then if not to expose you to things and make you a better, more knowledgeable, well rounded person? If only grades matter then you can buy a fake diploma and you're done with it.

You may be aware that you don't need to go to college in order to be a software developer/hacker. But if you decide to do that then what's the point in faking the grades?

Re: How we hacked Blackboard and changed our grades (2018)

#19
post #8

Changing your grades may look like a thrill now but in the long run you're only screwing yourselves.

I don't follow could you explain?

The theory of higher education and a liberal arts degree, is what I'm assuming OP is talking about.

The idea of a liberal arts degree at a university is to create a well-rounded individual. The idea of taking classes outside your major is to learn about life. The idea of even going to college (which is ENTIRELY optional) is to learn. Not just to pass classes and get an A.

This is something that, traditionally, CS and Engineering students like to shit on - as an example, see the other post about Sociology being useless.

The thing is, there are boot camps and trade schools to learn job skills. People are now attending University and complaining about the 'gen ed' courses in their degree because they're not "useful for my future". This is meant to be "not job skills directly connected to what I think I want to grow up to be".

They aren't supposed to get you a job. They're not job skills programs. They're liberal arts programs. They're supposed to make you into a fully realized human. Those other general courses exist because many students enter college not knowing what their passions are, right or wrong.

Source: My career in higher education. One thing has been constant in the decades that I've worked in this field - Engineering and CS students complain about and shit on the 'gen. ed' classes more than any other major. They also don't like hearing that they can just go to trade school or a boot camp if they just want job skills training; which makes no sense to me - trade school is cheaper, and boot camps are shorter in duration.

Re: How we hacked Blackboard and changed our grades (2018)

#20
post #11

Earlier quoted context omitted.

Yeah earning that A in Sociology 101 really changed my life's trajectory.

If you earned that grade honestly a few ideas may stay with you for your entire life and that may change your life, even if imperceptibly. Anything you study has the potential to make you a better, more well rounded, knowledgeable and less ignorant person.

> Anything you study has the potential to make you a better, more well rounded, knowledgeable and less ignorant person.

This is a pretty meaningless sentiment. There are plenty of things one can study that will lead to more ignorance and less well-roundedness. In the extreme, this is pretty much how cults can operate. I believe it also applies to a number of subjects in mainstream universities, but I am not going to hop into that fire pit.

Post reply on HN