Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we hacked Blackboard and changed our grades (2018)

bustbyte.no

Post reply on HN
Print view View original

51–60 of 94 posts

Re: How we hacked Blackboard and changed our grades (2018)

#51

Post by Ididntdothis »

AnIdiotOnTheNet wrote: post #48
Ididntdothis wrote: post #44

Earlier quoted context omitted.

“I reported this to our IT department and they were not pleased. They let me know they had the power to expel me but wouldn't.” This response is grounds for immediate dismissal of the IT person in my view.

By parent's own admission they actually did break into their professor's account. The fact that they reported it did not exonerate them from that act, but did at least get them off with a warning.

The first response should be to be horrified about their own system and fix it quickly. Such a simple hack shouldn’t be possible.

Re: How we hacked Blackboard and changed our grades (2018)

#52

Post by mdorazio »

Smithalicious wrote: post #28
_nickwhite wrote: post #15

When I was in college around Y2K, I took a "Foundations of Music" class offered online- an elective that taught, well, foundations of music, specifically how to read music. Students had to install this janky, low-quality, Windows Visual Basic application and do 100% of the coursework using it. This VB app would output a results file, and then we had to upload it to the professor. Well, I edited the file, and found th…

A moral of the story is that people will optimize for what's being measured, not what is intended. Machine learning does this even more so, with hilarious results.

Yup. Another example of this is when I was in college and other students would go on ratemyprofessor or look up grade distributions for different professors and class options to pick the easiest ones. The thought of, you know, actually learning something even if it was hard wasn’t even a consideration - they just wanted the GPA.

This continues in the working world as well, unfortunately. Many employees will optimize behaviors and attention to what’s most likely to get them a bonus or promotion regardless of how damaging it is to other people, users, or the company long term.

Re: How we hacked Blackboard and changed our grades (2018)

#53

Post by stale2002 »

onemoresoop wrote: post #18
danaur wrote: post #8

Earlier quoted context omitted.

I don't follow could you explain?

What's the point of going to school then if not to expose you to things and make you a better, more knowledgeable, well rounded person? If only grades matter then you can buy a fake diploma and you're done with it. You may be aware that you don't need to go to college in order to be a software developer/hacker. But if you decide to do that then what's the point in faking the grades?

Unfortunately, there truly isn't a point to many of the things we do in education, especially at the college level.

I went to college because I wanted to get a job as a high paid software engineer.

And although many of the class that I took, did indeed help me with this goal, many of them that I had to take did not.

It would have been awesome if I could have replaced some of my required classes that weren't particularly useful, with more focused ones on web development, and industry related.

Re: How we hacked Blackboard and changed our grades (2018)

#54

Post by jschwartzi »

keanebean86 wrote: post #22
tomatohs wrote: post #9

When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked. 30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age. I reported this to our IT department and they were not pleased. They let me know they had the power to expel me bu…

You're way cooler than me. I just injected rainbow css banners into my BB posts. I was too scared to try anything else.

I like this so much better because it beautifully demonstrates the problem without cluing anyone else in that there is an exploit unless they care to look at how you're injecting the rainbow CSS banner. And if anyone tells you to stop doing it you can just explain that you thought it was an intentional feature that just wasn't very well documented.

Re: How we hacked Blackboard and changed our grades (2018)

#55

Post by dmix »

bredren wrote: post #33

When I was in high school, the “good” PCs were locked with a boot password. Only upper level cs students could use them. It was somewhat annoying to have to get our teacher to enter the password each time it froze etc. Partially because higher level classes were all individual study and often math classes were in progress in the same room. So it could take a while to get the teacher’s attention. So one time some clas…

The best security bypasses tends to be the simplest ones!

Re: How we hacked Blackboard and changed our grades (2018)

#56

Post by tombert »

mdorazio wrote: post #52
Smithalicious wrote: post #28

Earlier quoted context omitted.

A moral of the story is that people will optimize for what's being measured, not what is intended. Machine learning does this even more so, with hilarious results.

Yup. Another example of this is when I was in college and other students would go on ratemyprofessor or look up grade distributions for different professors and class options to pick the easiest ones. The thought of, you know, actually learning something even if it was hard wasn’t even a consideration - they just wanted the GPA. This continues in the working world as well, unfortunately. Many employees will optimize…

The "choosing the easy professor path" always bothered me too; I always felt that it was stupid to go to college just to get the receipt, so I purposefully didn't do the ratemyprofessor thing, though now I almost wish I had, since I ended up on academic probation and eventually dropping out...though that might have less to do with my class selection and more to do with me spending most of my time playing Minecraft, upon reflection.

I think good companies (which are incredibly rare) will figure out how to make the behaviors that get people bonuses and/or promoted coincide with the ones that are good for the company long-term. Sadly, it doesn't seem to happen that way too frequently.

Re: How we hacked Blackboard and changed our grades (2018)

#57

Post by AnIdiotOnTheNet »

Ididntdothis wrote: post #51
AnIdiotOnTheNet wrote: post #48

Earlier quoted context omitted.

By parent's own admission they actually did break into their professor's account. The fact that they reported it did not exonerate them from that act, but did at least get them off with a warning.

The first response should be to be horrified about their own system and fix it quickly. Such a simple hack shouldn’t be possible.

For the most part people in IT departments aren't stupid, they know precisely how crap the software they're stuck using is, they just don't have any real input on the decision process. Blackboard, for instance, is notoriously awful but is everywhere in schools. This often applies to policies as well, unfortunately.

Re: How we hacked Blackboard and changed our grades (2018)

#58

Post by really3452 »

tombert wrote: post #56
mdorazio wrote: post #52

Earlier quoted context omitted.

Yup. Another example of this is when I was in college and other students would go on ratemyprofessor or look up grade distributions for different professors and class options to pick the easiest ones. The thought of, you know, actually learning something even if it was hard wasn’t even a consideration - they just wanted the GPA. This continues in the working world as well, unfortunately. Many employees will optimize…

The "choosing the easy professor path" always bothered me too; I always felt that it was stupid to go to college just to get the receipt, so I purposefully didn't do the ratemyprofessor thing, though now I almost wish I had, since I ended up on academic probation and eventually dropping out...though that might have less to do with my class selection and more to do with me spending most of my time playing Minecraft, u…

I would use rate my professor to make sure that I didn't end up with an over-the-top difficult general class that I didn't really care about but needed to fulfill a requirement (Art history, public speaking, etc). That way I could optimize my study time to focus on in-major classes.

Re: How we hacked Blackboard and changed our grades (2018)

#59

Post by kirykl »

Years ago I had an internship, in the lab there was a couple airgapped PCs with some confidential stuff on them, at least above my pay grade of $0. I was bored and tried logging with admin/admin and it worked, basically giving me root level access. I reported it, IT security interviewed me and I wasn't allowed near the PCs for the remainder of my internship.

Re: How we hacked Blackboard and changed our grades (2018)

#60

Post by the_watcher »

My freshman year of high school, some seniors got in trouble for changing their grades (I'm almost positive we used Blackboard). Ironically, the kids who did this were all excellent students and the modifications were things like "A- is now an A". The teachers talked about the kids being hackers and that recording grades in software wasn't safe because it meant hackers could always get an A.

Turned out, there was an admin account (u/p: admin/admin or something equally trivial to guess) with superuser access that someone learned.

Post reply on HN