Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we hacked Blackboard and changed our grades (2018)

bustbyte.no

Post reply on HN
Print view View original

71–80 of 94 posts

Re: How we hacked Blackboard and changed our grades (2018)

#71

Post by codr7 »

I once wrote a memory resident keylogger back in high-school to catch the lonely sysadmin's network login. Not that I knew what to do with the login, I just wanted to prove to myself that I could.

I got plenty of logins, but not the one I wanted. Until a friend looked over the sysadmin's shoulder. I lost interest right there, but my friend went on to wreck the entire network by mistake and barely escaped paying for the whole mess.

Have to give some credit to the sysadmin for the catch. To figure out who was messing with his stuff, he put a program that emitted a high frequency tone through the PC-speaker in his login script and sat down next door to wait for my friend to take the bait.

Re: How we hacked Blackboard and changed our grades (2018)

#72

Post by TrackerFF »

mnky9800n wrote: post #4
antsar wrote: post #3

Earlier quoted context omitted.

Worse, > 02/27: Attended conference call with Blackboard and NTNU to explain exploit > Blackboard stopped responding to our e-mails 02/28.

If they were American they would probably be in prison now.

We had another case in Bergen (Norway) where some 13 year old kid wrote a script to search files on school HD for things like usernames, etc.

To his big surprise, he found his own. On a spreadsheet, with usernames and passwords of 35000 others, in clear text

Turns out students had credentials to such places.

He tipped the school, who in turn called the cops on him. Cops went to his home and confiscated his computer.

Re: How we hacked Blackboard and changed our grades (2018)

#73

Post by protomyth »

AnIdiotOnTheNet wrote: post #57
Ididntdothis wrote: post #51

Earlier quoted context omitted.

The first response should be to be horrified about their own system and fix it quickly. Such a simple hack shouldn’t be possible.

For the most part people in IT departments aren't stupid, they know precisely how crap the software they're stuck using is, they just don't have any real input on the decision process. Blackboard, for instance, is notoriously awful but is everywhere in schools. This often applies to policies as well, unfortunately.

True, but it is nice to have some customer (student) verification of how crappy it is. It helps with future negotiations. Plus, wanting students to trust the IT department is not their enemy is the basis of a good security experience when we notice something about a student's laptop or other device.

Re: How we hacked Blackboard and changed our grades (2018)

#74

Post by perryprog »

maaaats wrote: post #12
tomatohs wrote: post #9

When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked. 30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age. I reported this to our IT department and they were not pleased. They let me know they had the power to expel me bu…

We used It's Learning in "high school". It had login without https at the time, and on the school wifi it was then easy to listen and get other's credentials. Some people got hold of some teachers' credentials, and tried to remove or alter some minuscule data. One guy however, decided to sell grade-editing as a service to others. Of course it was noticed by the school, and it became a big deal with police involved an…

Must've been fixed. My school used It's Learning for a while until this year, and it was fairly secure. HSTS of course.

Re: How we hacked Blackboard and changed our grades (2018)

#75

Post by emilfihlman »

danesparza wrote: post #35
XIVMagnus wrote: post #10

Earlier quoted context omitted.

I have and forever will find it extremely stupid to threaten someone with expelling them for trying to HELP you do your job.

School (the institution) is not about learning. School (the institution) is about conformity. And finding exploits is anything BUT conformity.

Perhaps in some places, but not everywhere.

Re: How we hacked Blackboard and changed our grades (2018)

#76

Post by food_eater »

maaaats wrote: post #12
tomatohs wrote: post #9

When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked. 30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age. I reported this to our IT department and they were not pleased. They let me know they had the power to expel me bu…

We used It's Learning in "high school". It had login without https at the time, and on the school wifi it was then easy to listen and get other's credentials. Some people got hold of some teachers' credentials, and tried to remove or alter some minuscule data. One guy however, decided to sell grade-editing as a service to others. Of course it was noticed by the school, and it became a big deal with police involved an…

Did this happen to go down in Florida?

Re: How we hacked Blackboard and changed our grades (2018)

#77

Post by michannne »

tombert wrote: post #56
mdorazio wrote: post #52

Earlier quoted context omitted.

Yup. Another example of this is when I was in college and other students would go on ratemyprofessor or look up grade distributions for different professors and class options to pick the easiest ones. The thought of, you know, actually learning something even if it was hard wasn’t even a consideration - they just wanted the GPA. This continues in the working world as well, unfortunately. Many employees will optimize…

The "choosing the easy professor path" always bothered me too; I always felt that it was stupid to go to college just to get the receipt, so I purposefully didn't do the ratemyprofessor thing, though now I almost wish I had, since I ended up on academic probation and eventually dropping out...though that might have less to do with my class selection and more to do with me spending most of my time playing Minecraft, u…

It all depends on your goal of going to college. Do you have ad-hoc self-taught and real world experience doing your major? Then you may just want a paper to show your employer. No clue about anything in your field and want to learn? Then having intense classes should be your end goal. Everyone has different reasons for attending college, at the end of the day a lot of students forget that they're only there for themselves and no one outside of their classroom will care much about what they did in it.

Re: How we hacked Blackboard and changed our grades (2018)

#78

Post by filoleg »

_nickwhite wrote: post #15

When I was in college around Y2K, I took a "Foundations of Music" class offered online- an elective that taught, well, foundations of music, specifically how to read music. Students had to install this janky, low-quality, Windows Visual Basic application and do 100% of the coursework using it. This VB app would output a results file, and then we had to upload it to the professor. Well, I edited the file, and found th…

Had a similar thing at my college. If you are trying to take a language class, you need to take an online test to examine your current level of knowledge of the language, so that they can put you in an appropriate class level (i.e., basically allowing you to test out of beginner level classes, if you have enough knowledge to take the more advanced ones). I found out that all the correct answers were basically encoded into the front-end HTML, so it looked something like "return question1.result === "XYZ". While the value of cheating on such a test is extremely dubious (you do not get any credit on your transcript for the beginner classes if you tested out of them), I thought it was interesting nonetheless.

Re: How we hacked Blackboard and changed our grades (2018)

#79

Post by food_eater »

TrackerFF wrote: post #72
mnky9800n wrote: post #4

Earlier quoted context omitted.

If they were American they would probably be in prison now.

We had another case in Bergen (Norway) where some 13 year old kid wrote a script to search files on school HD for things like usernames, etc. To his big surprise, he found his own. On a spreadsheet, with usernames and passwords of 35000 others, in clear text Turns out students had credentials to such places. He tipped the school, who in turn called the cops on him. Cops went to his home and confiscated his computer.

Well I'd say that student got a lesson that years of schooling could never provide!

Re: How we hacked Blackboard and changed our grades (2018)

#80

Post by michaelmcmillan »

hombre_fatal wrote: post #39
danesparza wrote: post #36

Earlier quoted context omitted.

I don't understand this comment. Blackboard has headquarters in Washington D.C.

Those who hacked it (TFA) were not.

Author here. Actually, we were in California when all of this went down. Total coincidence.
Post reply on HN