Slashdot Mirror
Experience with 'Secure' Exam Testing Software?
Durindana writes "My law school has decided using the Exam4 software from Extegrity, thinking it would be a good idea. I disagree; the software can only be used by students on their own laptops, and (of course) Exam4 is mono-platform. Anyone have experience using this software (e.g. security level, reliability) or, hopefully, successfully opposing its use? It strikes me as a hell of a disadvantage to students who'd like an alternative to hand-writing but - for some strange reason - don't own a Windows laptop."
To re-phrase this question: "What are the security vulnerabilities of my exam software, and how can I exploit them to do well on my test?"
---Psilosopher
Their policy is:
So, if their software is buggy or something...that's it, too bad, game over, you're screwed. If it's all the same, I'd rather use a pencil and piece of paper. I've never heard of a blue screen of death on a #2 pencil.
Check your school's policies on what happens when the software screws up. This may just be the standard form the company sends to every college to give to their students, or it may different for your school.
Unless I'm missing something, this is hillarious. The way I read it, his law school is forcing everyone to get a Windows laptop to be able to run some exam software. The implications of this are fun to think about. For one, by forcing everyone on a single platform, the law school seems to be going against the Microsoft antitrust rulling. Secondly, doesn't using "exam software" on people's personal computers seem a little insecure? How long until someone brute forces all the multiple choice questions?
You're right, I wouldn't steal a car. But if it were possible, I sure as hell would download one!
How long until the masses discover "net send"??
On the "disadvantage" side of things, exam4 looks particularly bad. Other pages allow students access to some of their notes (thus, making it advantageous to have a laptop) but no find/search functionality (or some other kind of feature-disabled option). Thus, you can get at the notes in digital form, all of them, but have to put up with a few restrictions. If all you get is a word processor (read: text editor, since it doesn't really do any extra word-processing things), there's not much advantage for the students. Of course, the professors will have the advantage of not having to read handwritten tests, etc.
Most law schools that use software like this also seem to consider it OPTIONAL. If your school is basically forcing you to buy/use a Windows-based laptop, they'd better be a top-tier school worth the extra $1500+...
Do you really need reason for beer? Wingman Brewers
'nuf said....
Tubgirl warning.
and you forgot the most important part:
????
for invoking "UltraSecure Mode" and a "Secret Number"
for unlocking the encrypted exam answers; and our nifty
"ExamOpener" utility software that "semi-automatically"
retrieves exams from the floppy disks...
And cheaters get "Double Secret Probabtion"
then a nifty fine of "One Trillion Dollars"
and jail time in an "UltraSecure" cell
guarded by "Sharks With Laser Beams"
Just like in UltraSecure Mode, access to all other material on the computer is blocked.
Run the exam software in Virtual PC. Anyone? This is like print-screen crack for MS Reader...
-CowboyNick
I've also encountered Extegrity's product, which is required at my law school. It does have at least rudimentary protection against the most obvious workarounds - when I tried to run it within VMWare, it "failed security check" and refused to operate. I'm not sure how exactly it checks to see if it's running in a virtualized environment - one project I have on my back-burner is to see how well it deals with bochs.
.doc files. OpenOffice hasn't failed me yet, though, and of course Word for the Mac exists and is frequently available at a steep discount to students.
I'm also the proud owner of a PowerBook. My solution was to trade some other computer gear for a big old PC laptop with a mostly-dead battery that meets the system requirements. I plan to use that laptop only for taking exams. Aside from exams, my school is fairly platform-agnostic: papers are turned in on paper, and the only electronic interaction with professors is via email. The one kink that I have run into is profs and fellow students who insist on sharing their academic insight via Word
As someone who also develops examination software, and who is doing academic research into computer security, I have to say that this is a ridiculous idea. Aside from requiring people to have specific hardware and purchase specific (pricey, but I guess they're law students...) software, the security issues here are horrendous.
The *only* ways to do this kind of thing is either have the software running on trusted hardware like a previously set up computer lab, or run the software on a trusted server and give the *untrusted* clients only a thin-client (citrix/ts/vnc/web browser). AND you have to have someone supervising them to make sure they've smuggled no notes in and aren't cut'n'pasting from another app.
Surely a law school, of all places, would have someone who knows a bit about information security on staff?
This software looks like exactly the kind of product developed by someone with no security training outside Microsofts VB tutorials.
Exactly the kind of software not to use for anything important - and Exams at Law School are important - there is a huge amount of money and future careers involved.
- Muggins the Mad
No matter how great the software is, it will still be running on a platform which can have problems (no matter what OS). I'm surprised that nobody is manufacturing small wireless devices solely for taking such tests. Make them cheap enough that the school could afford to buy them for everyone and hand them out before each exam. Student logs in, registers answers. Wouldn't be difficult to transmit results as you go, so in the event of a hardware or network failure, no information would be lost. Grab another one, log in, continue.
How long until a PDA becomes cheap enough to do this? Install a customized open source OS which doesn't support anything but this app, you'd be set. Most of them already have the tools, UI, encryption, networking, etc. You could do this today with ~$100 PocketPCs. If someone could find a way to do this on old PalmPilots or Visors.....
By forcing you to use windows software, the law school is violating your civil rights! Openly discriminating against a group of computer users, just because they carry around laptops with a shiny Apple logo, is no different the discriminating against a group because they have dark colored skin wrapped around their bodies.
I'm surprised that nobody else has brought this up, but hear me out...
:)
If "interior" is the opposite of "exterior", then what is the opposite of "extegrity"?
When I was going to school, the Sys Admin had a special enviornment setup on the Solaris server, that had very minimal tools. We would use a thin client to get access (new accounts too) to the resources to do the exam. The exams were 4 hours and we did not have any previous time with the enviornment. Worked good, if you spent any time trying to find ways around the system, you just ate into the exam time.
Don't law schools often require or subsidise the purchase of a specific supported laptop, for precisely this kind of reason? If the students don't have windows laptops, or laptops at all, how can they be expected to take tests at all?
Oh, maybe you haven't studied enough yet to know that niggers are evil...
Remember that not all people with dark skin are niggers, and not all niggers have dark skin.
This exam software is a joke. I just used Windows Media Encoder to encode an entire movie of the practice test I just took. Gimme a F*** break there is no such thing as secure online exam software. I'm a developer for a Course Management system and I've seen a lot of these "secure" testing platforms. They can all be beaten in about 10 minutes at the most. The real story here is that this company is marketing this exam software as 100% "secure" to people who don't know better. What a joke.
Since their entire website is written by a marketriod (UltraSecure mode), to be read by paraniod school administrators, you can bet this software is all hype, no substance. It will be cracked 10 minutes after a school announces it will be used. They may have some success running it securily in a supervised computer lab, but if students are expected to install it on their home computers or in an open lab, good luck.
Running software on untrusted hardware can never really be secure. If the school wants to do this sort of thing, they need to provide the machines.
They could either buy a set of laptops specifically for exams, or they could buy some low-end machine whose primary function is word processing. Examples are the Dana AlphaSmart and the LaserPC. A simple cold boot will bring them back into a known configuration. Buying a few dozen of those may even be cheaper than a site license for the "Extegrity" software.