Slashdot Mirror

← Back to Stories (view on slashdot.org)

Finland's Upper Secondary School Exams Going All-Linux

Posted by timothy on from the local-boy-makes-good dept.

First time accepted submitter jovius writes "The Matriculation Examination Board of Finland has just opened an international hacking contest to find flaws and exploits in Digabi Live — the Live Debian based operating system to be used in the all-digital final exams by the year 2016. The contest ends on 1st of September, and the winners are about to scoop hefty hardware prizes, also available as cash."

32 of 55 comments (clear)

  1. Burning Platform by Freshly+Exhumed · · Score: 5, Funny

    Oh come on, Finns! Didn't you get the memo that only Windows 8 will provide a future for all students? Clearly the comparatively high quality and level of education of Finnish students is burning, and they must jump. It cannot be sustained, so the existing system must be abandoned. It is time to adopt the Microsoft education curriculum. With this, Finland can successfully, drastically reduce the number of educators, divest huge amounts of school real estate, slash maintenance costs, and give the five remaining students a wonderful head start on their success.

    Yours truly, Stephen Elop.

    --
    I deny that I have not avoided attaining the opposite of that which I do not want.
    1. Re:Burning Platform by Luckyo · · Score: 2

      Nokia got the memo. Rest of us saw what happened to nokia after believing the memo and used our common sense.

    2. Re:Burning Platform by lord_rob+the+only+on · · Score: 1

      Are you working for Nokia ?

    3. Re: Burning Platform by lord_rob+the+only+on · · Score: 1

      Sigh...

  2. simple. effective. by Anonymous Coward · · Score: 1

    And this is how a tech-savy government should do things. Start with something open, encourage breaking it. Compare this to a 45 million euro fail of other administrations.

  3. Headline? by Bruce66423 · · Score: 2

    Surely the headline - which appears to refer to school exams - needs to be altered. Great story though...

    1. Re:Headline? by colordev · · Score: 1

      "Hacking Contest to Secure Finland's Computerized School Exams", might be more informative.

  4. Re:And the winner is... Debian by gl4ss · · Score: 1

    ..?

    they would still need to invent a way to get the distro to install it. if you can just install a .deb(signed by debian) you're eligible for prize, doesn't matter if the deb is that of nethack or netcat..

    --
    world was created 5 seconds before this post as it is.
  5. Hefty Prizes? by Anonymous Coward · · Score: 1, Insightful

    "At least three best competition entries, chosen by the jury, are awarded a smartphone or a tablet device valued at approximately 1.000 €. Possible prizes include Acer Iconia W700 11.6” 128 GB, Apple iPhone 5 64 GB, Apple iPad Retina 128 GB, Asus Vivo Tab RT TF600TG 64GB, Lenovo ThinkPad Tablet 2 10.1”, Samsung Google Nexus 10 32 GB or Sony Xperia Tablet Z 10.1”. Alternatively, the prize can also be given in currency. In addition to three best entries, the Matriculation Examination Board reserves the right to award additional entries using a set of criteria of its own choosing. Winners are announced on 3rd October 2013 on the website of the competition. Winners will also be informed by email."

    maybe if you live in a country where the average salary is under $10k.

    1. Re:Hefty Prizes? by jones_supa · · Score: 1

      In any case, the prizes should be spicy enough that it's a better deal to reveal the vulnerability in the contest rather than to keep it to yourself and then later exploit it in the exam.

    2. Re:Hefty Prizes? by Anonymous Coward · · Score: 1

      When considering "better" in that deal, you have to also consider all the risks included - if somebody else finds it before you, your winnings are zero, and if you try to sell it and your customer is actually a sting op by Finnish law enforcement, your winnings go deep into negative.

    3. Re:Hefty Prizes? by hoboroadie · · Score: 1

      You're comparing US median income with Finnish average income, and the units aren't precisely correlated.
      You must be a veteran here.

      --
      They feared that it could be used to suppress protest or support unpopular rule.
  6. Re: cash money by aliquis · · Score: 4, Informative

    No need for modern gimmicks such as eurosigns on Slashdot.

  7. Re:Doomed effort for multiple reasons by aliquis · · Score: 1

    Is it supposed to be running on the students own machines? Not school desktops or school laptops or laptops given away from the school?

  8. OMG Ponies! by Anonymous Coward · · Score: 4, Informative

    Seem to be two separate stories here...

    1 - Matriculation Examination Board of Finland is replacing pen/paper exams with exams in a live-cd (or usb-booted live environment or similar) examination system (and with associated back end systems, databases, aaa, etc)

    2 - Matriculation Examination Board of Finland is holding a hacking competition to find security flaws/vulnerabilities in the student live-cd OS.

  9. BYOD is doomed for tests by e**(i+pi)-1 · · Score: 1

    I believe, BYOD is doomed from the beginning, thats why graphing calculators (dinosaurs in comparison with modern smart phones) are still around: because of their limitations they can still be used for tests. Many questions for systems running on students hardware? How is the live system booted: DVD, memorystick? How does that work on a tablet? The biggest weakness is that the system is booted in a subsystem of an other OS. If the system interacts with a server, how do you prevent other internet access? How do you prevent other programs to be run? One major weakness for math testing systems accessed from a browser is that students can "google" or "alpha" the answer. Many system run the clock on the students system so that if the student runs a virtual machine and stops it, the clock stops. For testing systems with BYOD, there is always also the danger that the test leaks. Even with a completely locked down system, it is difficult to prevent that a student boots the OS in a virtual machine and have free range and post the test on the web. It needs only one student to do so. A test examinator can not see the difference (without considerable effort) whether the machine has booted up in a virtual machine or not. Ie only safe way to make a safe and accountable testing system is to make it on paper.

    1. Re:BYOD is doomed for tests by tommituura · · Score: 3, Informative

      Right now, all the details are up to evaluation whatever seems most feasible.

      Taken from project's website, the most likely way forward now is a USB-bootable live Linux distro on a laptop that has been maximally gutted in its ability to access anything else but a predefined server and the USB stick it boots on. Like, not having hardware drivers for the hdd etc. There also won't be any other programs except those needed to do the test installed, and the exam participant's user account won't have privileges to install anything else either, of course. The systems are most likely going to be booted by the administrators before test begins, (and the laptops, if owned by the students, have to be turned in for checks -- although if it's done in the same spirit as checks for graphing calculators are, the actual checks are randomly done. No school has enough manpower to do a sweep checks for every machine). There most certainly won't be any virtualization software included with the programs the exam taker can run.

      The problem would at that point to prevent the student to boot into another OS in the middle of exam, accessing whatever, and then booting back test system again. Maybe they'll include constantly home-calling ping to some central server which will notify the local admins that "exam taker #34234 is up to something no good. Go look over his/her shoulder constantly for a while". Also, rebooting the whole computer would most likely be visible enough for the exam administrators (who are, or should be, on constant outlook for cheaters in any case).

      That being said... a entrepreneuring (and skilled) exam taker could, with some hardware hacking, overcome many of these blocks in order to bring unauthorized materials into the exam and maybe even succeed in going unnoticed. That's why I'd really think the school districts (or the state) should just scrap the BYOD idea and shell the cash for bunch of cheap (around €200 or so) laptops. Since they would be usable for many years only for this purpose with tailor-made OS, it won't have to be *that* powerful anyway.

    2. Re:BYOD is doomed for tests by Joe_Dragon · · Score: 1

      also what about drivers on the USB-bootable live Linux to cover the full range of BYOD hardware? or maybe they will need an USB wifi stick as well to make it easier and for less stuff to hack. But still what about a full screen VM that looks like it has it's own BIOS or some kind of EFI / UEFI looking GUI? and after you boot it you take the VM out of full screen mode.

    3. Re:BYOD is doomed for tests by Apotekaren · · Score: 1

      In this case, some of these problems are non-issues. The exam is a national exam, taken simultaneously all over the country. So a "leaked exam" doesn't really matter once the exam has started since everyone that's supposed to be taking it, is sitting there taking it. The test timing is done on clock. The real one on the wall. Time from 9am to 3pm. Doesn't help if you can pause the program...

      As for the internet part, they just need to have bootable USB-sticks, with the exams on them, tagged with the name and ID of the exam taker. The students boot the exam under supervision, and start. The answers are then saved locally onto the stick, and collected at the end of the day. Alternatively, a central exam server is put up locally(with no internet access), the computers connect to that for login/exam saving.

      Also, these exams are overseen be at least 2 people at all times, and they're were sensitive to people breaking rules. Carrying a mobile phone is enough to get your exam failed, sometimes even all the exams of that spring/fall nulled. So any activity that's off from the normal test-taking would raise suspicion.

      --
      She: Hey, are you a traitor? Me: No, I'm atheist.
    4. Re:BYOD is doomed for tests by jones_supa · · Score: 1

      That's why I'd really think the school districts (or the state) should just scrap the BYOD idea and shell the cash for bunch of cheap (around €200 or so) laptops.

      The whole BYOD thing might enable an überwizard to hide some completely discrete systems inside his laptop and communicate with them using special hot keys while the main OS is running normally. :) It's quite hard to engineer something like that, but a thing that should be given a thought.

  10. Re:And the winner is... Debian by gl4ss · · Score: 1

    well if you start nitpicking like that then any system, openbsd and whatever, is suspect to attack by it's creators if it's creators can get users to install the attack. like, no shit.

    still, that would be a modification of the base system. that's outside the competitions scope, for obvious reasons.

    --
    world was created 5 seconds before this post as it is.
  11. Re:Doomed effort for multiple reasons by LilWolf · · Score: 2

    Depends on the municipality. Some give students laptops from the school, some support students buying their own devices with x euros, some do nothing to help students secure a device.

    It's important to note that they've made guidelines on what sort of devices are supported for the exam and the way it's done. It completely rules out any of the current tablets and pretty much narrows it down to a traditional laptops running x86(or amd64) processors. They've also got pretty good rules for setting up the exam environment.

    That being said, I think there will be plenty of problems to sort through.

  12. Re:Doomed effort for multiple reasons by AliasMarlowe · · Score: 2

    Is it supposed to be running on the students own machines? Not school desktops or school laptops or laptops given away from the school?

    The workstation specifications are given here. Booting from external media (DVD, USB) is a requirement, so although it's not stated, I'd expect that running Digabi inside a VM would not count.

    --
    Those who can make you believe absurdities can make you commit atrocities. - Voltaire
  13. Re:And the winner is... Debian by Anonymous Coward · · Score: 1

    A rouge package? Does it apply makeup to the faces in your digital photos?

  14. #3 driver updates by Joe_Dragon · · Score: 1

    You can just think the 2013 build will load and run fully on systems that come out 2-3-4-5 years from now.

  15. Elop vs Linus by unixisc · · Score: 1

    That would be a WWF battle worth a Helsinki or Oalu crowd! I guess the Finns could strike a compromise by rigging Linux to run on the Lumias. ;->

  16. Re:And the winner is... Debian by Anonymous Coward · · Score: 1

    Ladies pinch, whores use rouge.

  17. Re:Maybe the Netherlands will counter by unixisc · · Score: 1

    And the Russians w/ ReactOS, Canadians w/ QNX, USians w/ Windows or OS-X, Germans w/ L4...

  18. Re:cash money by Zero__Kelvin · · Score: 1

    Not on this one, or did you mean it is available in Windows with that sequence?

    --
    Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  19. Re:cash money by gomiam · · Score: 2

    You can use the € HTML entity. It's a bit longer to type but it should work to get a nice €

  20. It's been fun, MS, but... by bjoswald · · Score: 1

    Another one moves to free software.

  21. More Linux = more Linux apps. by edibobb · · Score: 1

    Good! I would love to change to Linux when the apps I need are there. More Linux developers is a step in the right direction.