#Drake Like Testing Progr
4 messages in this thread
James…
A little butting in here (and if you knew me, you'd come to expect it!!), but I
couldn't help "overhear" your comments about a hacker having better advantages
than the normal "Joe". However true this may be, keep in mind that these tests
are monitored by the proctor as well as timed. When the student begins the
test, the "system" is watching them, and they only have a given amount of time
to "get busy".
For the AutoCAD exams, the student is truly in a Windows environment, but it is
not the traditional Windows environ that we're used to seeing. Sure, you can
minimize and change window sizes, and most all those other cool Windows
features. What you can't do is shell to DOS, fire-up FileManager….you see,
the test is being run in a highly customized Windows application (I couldn't
even get Solitair to fire up!!!).
If someone can hack that, hire 'im!!!
Hit Return…Bill Elliott
Bill,
If the test is proctored, then security is probably not too much of an issue.
This is probably the best policy.
However, please allow me to play the hacker's advocate. Keep in mind that
hackers generally posess greater-than-average intelligence. This means they
are not usually affected by the obvious stumbling blocks.
I'm not a practiced hacker, but I am a practiced logic solver. If I wanted to
hack the system, here is what I would do:
1) Gain access the machines holding the test program and do a dummy run.
Reboot to A: and look for files written in last 15 minutes.
2) Find somebody who will be taking the test before me (previous hour, or
separate section of class). Preferably this person is one who is gauranteed to
ace the test. Instruct them on how to grab the file(s) identified in step 1 by
rebooting from A:.
3) One the file is in hand, and If the file is not too encrypted, I could
change any relavant information such as the username on the file.
Steps 1-3 happen, BEFORE, I go to take my exam.
4) During the exam, check the interface and make sure the test has not
changed. Provided it has not, reboot the computer from A:.
5) Dump the 'hacked' file(s) into the appropriate directory. Hack complete.
As you can see. My approach was to avoid the interface altogether. With two
to three hours invested, the hacker could save weeks worth of studying!
Obviously, I have made many assumptions. But, I think you see my point.
— James —
Fortunately for us and unfortunately for you, I think we have you foiled so far
James! <g>
1. You can gain access to the machines if you like perhaps, BUT there are
NO files to be found! These are downloaded from the server just before the
exam begins after determining what exam you want. In future evolvements, we
will be having different "application tracks" such as mechanical, architectural
so that the person being tested will be able to ensure that when they are
facing drawing problems they will be in a closer match to what they are
accustomed to.
2. Again, no files to be found, they are all moved to the server for
processing, scoring, uploading, etc. Also, rebooting the machine would lock
you out of the net and require the proctor to get you back in. Also, NO
floppies allowed in the room. Sure you could smuggle them in, hide em, etc.
but the typical setup is, come in, go to the machine you are assigned, begin
the exam, tell the system you are through to stop the clock, get your results,
leave. Also, while I guess you could find someone to take the exam "before"
you, there is not typically so much demand as to require more than one sitting
per day or less. Remember, the exams are available almost whenever you want to
take them within the schedule that the site sets. We will increase this
frequency as demand dictates.
3. Not applicable. No file exists. Oh, yeah, BTW, the files are encrypted
and compressed for transmission via sattelite to the Drake mainframe.
4. Similar to #2 above.
5. Nothing to dump.
Any questions? <g>
Now don't get me wrong, I am not so naive as to be suggesting that there is no
way that this system can be "hacked" by someone, somehow, with enough ingenuity
and guile, but we think we have made the liklihood VERY remote. Keep "testing"
us though (sorry couldn't resist) to keep us on our toes. Course if you are
successful, just let us know and I guess we will just have to hire you to fix
the system for us!
ww
5.
Your hacking points are well taken (and thoroughly considered), but
BING….wrong answer!!!!
You see, the test is driven by Drake's version of Windows and all the
files are stored on the server (undoubtedly – access protected). The
only real advantage you could possibly acquire, would be to use the
drawings that the previous "attendee" used for their test, but
Bing….worng answer!!! The drawing files are automatically deleted
after the test is completed.
Even though you're using a test station, all of the information files,
menus, answer files, blah, blah, blah….are kept on the server. Now
there's your target (and I'm not talking about the famous store!!).
If you can get to the server, and access the database for
the…Bing….wrong answer!!!
You see Drake Training and Technologies is a well estaablished company
that provides testing certification administration for such fields as
Novell Certification, FAA Pilots, and the likes. I don't want to
know if my friendly airline pilot has hacked his way through the
certification process to get to the first seat on the plane.
But again, Drake's jopb in all of this is to "certify" that he
hasn't, nor will MOST other folks. I don't work FOR Drake, simply
WITH them, and they have a reall solid solution to these scenarios
that you've presented.
Besides, the test is randomized each time anyway, so the anwer to
question 27 WAS "B", but the next time, that same question may show
up at position number 12….hoooo nose!!!! Keep hackin'
though…it's good for the nerves!!!