79

A friend of mine is taking a UNIX systems class and mentioned to me that when they take exams they do so on their computers. That is all students are using their own computer/laptop. Students are not being provided a computer by the professor. In an attempt to prevent cheating and googling of the answers, all student's are required to connect to a router that the professor has set up in order to take the exam. This router is not connected to the internet.

If anyone disconnects from the router during the exam time the professor then knows that they were potentially trying to use the internet. Apparently he has told his class that this system is "foolproof" and is so confident in its ability to prevent student network access he often leaves the room during the exam.

I admit that I'm not particularly well versed in this area of networking but theoretically couldn't this safeguard be defeated by using something resembling a man in the middle attack. You spoof a MAC address and IP and send that to the target router, which then thinks you are connected even though there is no real connection? Or is this problem network card based, where the vast majority of computers only have 1 wifi card and can therefore only do network related tasks for 1 network at a time.

  • 90
    I do hope this question has been asked purely for referential purposes, otherwise humanity is apparently doomed. If students these days can't fool an exam system with this level of security themselves, I don't dare imagine what they actually do learn:) – Pavel Apr 27 '17 at 7:06
  • 18
    Does he fail you for cheating if your battery dies? If he's not even in the room, I don't see how his system would even stand up to scrutiny if you came up with a plausible excuse. Heck, sometimes network connections just go down for no apparent reason. How could he prove that didn't happen? And what if his computer experiences a problem and loses all the connections? – jpmc26 Apr 27 '17 at 9:37
  • 11
    Unplug the router when he leaves. – DasBeasto Apr 27 '17 at 12:27
  • 18
    Technically, "foolproof" means only that a fool can't break the system, right? – Federico Poloni Apr 27 '17 at 13:42
  • 41
    If the professor leaves the room - why doesn't every student just pull out their smartphones? – Arminius Apr 27 '17 at 13:43
117

Well, obviously it's not "foolproof". Depending on your capabilities, there are plenty of ways to cheat.

Your professor has a point in that your standard wireless network card won't simply support a simultaneous connection to multiple different APs, thus preventing your from using that particular interface for an Internet connection. (Although with some tinkering you could possibly alternate between networks without letting the professor's AP take notice by tweaking your driver to omit the layer-2 management frames that are supposed to notify the AP of your intent to dis-/reassociate.)

However, there are also easy workarounds:

  • Build in a second network adapter (or plug in an external USB one, once the professor leaves) to connect to a network with Internet access. You can easily do this without interrupting your existing connection.
  • Connect with your phone or another device instead of your real computer. On that device you can configure the broadcasted MAC address to match the one of your computer. This could fool your professor but probably wouldn't withstand a forensic investigation of the traffic.
  • Use Bluetooth. Most laptops have built-in BT, so you could just tunnel your traffic via BT to a hidden device that itself is connected to the internet.

  • Get creative. There are plenty of ways to bridge an apparent air gap. You might use your sound card to transmit data in a small range (or even your hard drive for that matter) - but then again you could also spend that time studying for the exam.

One effective countermeasure might be capturing every student's screen during the exam, but personally I find that very intrusive. Ultimately, if the professor allows students to use their own computers there will always be some way to prepare the devices to cheat.

  • 12
    @JanDvorak Not at all. Use two different subnets and set the default route for the "hidden" internet access and you're ready. – rbialon Apr 27 '17 at 6:49
  • 75
    @JanDvorak: or give exclusive use of the second adapter to a VM, and use that for internet access - thus keeping your host machine connected only to the professor's machine, and in turn obeying the letter of the law, if not the spirit. – flith Apr 27 '17 at 6:52
  • 8
    @ti7: By just not having the router connected to the internet at all? – psmears Apr 27 '17 at 16:48
  • 7
    I think 2 interfaces on one machine are easy to detect. (doesn't affect filth's answer) I'd do the following as the professor: on the test website add a script which periodically tries to get a resource from a list of "normal public addresses". (for example CDNs) If any of them are requested properly, you're auto-reported for cheating. Now you not only have to have proper routing, but also bind your browser to a single interface only (doable with network namespacing in linux) – viraptor Apr 27 '17 at 23:05
  • 3
    another way is to perform a DoS attack on the router so that it will lose all connections/reboot/etc. – Sarge Borsch Apr 28 '17 at 7:38
54

You don't need to fake being connected to a router. The simplest way to ensure that you're detected as being connected to a router is to be genuinely connected to that router. That doesn't mean you're connected only to that router.

A $10 USB wifi adapter or a slightly more expensive 3G/4G adapter can connect a PC to the Internet, bypassing any other network connection that they might have. The PC would of course need to be configured carefully, make sure that it isn't forwarding packets between its connection to the Internet and its connection to the professor's router or the game would be up.

The only way for the professor to know that the students are cheating would be to retain full control over the computers, i.e. ensure that the students can't make changes to the network configuration and can't activate any hotplugged peripherals. And of course the professor should ensure that the students aren't discreetly using a mobile phone.

  • 4
    In college, worked in a computer lab where every time exam time came around, we had to re-image all the machines to have no internet or network access at all. Boy ever was that fun; something went wrong every time. – KRyan Apr 27 '17 at 18:19
  • 4
    @KRyan Couldn't you just delete the network drivers? That has the added bonus of hideous error messages whenever somebody tries to do anything (though those are usually printed to /dev/tty0 and not the GUI). – wizzwizz4 Apr 27 '17 at 19:04
  • 1
    @wizzwizz4 I don’t honestly know what was or wasn’t done—I should be clearer, I worked in the lab as the TA for the exam, rather than actually being in charge of the lab and the re-imaging. – KRyan Apr 27 '17 at 19:09
  • @KRyan Couldn't they set up VLANs so the test machine could only access the test server? Or if it's no network access at all... just unplug the room's switch? – immibis Apr 28 '17 at 1:48
  • 2
    @immibis No access to the school network, but linked together in a little private network of just the machines in that room, for turning the exam in. And I’m sure it could have been done better; the sys admin was an ancient, jovial little man who didn’t really seem to be 100% up on his game there. – KRyan Apr 28 '17 at 2:05
14

In addition to the existing answers: some laptops have built-in SIM card slots. My previous laptop had one which could only be accessed by removing the battery. You could connect the built-in wifi card to the wifi provided by the router, and use the mobile internet for your cheating. This has the advantages that there is no additional wifi network - which the professor could easily track down - and no dongle that the professor might find suspicious. On the downside, you need to have a laptop with that feature (or use a dongle which provides this feature, destroying one of the advantages).

  • 3
    In order to use a dongle without suspicion, you could use a bluetooth mouse, and claim the dongle is for that mouse. This does require the laptop has built-in bluetooth, but most do nowadays. – Mateon1 Apr 28 '17 at 18:09
  • 1
    no need, iw phy0 interface add cheat0 type station will create a virtual wireless interface called cheat0. using ip you can set it's MAC address and you're ready to rock.. – Hydranix Apr 28 '17 at 19:14
11

Caution, may contain humour.

Yes, it's enough

Alright, now I got your attention.

Basically, I use an ontological argument: the fact that he is a professor who should know this kind of stuff, and is so sure, tells me that the room you are taking the test in has absolutely no possibility of WLAN or Mobile access. I.e., an underground room with lots of steel and very thick walls around.

I also deduce that the professor has verified, using all kinds of different smartphones/WLAN routers and different SIM cards (different providers), that not a single corner of the room allows any meaningful connection.

In this case, yes, he can be sure, because...

Physical connection

He can be sure that your ethernet port is and stays physically connected to his router. His router will log physical plugging/unplugging of ports (the lowest layer of the network stack - link level). There is nothing in the world you can do against it without it being very obvious. In far fetched theory (James Bond style) you could theoretically somehow screw with the cable - separate individual strands while it is connected, and connect some kind of quite involved electronic gadget with alligator clips that keep the link layer up while you disconnect your laptop.

But

We have to take more assumptions: it would be trivial for you to connect a USB-Ethernet-Adapter to your laptop and run that into some Ethernet port on the walls or on your desk which gives you internet access. Since the professor is a) knowledgeable and b) very sure of himself, this logically means that there are no such Ethernet ports available in the room.

This, and now comes the crux, means that everything he did was in vain. I.e., there was no reason to actually connect you to the router in the first place - if there is no Ethernet port available, there is no reason for you to "plug up" your laptop's port.

This, sadly, brings the whole beautiful thought building crumbling down. The professor is obviously having no clue, and everything is pointless.

Conclusion and outlook

As we look for only the best in all people, it is obvious to me that the professor is not having no clue. The point of the exercise is to detect which of the students is first to hack his protection. Those will obviously get bonus points (in the form of knowledge gained through the Internet access).

So it all makes sense. The professor is a brilliant genius who teaches you to question authority, not to blindly follow technical leaders, and think out of the box. Congratulations!

  • Inventive, but I don't think so. – Wildcard Apr 29 '17 at 1:26
  • 7
    This made me want to curl into a ball and cry – Nic Hartley Apr 29 '17 at 3:51
  • 1
    If that were the case, then the professor would've told people that they get bonus points for successfully sending him and email during the exam (without him being alerted either visually or technologically) and then stayed within the room for the exam. To me, this seems like an overconfident person. – The Great Duck Apr 29 '17 at 20:18
  • I'd hoped that the huge amount of tongue-in-cheek in my answer would be enough to set the stage for the last paragraph. ;) – AnoE Apr 29 '17 at 20:36
  • Based on AnoEs reputation on the academia website. It's reasonable to assume they are a professor. I surely hope he/she is @Ryan professor. – spuder Apr 29 '17 at 23:02
9

Let's just make your professor's router act up a bit.

You can use an ESP8266 to launch a de-auth attack that disconnects everyone from the router, basically tricking the professor to think there's something wrong with his router. https://hackaday.io/project/9333-weekend-on-the-dark-side

Another option for the same attack but without dedicated hardware, launch the attack from your laptop: http://hackaday.com/2011/10/04/wifi-jamming-via-deauthentication-packets/

  • 2
    This doesn't actually answer the question, but I like this idea. – canhascodez May 1 '17 at 12:16
  • 1
    @sethrin: I'm pretty sure it does. If the professor doesn't know who's doing it his plan is defeated, and it would serve him right for this horrendous anti-cheat idea. Nobody should be requiring reliable wireless networks for anything. This is an abomination. – Joshua May 1 '17 at 15:55
  • 1
    @sethrin: It is a very common pattern in hacks. "But X wasn't protecting against Y". Sure, but everyone thought X was, so nobody actually bothered to provide additional protection against Y. Hacking often is the art of finding gaps between assumptions and reality; rarely a matter of brute force. – MSalters May 1 '17 at 19:15
  • Yea, it's more of a "Screw them all" sort of hack. – Pranav May 2 '17 at 19:20
3

A cellular modem? One can be installed inside the machine. Remembering an instructor who invited me to try to break into a server, I can't help wondering what this professor is really doing. Do you get a better mark if you defeat his system?

  • 3
    Lots of questions to answer if he has equipment to snoop on LTE... – trognanders Apr 29 '17 at 23:26
  • 1
    @BaileyS: For whom? There will be LTE chatter all the time, but you'd need to decrypt it to know what's being said. Is it just Facebook pushing notifications to smartphones, or a laptop in use? And given the high likelihood of at least some LTE traffic being entirely legit, it would mean the professor would be violating a handful of laws. – MSalters May 1 '17 at 19:18
  • @MSalters I meant he would have a lot of questions to answer to law enforcement . Even using the gear to monitor for cheating on an exam would be a crime. Just having it is probably a crime. – trognanders May 1 '17 at 19:36
1

Well, this is definitely enough. When younger, we passed our exams (in a high school) each in our own room, with all books and other documents being available. The rationale for that was that if you needed to read a lesson to make an exercise, you would not have enough time to complete it.

You can certainly cheat the poor protection set up by the professor. But:

  • it will certainly take some time, that will no longer be usable for completing the exam
  • if you need to search on Internet to complete an exercise, you will spend too much time to be able to complete the exam
  • there is a risk that you get caught while actually connected to internet. What do you think will happen after? You have willingly cheated on a exam, bypassing a security system. Chances are that you are simply excluded from the exam.

People have always tried to cheat for their exams, and those that always passed were the ones that simply learned enough to be able to answer without cheating. You may pass once by cheating, but if there are different tests for your examination, the risk of being caught is much too high IMHO.

That being said, it is indeed very easy to setup a second router with a USB cable to a smartphone...

0

The simplest solution would be to connect to your smart phone via blue tooth and connect to the internet that way. I'm ofc assuming your laptop has built in blue tooth, if it doesn't buy a blue tooth dongle.

Better yet, if he requires a physical ethernet connection to your laptop, just connect to your phone's wifi hotspot with your laptop's wifi card and skip blue tooth all together!

protected by Community May 1 '17 at 11:20

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.