5 ms·
Most of these proctoring software easily detect Virtualbox, VMware, etc. But QEMU/KVM which is the de-facto hypervisor on Linux is harder to detect. Even the o
by IceWreck 5y ago
Most of these proctoring software easily detect Virtualbox, VMware, etc.
But QEMU/KVM which is the de-facto hypervisor on Linux is harder to detect. Even the others which I mentioned before can be hardened to evade detection.
And if you do a little bit of tinkering and intercept traffic, you can make it so that all the cheating reports from the "AI" never leaves you computer. I've never played with ProctorU but have experimented with a couple of other similar software. They usually send regular reports every five minutes and some anomaly reports (some extra software running on your computer, another person in room, face not visible, etc) when something happens. You need to intercept and modify traffic to not send these anomaly reports. This is easier if its browser based, but you need to install systemwide certs if its install-able software, and a lot more work if they utilize certificate pinning inside binary install-able software. I have never encountered the last one though.
- PenguinCoder 5y agoWhen I had to deal with Proctor-U, the software refused to run under a KVM VM. Detection of anything remotely VM hardware related, made it alert and the proctor refuse to continue. That's after fighting with the software to have it installed in the VM to begin with.
- 10000truths 5y agoMost virtual machine detection boils down to checking the CPUID hypervisor bit and vendor string. Luckily, it is possible to configure VMWare, VirtualBox and QEMU to spoof those values in the guest machine.
- eulers_secret 5y agoThis sent me down the rabbit hole on defeating this... I cannot stand this sort of authoritarian horsesh... Defeating malware's VM detection is very interesting. Links for others if they're interested: https://github.com/a0rtega/pafish https://github.com/a0rtega/pafish collects all the best-known detection methods into a test suite. This issue is interesting/has links for sure: https://github.com/spender-sandbox/cuckoo-modified/issues/459 https://github.com/spender-sandbox/cuckoo-modified/issues/45...
- lights0123 5y agoOne big problem with QEMU is that its virtual hard drives has the word "QEMU" hardcoded in their name, which proctoring software easily detects. When I checked there was a patch 1 year ago to make that configurable, but it was unmerged.
- blibble 5y agodoesn't windows 11 run under a VM by default?
- raxxorrax 5y agoReminds me that I still want to develop that camera driver that replays fake footage. Maybe I will build a small dongle with some storage for video. I heard that MS is requiring notebooks to have a HD front facing camera. Maybe they would still sign my device driver? If they don't, wouldn't that be a lawsuit waiting to happen?