6 ms·

College grad hacks ICSE, ISC results, shows up India’s cyber flaws

50 points by posharma 13y ago

thex86 13y ago
> One person had just acquired the exam results for the whole country. Not only was this a violation of any and all forms of privacy associated with something as personal as your examination marks, but a mass divulsion of all sorts of personal information - names, date of birth and school. There is no privacy to begin with, so this is a sensationalist argument at its best. In India, there is no notion of keeping your grades confidential from others. Your entire neighborhood knows how you fared in your exams, because the notion of privacy and to keep grades as a secret as is in the western countries is not there. What the author has done is nothing new, except that he got hold of them "technically". I checked my result for the same exam when I was in USA. Not only that, I got the result for the entire school through email, it is that easy. Case in point: http://schoolcoderesults.nic.in/cbse-2013/result.php http://schoolcoderesults.nic.in/cbse-2013/result.php So if you did give the exam, you have access to all the grades and they will send them to you through email, no questions asked at all. Let me repeat: you get all the grades for everyone in the school just through this one click. Should I call this a flaw in the system when the system presents this interface to me? Even if you did not give the exam, you can get the "School Code" and "Authorization Code", again from the CBSE (the Central Board of Secondary Education). So I can get the grades for anyone from any school in India. This is not a "cyberflaw". It is a flaw in our culture, if you can call it that.
- kamaal 13y ago
  Yes, How are exam results secret? Sorry but ever since exam results are being posted on the internet. You could practically Google your way to finding some one's result.
- harichinnan 13y ago
  Results get published in news paper in India. Anyone with your registration number could get all your marks. Its easy to go back one step and know who is the owner or the exam registration number. In our state(Kerala) they publish a ranking of top 15 rank holders in the state for 10'th and 12'th classes and the kids are treated as celebrities with newspaper and tv coverage.
- fakeer 13y ago
  CBSE[1] officially sends you results via email[2]. Of an entire school and there you get students' names, roll numbers and marks and pass/fail. The you get student's roll number and see the entire result card[3] which also has students' mother's names, father's names and DOB. All you have to know is two codes of a school: affiliation and school code which is public and schools put it on their websites[4] [1]https://www.google.com/search?q=CBSE https://www.google.com/search?q=CBSE [2]http://schoolcoderesults.nic.in/cbse-2013/result.php http://schoolcoderesults.nic.in/cbse-2013/result.php [3]http://cbseresults.nic.in/class10/cbse102013cvb.htm http://cbseresults.nic.in/class10/cbse102013cvb.htm [4]A tiny % of schools have their websites but that information is readily available.
- shubhamjain 13y ago
  Agreed. Someone just created a bot to fetch all records and plotted nice graphs. Creative but I don't see any reason how this is a security flaw.
nrbafna 13y ago
He writes about it himself here - http://deedy.quora.com/Hacking-into-the-Indian-Education-System http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys... Also, from his write up, it was serious lack of security on the results website. More importantly, the focus from his write up should be less on the getting the data of the results, rather on the data itself. He goes on plot the scores vs frequency for all the courses taken up students and discovers a good case of tampering with the scores.
- thex86 13y ago
  > Also, from his write up, it was serious lack of security on the results website. How? The website has an interface to give you all the results. All you need is an email address. How is this then a lack of security? This is 'by design'.
  - pyre 13y ago
    Just because that's the interface doesn't mean, "Allowing the entire world access," is by design. I understand where you're coming from with the cultural angle in your other post. On the other hand, sometimes people leave things in the open with the idea, "what's the worst that can happen," or, "only authorized people will know about this, I don't need security." This doesn't signify an intention to let the world see, or a lack care about whether or not the world sees.
    - thex86 13y ago
      As far as my memory goes - I think I can safely say this for the past six years, everyone I know is aware that you can get the results for practically anyone, as long as you know their name and their school. So I meant that that this is not anything revolutionary or new, let alone a security flaw. It's just how it is. And this is no violation of privacy as the author claims. When the grades are announced, they are put up in their full glory in the school. There is no privacy! That is what I meant. I know this is not a good thing, but I doubt this trend will change anytime soon.
captn3m0 13y ago
The code for this is available on github[1], in case anyone is interested. [1]: https://github.com/deedydas/CISCEResults2013 https://github.com/deedydas/CISCEResults2013
- ihuman 13y ago
  Strange. I'm getting 404 errors for that repo.
  - thex86 13y ago
    He says he made the repo private.
    - fakeer 13y ago
      Well, that means he is a paying github customer or mayeb the recent Gitub offer of pvt repos to students. Ps. Any mirrors?
glesica 13y ago
Why are all the comments focused on how he got access to the data? The real scandal isn't in that they didn't protect the results (apparently Indian culture doesn't have the same level of privacy in this area), but in the fact that the results appeared to have been manipulated in odd ways.
- thex86 13y ago
  I don't have the time to write a complete explanation about that, but if you point out a specific instance that interests you particularly, I can try to give an explanation.
- iamshs 13y ago
  The guy is playing the press, and enjoying the limelight on him by terming his data mining process as hacking in the opening paragraphs complete with juicy quotes, and this is why this article does not even mention the anomalies in the testing but rather concentrates on the cyber attacks. On his results: http://qph.is.quoracdn.net/main-qimg-7563466e4810af140bb712b95f238531 http://qph.is.quoracdn.net/main-qimg-7563466e4810af140bb712b... Now this data distribution looks suspect to tampering. I will not pass judgements though without knowing the format of the papers. Besides, we do not know if indeed he actually fetched data for all the students and did not miss anybody, since he is relying upon his manual boundaries while scraping data. How informed are those boundaries is not known. ICSE schools are not normal run of the mill schools, they are populated by rich kids who can afford extra help and are kind of smart. Their English curriculum is reputed to be strong, hence the strong distribution towards high end. I am also making assumptions, but I do not have full data to make informed inferences.
  - fakeer 13y ago
    Agree with rich kids and English part totally. Besides, it's a tradition to get high marks in an ICSE schools in India. So much that if you pass your 10 from an ICE school and go to a CBSE school for admission and have 94% marks then the kid who has 89-90% from a CBSE school or even lower from a state board school might be preferred. It was true in 2001-2003 and was till I kept track, not sure now. Their system has(had) a lot of marks in the hands of school authority rather than the board and those marks were(are) very generously handed out.
cubancigar11 13y ago
I have been doing this for past two years for my paper on social privilege and reservation. Thanks to this guy my job might just become harder.
- ISL 13y ago
  Quality work is quality work. Getting scooped doesn't diminish whatever you've accomplished.
octonion 13y ago
I've forked the GitHub and rewritten the scraper in Ruby. Full ICSE and ICS results are already there, plus a PostgreSQL loader and a script to determine the "true" all-India topper accounting for exam difficulty. I've also written a preliminary CBSE scraper. https://github.com/octonion/CISCEResults2013 https://github.com/octonion/CISCEResults2013
- iamshs 13y ago
  Can you put up the CBSE results please? Simple csv aggregate file will suffice. I will do some analysis on that too.
  - octonion 13y ago
    I'm scraping the CBSE now. It'll take about a day. I'll upload it and post here when it's done.
  - octonion 13y ago
    I have about 1 million of the CBSE student records there now. That's abut 8.8 million scores. https://github.com/octonion/CISCEResults2013/tree/master/cbse https://github.com/octonion/CISCEResults2013/tree/master/cbs...
Sven7 13y ago
Hilarious stuff :) "For example, 81, 82, 84, 85, 87, 89, 91 and 93 were visibly missing. I repeat, no one in India had achieved these marks in the ICSE." http://deedy.quora.com/Hacking-into-the-Indian-Education-System http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys...
- IvyMike 13y ago
  To me the missing values (and nearby spikes) seem like they could be aliasing due to a bad rounding/scaling algorithm.
  - iamshs 13y ago
    This is what i thought too, especially since it is visible among all the subjects.
    - harichinnan 13y ago
      A simple explanation would be extra scrutiny for the answer paper evaluators when marks go beyond 80. That might determine the difference between getting home/hotel at 5:00 P.M or sitting with the supervisor, painstakingly cross checking every answer. Picking answer paper evaluators are like picking people for jury duty in US. Its a lottery system for teachers across the board(In this case across India) and once you get selected, its mandatory to show up at the central evaluation center. The evaluations last something like 10-15 days.
nadahalli 13y ago
It's not quite bogus, but it's very close. http://pratyaya.nationalinterest.in/2013/06/05/the-bogus-claims-of-hacking-indian-education-system-and-marks-tampering/ http://pratyaya.nationalinterest.in/2013/06/05/the-bogus-cla...
siddhantpuri 13y ago
he didnt hack it he just scraped it. it wasnt something illegal. read his blog post.
- pilif 13y ago
  isn't what he has done exactly what the "AT&T Hacker" who's now put into jail for years has done back in 2010?
general_failure 13y ago
I think the hacking claims are just fine. Hacking doesn't just mean making use of some XSRF or XSS exploit. Hacking means to make software behave in a way it was not intended to behave. It means to spot mistakes in software in some ingenuous fashion. The author (http://deedy.quora.com/Hacking-into-the-Indian-Education-System http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys...) has done just that. He had to look into the source code, figure what format of the request was, figure the block ranges for the student and school codes and parse out the html results.
yuvipanda 13y ago
http://tnresults.nic.in/tncfplus/cfplus.htm http://tnresults.nic.in/tncfplus/cfplus.htm is the similar site for the Tamil Nadu (southern state)'s exam. From a cursory look seems to be at least a little bit more secure - requires DOB. Still, is made with Frontpage...
ja27 13y ago
Why is so significant that he is a "college grad"?

50 points by posharma 13y ago

> One person had just acquired the exam results for the whole country. Not only was this a violation of any and all forms of privacy associated with something as personal as your examination marks, but a mass divulsion of all sorts of personal information - names, date of birth and school. There is no privacy to begin with, so this is a sensationalist argument at its best. In India, there is no notion of keeping your grades confidential from others. Your entire neighborhood knows how you fared in your exams, because the notion of privacy and to keep grades as a secret as is in the western countries is not there. What the author has done is nothing new, except that he got hold of them "technically". I checked my result for the same exam when I was in USA. Not only that, I got the result for the entire school through email, it is that easy. Case in point: http://schoolcoderesults.nic.in/cbse-2013/result.php http://schoolcoderesults.nic.in/cbse-2013/result.php So if you did give the exam, you have access to all the grades and they will send them to you through email, no questions asked at all. Let me repeat: you get all the grades for everyone in the school just through this one click. Should I call this a flaw in the system when the system presents this interface to me? Even if you did not give the exam, you can get the "School Code" and "Authorization Code", again from the CBSE (the Central Board of Secondary Education). So I can get the grades for anyone from any school in India. This is not a "cyberflaw". It is a flaw in our culture, if you can call it that.

kamaal 13y ago
Yes, How are exam results secret? Sorry but ever since exam results are being posted on the internet. You could practically Google your way to finding some one's result.
harichinnan 13y ago
Results get published in news paper in India. Anyone with your registration number could get all your marks. Its easy to go back one step and know who is the owner or the exam registration number. In our state(Kerala) they publish a ranking of top 15 rank holders in the state for 10'th and 12'th classes and the kids are treated as celebrities with newspaper and tv coverage.
fakeer 13y ago
CBSE[1] officially sends you results via email[2]. Of an entire school and there you get students' names, roll numbers and marks and pass/fail. The you get student's roll number and see the entire result card[3] which also has students' mother's names, father's names and DOB. All you have to know is two codes of a school: affiliation and school code which is public and schools put it on their websites[4] [1]https://www.google.com/search?q=CBSE https://www.google.com/search?q=CBSE [2]http://schoolcoderesults.nic.in/cbse-2013/result.php http://schoolcoderesults.nic.in/cbse-2013/result.php [3]http://cbseresults.nic.in/class10/cbse102013cvb.htm http://cbseresults.nic.in/class10/cbse102013cvb.htm [4]A tiny % of schools have their websites but that information is readily available.
shubhamjain 13y ago
Agreed. Someone just created a bot to fetch all records and plotted nice graphs. Creative but I don't see any reason how this is a security flaw.

nrbafna 13y ago

He writes about it himself here - http://deedy.quora.com/Hacking-into-the-Indian-Education-System http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys... Also, from his write up, it was serious lack of security on the results website. More importantly, the focus from his write up should be less on the getting the data of the results, rather on the data itself. He goes on plot the scores vs frequency for all the courses taken up students and discovers a good case of tampering with the scores.

thex86 13y ago
> Also, from his write up, it was serious lack of security on the results website. How? The website has an interface to give you all the results. All you need is an email address. How is this then a lack of security? This is 'by design'.
- pyre 13y ago
  Just because that's the interface doesn't mean, "Allowing the entire world access," is by design. I understand where you're coming from with the cultural angle in your other post. On the other hand, sometimes people leave things in the open with the idea, "what's the worst that can happen," or, "only authorized people will know about this, I don't need security." This doesn't signify an intention to let the world see, or a lack care about whether or not the world sees.
  - thex86 13y ago
    As far as my memory goes - I think I can safely say this for the past six years, everyone I know is aware that you can get the results for practically anyone, as long as you know their name and their school. So I meant that that this is not anything revolutionary or new, let alone a security flaw. It's just how it is. And this is no violation of privacy as the author claims. When the grades are announced, they are put up in their full glory in the school. There is no privacy! That is what I meant. I know this is not a good thing, but I doubt this trend will change anytime soon.

captn3m0 13y ago

The code for this is available on github[1], in case anyone is interested. [1]: https://github.com/deedydas/CISCEResults2013 https://github.com/deedydas/CISCEResults2013

ihuman 13y ago
Strange. I'm getting 404 errors for that repo.
- thex86 13y ago
  He says he made the repo private.
  - fakeer 13y ago
    Well, that means he is a paying github customer or mayeb the recent Gitub offer of pvt repos to students. Ps. Any mirrors?

glesica 13y ago

Why are all the comments focused on how he got access to the data? The real scandal isn't in that they didn't protect the results (apparently Indian culture doesn't have the same level of privacy in this area), but in the fact that the results appeared to have been manipulated in odd ways.

thex86 13y ago
I don't have the time to write a complete explanation about that, but if you point out a specific instance that interests you particularly, I can try to give an explanation.
iamshs 13y ago
The guy is playing the press, and enjoying the limelight on him by terming his data mining process as hacking in the opening paragraphs complete with juicy quotes, and this is why this article does not even mention the anomalies in the testing but rather concentrates on the cyber attacks. On his results: http://qph.is.quoracdn.net/main-qimg-7563466e4810af140bb712b95f238531 http://qph.is.quoracdn.net/main-qimg-7563466e4810af140bb712b... Now this data distribution looks suspect to tampering. I will not pass judgements though without knowing the format of the papers. Besides, we do not know if indeed he actually fetched data for all the students and did not miss anybody, since he is relying upon his manual boundaries while scraping data. How informed are those boundaries is not known. ICSE schools are not normal run of the mill schools, they are populated by rich kids who can afford extra help and are kind of smart. Their English curriculum is reputed to be strong, hence the strong distribution towards high end. I am also making assumptions, but I do not have full data to make informed inferences.
- fakeer 13y ago
  Agree with rich kids and English part totally. Besides, it's a tradition to get high marks in an ICSE schools in India. So much that if you pass your 10 from an ICE school and go to a CBSE school for admission and have 94% marks then the kid who has 89-90% from a CBSE school or even lower from a state board school might be preferred. It was true in 2001-2003 and was till I kept track, not sure now. Their system has(had) a lot of marks in the hands of school authority rather than the board and those marks were(are) very generously handed out.

cubancigar11 13y ago

I have been doing this for past two years for my paper on social privilege and reservation. Thanks to this guy my job might just become harder.

ISL 13y ago
Quality work is quality work. Getting scooped doesn't diminish whatever you've accomplished.

octonion 13y ago

I've forked the GitHub and rewritten the scraper in Ruby. Full ICSE and ICS results are already there, plus a PostgreSQL loader and a script to determine the "true" all-India topper accounting for exam difficulty. I've also written a preliminary CBSE scraper. https://github.com/octonion/CISCEResults2013 https://github.com/octonion/CISCEResults2013

iamshs 13y ago
Can you put up the CBSE results please? Simple csv aggregate file will suffice. I will do some analysis on that too.
- octonion 13y ago
  I'm scraping the CBSE now. It'll take about a day. I'll upload it and post here when it's done.
- octonion 13y ago
  I have about 1 million of the CBSE student records there now. That's abut 8.8 million scores. https://github.com/octonion/CISCEResults2013/tree/master/cbse https://github.com/octonion/CISCEResults2013/tree/master/cbs...

Sven7 13y ago

Hilarious stuff :) "For example, 81, 82, 84, 85, 87, 89, 91 and 93 were visibly missing. I repeat, no one in India had achieved these marks in the ICSE." http://deedy.quora.com/Hacking-into-the-Indian-Education-System http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys...

IvyMike 13y ago
To me the missing values (and nearby spikes) seem like they could be aliasing due to a bad rounding/scaling algorithm.
- iamshs 13y ago
  This is what i thought too, especially since it is visible among all the subjects.
  - harichinnan 13y ago
    A simple explanation would be extra scrutiny for the answer paper evaluators when marks go beyond 80. That might determine the difference between getting home/hotel at 5:00 P.M or sitting with the supervisor, painstakingly cross checking every answer. Picking answer paper evaluators are like picking people for jury duty in US. Its a lottery system for teachers across the board(In this case across India) and once you get selected, its mandatory to show up at the central evaluation center. The evaluations last something like 10-15 days.

nadahalli 13y ago

It's not quite bogus, but it's very close. http://pratyaya.nationalinterest.in/2013/06/05/the-bogus-claims-of-hacking-indian-education-system-and-marks-tampering/ http://pratyaya.nationalinterest.in/2013/06/05/the-bogus-cla...

siddhantpuri 13y ago

he didnt hack it he just scraped it. it wasnt something illegal. read his blog post.

pilif 13y ago
isn't what he has done exactly what the "AT&T Hacker" who's now put into jail for years has done back in 2010?

general_failure 13y ago

I think the hacking claims are just fine. Hacking doesn't just mean making use of some XSRF or XSS exploit. Hacking means to make software behave in a way it was not intended to behave. It means to spot mistakes in software in some ingenuous fashion. The author (http://deedy.quora.com/Hacking-into-the-Indian-Education-System http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys...) has done just that. He had to look into the source code, figure what format of the request was, figure the block ranges for the student and school codes and parse out the html results.

yuvipanda 13y ago

http://tnresults.nic.in/tncfplus/cfplus.htm http://tnresults.nic.in/tncfplus/cfplus.htm is the similar site for the Tamil Nadu (southern state)'s exam. From a cursory look seems to be at least a little bit more secure - requires DOB. Still, is made with Frontpage...

ja27 13y ago

Why is so significant that he is a "college grad"?