4 ms·

How did it identify you as a student? Couldn't you alter the routine to bomb someone else's grade?

• D5AA96 12y ago
  That's how you get extra credit.
• superuser2 12y ago
  You get a customized binary tied in a server-side database to your campus single-sign-on identity. Everyone gets different passwords, and the passwords are validated server-side to make sure you didn't just GOTO the success reporting routine. There could easily have been a secret embedded in each bomb, reported on defusal or detonation, to prevent people from detonating each other. The project was graded on an absolute rather than relative scale, so there was little incentive to spend time on something other than defusing your own bomb. (The project was called "the binary bomb." We all had a great time telling our friends that we were up all night at the library defusing a bomb.)
  • x1798DE 12y ago
    Do you know if they did anything to mitigate replay attacks? If not, you could potentially capture someone's first call-hope and replay it until they fail. Presumably no one would want to, but people still like messing with one another for fun. Also, if you discover a vulnerability like that, you could plausibly claim that someone exploited it to bomb your grade, particularly if you used it against a bunch of people.
    • superuser2 12y ago
      You would have to be in a position to pcap another person's attempt, which would itself be a fairly intense project on a WPA2-EAP network. Definitely worthy of glory, but probably harder than just doing the project.
• eva1984 12y ago
  The binary is tailored, in the beginning it does some identity check. In CMU, as I remembered, you have to login to the school's cluster using your own account to actually diffusing the bomb.