College grad hacks ICSE, ISC results, shows up India’s cyber flaws

http://www.firstpost.com/tech/college-grad-hacks-icse-isc-results-shows-up-indias-cyber-flaws-845135.html

by posharma • 13 years ago

50 46 13 years ago

thex865• 13 years ago

> One person had just acquired the exam results for the whole country. Not only was this a violation of any and all forms of privacy associated with something as personal as your examination marks, but a mass divulsion of all sorts of personal information - names, date of birth and school.

There is no privacy to begin with, so this is a sensationalist argument at its best.

In India, there is no notion of keeping your grades confidential from others. Your entire neighborhood knows how you fared in your exams, because the notion of privacy and to keep grades as a secret as is in the western countries is not there.

What the author has done is nothing new, except that he got hold of them "technically". I checked my result for the same exam when I was in USA. Not only that, I got the result for the entire school through email, it is that easy.

Case in point:

http://schoolcoderesults.nic.in/cbse-2013/result.php

So if you did give the exam, you have access to all the grades and they will send them to you through email, no questions asked at all. Let me repeat: you get all the grades for everyone in the school just through this one click. Should I call this a flaw in the system when the system presents this interface to me?

Even if you did not give the exam, you can get the "School Code" and "Authorization Code", again from the CBSE (the Central Board of Secondary Education). So I can get the grades for anyone from any school in India.

This is not a "cyberflaw". It is a flaw in our culture, if you can call it that.

harichinnan2• 13 years ago

Results get published in news paper in India. Anyone with your registration number could get all your marks. Its easy to go back one step and know who is the owner or the exam registration number. In our state(Kerala) they publish a ranking of top 15 rank holders in the state for 10'th and 12'th classes and the kids are treated as celebrities with newspaper and tv coverage.

fakeer5• 13 years ago

CBSE[1] officially sends you results via email[2]. Of an entire school and there you get students' names, roll numbers and marks and pass/fail. The you get student's roll number and see the entire result card[3] which also has students' mother's names, father's names and DOB.

All you have to know is two codes of a school: affiliation and school code which is public and schools put it on their websites[4]

[1]https://www.google.com/search?q=CBSE

[2]http://schoolcoderesults.nic.in/cbse-2013/result.php

[3]http://cbseresults.nic.in/class10/cbse102013cvb.htm

[4]A tiny % of schools have their websites but that information is readily available.

kamaal2• 13 years ago

Yes, How are exam results secret?

Sorry but ever since exam results are being posted on the internet. You could practically Google your way to finding some one's result.

shubhamjain• 13 years ago

Agreed. Someone just created a bot to fetch all records and plotted nice graphs. Creative but I don't see any reason how this is a security flaw.

nrbafna• 13 years ago

He writes about it himself here - http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys...

Also, from his write up, it was serious lack of security on the results website.

More importantly, the focus from his write up should be less on the getting the data of the results, rather on the data itself. He goes on plot the scores vs frequency for all the courses taken up students and discovers a good case of tampering with the scores.

thex865• 13 years ago

> Also, from his write up, it was serious lack of security on the results website.

How? The website has an interface to give you all the results. All you need is an email address. How is this then a lack of security? This is 'by design'.

pyre2• 13 years ago

Just because that's the interface doesn't mean, "Allowing the entire world access," is by design. I understand where you're coming from with the cultural angle in your other post. On the other hand, sometimes people leave things in the open with the idea, "what's the worst that can happen," or, "only authorized people will know about this, I don't need security." This doesn't signify an intention to let the world see, or a lack care about whether or not the world sees.

zengr• 13 years ago

He has clearly stated on his blog:

"I spoke to the Times Of India (linked below) and I would like to clarify what's been written in the article. The article states "A 20-year-old Indian student from Cornell University hacked into the database ... " This is technically incorrect. I did no such thing. I did not illegally access any database system. All I did was access information that was available to any person who entered a number into the website could access. I simply mined the data and then analyzed it to reveal some interesting and disturbing trends""

So, he didn't hack anything.

pyre2• 13 years ago

Depending how you define 'hacker,' his data mining could be considered 'hacking the data.'

jervisfm• 13 years ago

Well, don't know what laws India has with regards to Cyber-security if any at all, but I wonder how the reaction would be if that happened to a nation-wide exam/test in the US like the SAT.

Even if the data was available on the server, I think the laws here are such that one can still be persecuted for that. A recent example that comes to mind is the AT&T hack that leaked email addresses of some iPad users [1].

Fortunately, in this case, it does not appear that the original poster has anything to be concerned about.

[1] http://www.computerworld.com/s/article/9237838/Legal_experts...

lawnchair_larry• 13 years ago

Well in the US, doing this to get information that is even less sensitive counts as hacking and gets you sent to prison (see Andrew Auernheimer).

openforce• 13 years ago

Its funny how this will likely be handled by the people in authority. Some narrow minded men with no computer knowledge will sit around a table and decide what action can be taken against the 'hacker' for this 'breach', Ignoring the real issue here.

Websites made by/for government institutions in India are a joke. Most Indian websites are probably still made to work only with IE (IE6 even).

bshastry• 13 years ago

If he stated so, it is clearly not in line with the title of his blog post [1]. Come on, the media preys on keywords like hacking, so if you don't see it coming be careful the next time is my advice to the "hacker" in question. [1] http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys...

captn3m0• 13 years ago

The code for this is available on github[1], in case anyone is interested.

[1] https://github.com/deedydas/CISCEResults2013

ihuman• 13 years ago

Strange. I'm getting 404 errors for that repo.

thex865• 13 years ago

He says he made the repo private.

glesica2• 13 years ago

Why are all the comments focused on how he got access to the data? The real scandal isn't in that they didn't protect the results (apparently Indian culture doesn't have the same level of privacy in this area), but in the fact that the results appeared to have been manipulated in odd ways.

thex865• 13 years ago

I don't have the time to write a complete explanation about that, but if you point out a specific instance that interests you particularly, I can try to give an explanation.

iamshs3• 13 years ago

The guy is playing the press, and enjoying the limelight on him by terming his data mining process as hacking in the opening paragraphs complete with juicy quotes, and this is why this article does not even mention the anomalies in the testing but rather concentrates on the cyber attacks.

On his results: http://qph.is.quoracdn.net/main-qimg-7563466e4810af140bb712b...

Now this data distribution looks suspect to tampering. I will not pass judgements though without knowing the format of the papers. Besides, we do not know if indeed he actually fetched data for all the students and did not miss anybody, since he is relying upon his manual boundaries while scraping data. How informed are those boundaries is not known. ICSE schools are not normal run of the mill schools, they are populated by rich kids who can afford extra help and are kind of smart. Their English curriculum is reputed to be strong, hence the strong distribution towards high end. I am also making assumptions, but I do not have full data to make informed inferences.

fakeer5• 13 years ago

Agree with rich kids and English part totally.

Besides, it's a tradition to get high marks in an ICSE schools in India. So much that if you pass your 10 from an ICE school and go to a CBSE school for admission and have 94% marks then the kid who has 89-90% from a CBSE school or even lower from a state board school might be preferred. It was true in 2001-2003 and was till I kept track, not sure now.

Their system has(had) a lot of marks in the hands of school authority rather than the board and those marks were(are) very generously handed out.

kamaal2• 13 years ago

>> ICSE schools are not normal run of the mill schools, they are populated by rich kids who can afford extra help and are kind of smart.

Around a decade back, When I joined pre university college. ICSE/CBSE fashion was its highest. I remember our college principal had put them all in a section and they often got the best faculty and privileged treatment. It was almost like they were sort of something special, so special care needs to be taken to handle them, As though they were some exotic orchids. And we were some garbage thrown across the road which would turn fertilizers for the large plants.

By the next year it was clear, they were a total disaster. In fact their only distinguishing factor was they could speak neat English, good clothes and a tremendous sense of elitism.

Its just these highly bloated syllabi, about teaching kids all sort of advanced subjects which they understand nothing of. Ultimately they learn less than others.

glesica2• 13 years ago

The article is mostly about the data he gathered, not the methods he used to acquire the data. I agree with you that it is hard to draw conclusions from his analysis without knowing more about the tests and how they work, but that is exactly why I was hoping the comments on HN would provide some clarity in this area rather than a debate about whether what he did was "hacking", which is wholly uninteresting as far as I'm concerned.

rjuyal• 13 years ago

Few years ago I too "mined data" ( this word sounds ethical ) the data from MTNL site. I got the record of every single person who have landline number in delhi. ( Actually I just wanted to see the bill amount ) but they showed me everthing. ;) Though I didn't made such graphs.

Whats's more in one of the site I was able to clear my bill by paying as much I like. That means if my bill was 1000/- then by just paying 100/- I would get the confirmation of 1000/- bill pay. :)

cubancigar11• 13 years ago

I have been doing this for past two years for my paper on social privilege and reservation. Thanks to this guy my job might just become harder.

ISL• 13 years ago

Quality work is quality work. Getting scooped doesn't diminish whatever you've accomplished.

octonion3• 13 years ago

I've forked the GitHub and rewritten the scraper in Ruby. Full ICSE and ICS results are already there, plus a PostgreSQL loader and a script to determine the "true" all-India topper accounting for exam difficulty. I've also written a preliminary CBSE scraper. https://github.com/octonion/CISCEResults2013

iamshs3• 13 years ago

Can you put up the CBSE results please? Simple csv aggregate file will suffice. I will do some analysis on that too.

octonion3• 13 years ago

I'm scraping the CBSE now. It'll take about a day. I'll upload it and post here when it's done.

octonion3• 13 years ago

I have about 1 million of the CBSE student records there now. That's abut 8.8 million scores. https://github.com/octonion/CISCEResults2013/tree/master/cbs...

Sven7• 13 years ago

Hilarious stuff :)

"For example, 81, 82, 84, 85, 87, 89, 91 and 93 were visibly missing. I repeat, no one in India had achieved these marks in the ICSE."

http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys...

IvyMike• 13 years ago

To me the missing values (and nearby spikes) seem like they could be aliasing due to a bad rounding/scaling algorithm.

iamshs3• 13 years ago

This is what i thought too, especially since it is visible among all the subjects.

nadahalli• 13 years ago

It's not quite bogus, but it's very close.

http://pratyaya.nationalinterest.in/2013/06/05/the-bogus-cla...

siddhantpuri• 13 years ago

he didnt hack it he just scraped it. it wasnt something illegal. read his blog post.

pilif• 13 years ago

isn't what he has done exactly what the "AT&T Hacker" who's now put into jail for years has done back in 2010?

general_failure• 13 years ago

I think the hacking claims are just fine. Hacking doesn't just mean making use of some XSRF or XSS exploit. Hacking means to make software behave in a way it was not intended to behave. It means to spot mistakes in software in some ingenuous fashion. The author (http://deedy.quora.com/Hacking-into-the-Indian-Education-Sys...) has done just that. He had to look into the source code, figure what format of the request was, figure the block ranges for the student and school codes and parse out the html results.

yuvipanda• 13 years ago

http://tnresults.nic.in/tncfplus/cfplus.htm is the similar site for the Tamil Nadu (southern state)'s exam. From a cursory look seems to be at least a little bit more secure - requires DOB. Still, is made with Frontpage...

ja27• 13 years ago

Why is so significant that he is a "college grad"?

College grad hacks ICSE, ISC results, shows up India’s cyber flaws

Related Stories