<\/span><\/p>\n Passwords are stored in plaintext. Seriously- how is this still a thing? Users report being able to call customer support and retrieve not only their usernames but their passwords as well.<\/a> Others had their passwords emailed to them. If a customer support rep can read your password to you over the phone, you\u2019ve got a real problem. It would only take a bit of social engineering for somebody to get into your account, and if you reuse passwords, then your unrelated accounts can be easily compromised. (Please, use a password manager!)<\/p>\n It turns out that you don\u2019t even need to log into somebody\u2019s account to scope out their personal info. Users uploaded government IDs to their accounts, which were promptly sent to a server and stored accessible publicly<\/i> via a random URL<\/i><\/a>. It\u2019s worth noting that it seems like more of a shortcoming on the part of the NY BOLE and not ExamSoft. Thankfully, once users reported the problem, the BOLE fixed it — though the fact that it was a issue in the first place is ridiculous. More astonishingly, the NY BOLE isn\u2019t the only exam board that had this sort of problem. The DC Bar published\u00a0 users\u2019 background check documents, containing SSNs and employment histories, in addition to their IDs.<\/a><\/p>\n There is a set of config files that comes bundled with each downloaded exam<\/a>, and those files are, well, just plaintext. Puzzlingly, the parameters in these files, such as “isTimed” and “allowSpellChecking,” seem to have little effect in the software. Examsoft claims that modifying them will corrupt and invalidate the exam<\/a>, but that doesn\u2019t appear to be the case either.<\/p>\n The software also downloads the exam days before the test starts, leaving the files vulnerable to being poked and prodded by the curious-minded. These files are at least encrypted with an 18-character key, according to ExamSoft<\/a>. On the exam day, the key is made public and test-takers can use it to decrypt the exam files. This isn\u2019t the best strategy, especially when the Michigan bar exam, rather than employing an 18-character key as ExamSoft promised, used the passwords green56, purple34, and blue78 for their exam files<\/a>. These horribly weak passwords are probably vulnerable to a brute-force attack.<\/p>\n One of Examplify\u2019s main selling points is its ability to lock down a computer<\/a>. You wouldn\u2019t want a test-taker googling anything, or glancing at a PDF of the textbook on a second monitor.\u00a0 While some of the more obvious ways to cheat are blocked here, users have found a loophole that ExamSoft unsurprisingly overlooked. Mac users may be familiar with the Universal Clipboard, a feature which, when enabled, allows a user to copy something on one device and paste it on another linked to the same account. Guess what — Examplify doesn\u2019t disable it<\/a>. This is a fun loophole, since a test-taker could copy the question text, and a friend could paste it onto an iPad and copy the relevant section in the textbook for the test-taker to read. It\u2019s unclear as to whether or not this has been fixed yet, but as of September 28th the workaround was still usable.<\/p>\n Users found other creative ways to get around the software lockout as well. It\u2019s been reported that if the computer gets rebooted mid-exam, the user gets ~30s of unrestricted access to their files, as well as the internet<\/a>. One user was even able to reset the timer and start the exam over by rebooting their computer<\/a>.<\/p>\n As you can imagine, it\u2019s not just the security that\u2019s awful. Users report a slew of interface problems, from software freezing mid-exam<\/a> to the facial tracking software (which determines whether you\u2019ve cheated by looking away from your screen) not being able to recognize dark-skinned people<\/a>.<\/p>\n It\u2019s tough to dive into this sea of shortcomings without registering for the bar exam, however we were able to find a link to the Examplify installer (Windows<\/a>, macOS<\/a>) hosted on ExamSoft\u2019s servers and, of course, unprotected. Go nuts.<\/p>\n It\u2019s impressive that with modern advances in technology, we\u2019ve found ways to make exams more stressful than ever before. It may be worth considering doing away with the bar exam<\/a> and other standardized tests entirely. For the time being these tests are still a reality and it goes without saying, but we\u2019ll say it anyway: even though ExamSoft and the NY BOLE seem to have made it easy to cheat, please don\u2019t do that. Amid all of this failure, they\u2019ve at least succeeded in one way. They\u2019ve given us excellent examples of how not to do, well, pretty much everything.<\/p>\n Thanks to [Jonathan Merrin] for the tip!<\/p>\nDid They Just Email Me My Password?<\/h2>\n
12345? Amazing, I have the same combination on my luggage!<\/h2>\n
![\"\"](\"http:\/\/cornay.co.za\/wp\/wp-content\/uploads\/2020\/10\/EjHVXeiWAAExNlq.png\")
Now What?<\/h2>\n