Dark web schooling

[harlan4096]

School exams not going quite according to plan? It can happen to anyone. Most of those affected will pick themselves up, retake the tests, or change their goals. But in a few cases, students may be tempted to cheat their way to success.

Over the years, an underground industry has grown up around that temptation, from discussion fora and how-to videos for hacking into your school system to fake certificates and diplomas available for sale on the black market. We decided to look into this a little and see what schools and colleges can do to protect themselves and their students.

Getting access to grades

Many schools have introduced Web-based information platforms for school activities, homework, assessments, parent and teacher communications, and more. Some of these are open to the Internet, and many such platforms, including some of the most widely used, have a history of being vulnerable.

One of the most popular school information platforms is PowerSchool. PowerSchool is known to have carried a vulnerability (CVE-2007-1044) that would allow an attacker to list the content of the admin folder via a specially crafted URL. The impact of this vulnerability depends on the settings of the Web server and what the folder contains.

However, reported vulnerabilities and exploits such as this one do not allow an attacker to bypass the authentication or escalate privileges to gain access to the kind of information grade-hackers might be looking for. For that, there is an easier route: using account credentials.

PowerSchool’s gateway, like that of many other platforms is protected only by usernames and passwords.

In March 2019, students were alleged to have hacked into PowerSchool for the purpose of changing grades and improving their attendance records. And because people reuse account credentials on multiple sites, it is highly likely that these portals are being hacked using stolen or reused account details. These accounts can be obtained using different methods, from simply copying them from a sticky note on a teacher’s keyboard to actual hacking and credential harvesting on the school or college network. Alternatively, students can hire an underground hacker to do it for them.

Continue Reading