Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 1 of 12

On the Stepping Stone

714 Followers

HackingintotheIndianEducationSystem
Debarghya Das 4520 votes by Devvrat Singh Rathore, Tushar Gupta, Nikhil Mitra, (more)

Debarghya Das 42 debarghyadas.com

Inthelastseveralweeks,inatimewedgedawkwardlybetween theendofmycollegefinalsandmysummerinternship,Ivebeen exposedtosomeinformationthatleftmequiteflabbergasted.It startedaboutamonthago.Itwasaveryimportantdayinthe livesoftwoofmyjuniorsandclosefriends,SumitShyamsukha andRonakShah.Itwasthedaytheirboardexaminationmarks, theICSEandtheISCrespectively,weretobereleased.Toputthis incontexttoournonIndianreaders,theICSEisa10thgrade nationalexaminationandtheISCisits12thgradecounterpart.I amnotawareoftheexactnumbers,butIbelievetheboardwho holdstheseexaminations,ambiguouslynamedCISCE,isthe secondmostpopularboardofeducationinIndia,aftertheCBSE. Around150,000 studentstaketheICSEandaround65,000 take theISCfrominandaroundIndia. Wroughtwiththemonumentalanxietythatusuallysurrounds suchacrucialresult,SumithadaskedmewhetherImight beable tobreakintotheirsystembeforeDdayandquellhiscuriosity.I knewitwasalongshot.Ononehand,Iwantedtoimpress someonewholooksuptomeandontheother,Ithought"break into the ICSE? This isn't Hollywood you can't just hack into everything, kiddo".Puttingthepessimismpastme,Idecidedto takealook. Technicality Alert. Theportionsbelowareforanaudienceinterestedinthetechnical aspectofthings.Iwilltrymylevelbesttosimplifythings,butin caseIfail,feelfreetoskipthepastthedemarcated[technical]tag. [Technical] HandedjustaURLandatask,Iwasunsureofhowtoproceed pastamostlyblankscreenwithtwotextboxesinthecenter.One textboxwasforSchoolCodeandtheotherwasforthestudentID. ItypedinSumitsIDhopingforaresult.Notsurprisingly,this gotmenowhere.Theresultswerentoutyet,andprobablynot uploaded.Thiswasntgoingtobeeasy. Itriedagain,alittlewhileaftertheresultswerereleased. AtleastIcouldsalvagesomeofmyrespectandmaybescrape some results,Ithought.Iinvestigatedfurther.Viewingthesource oftheinvalidpagerevealedsomeverypoorlywrittenandbadly styledjavascript. Thejavascriptwasntseparatedawayfromthe
More The April Fools' XKCD Alma Mater Challenge Winter. 46201 people have viewed this post. Post Topics Promote Indian Institutes of Management Technology Education Public Education Hacking (general programming) CBSE ICSE Schools Computer Science The College and University Experience India

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 2 of 12

HTMLintoitsownJSfile(asisusuallydone).Neitherwasit minified.Itwassomesloppywebwork.Therewereseveral pointsofinterestinthecode. ThepagesourcedidnotcontaintheHTMLforaparticular studentsresultsbuthadone layer of additional security it fetchedthemviajavascript.However,tomysurprise,itdidnt fetchthemfromadatabaseoranythingserverside itmerely fetchedthemfromanotherunindexed(akainvisibletosearch engines)URL.Heresthecodethattheyused: 1 function changeIframe() 2 3 4 5 6 7 8 9 10 11 { // Retrieve 2 parameters from the URL var indexno2 = getQuerystring('indexno2'); var indexno4 = getQuerystring('indexno4'); // Concatenate the parameter Strings var rollno = indexno2 + indexno4; // Fetch the results from a link to an html file named with the String // of the concatenated parameters $("#result").html('<img } src=\'http://drop.ndtv.com/ndtv/common/onemin/icse/lo makePOSTRequest("web/10th/10-1/"+rollno+".html",rollno);

Iaddedtheinlinecommentstoexplainthecode.Iwastaken abackalittlebythisdiscovery.Besides a wafer thin layer of hiding the content from the HTML page, all they did was fetch it from another unencrypted HTML page. ThefunctionmakePostRequest wasprettyselfexplanatory butIhadtoreaditsimplementationtobesure. 1 function makePOSTRequest(url, parameters) { 2 3 4 5 6 7 9 10 11 12 13 14 15 16 } Essentially,itdidexactlywhatIthought itwenttoanotherURL tofetchastudentsresults a URL to <students school code><students individual code>.html. Yes.That simple.Incase itfailed,itwouldcallfailoverPOSTRequest_2 which wouldmaketherequesttoadifferentserver the2ndone.This chaincontinuedontoabout4servers. [/Technical] }); // Constructing an AJAX request $.ajax( { data: error: parameters, //Data sent in the request function(request,status,error) { //In case of error execute this

failoverPOSTRequest_2( }, success: }, url: type: url, 'POST' function(data,status,request) { // In case of success, display $("#result").html(data);

8 "web/10th/10-2/"+parameters+".html",parameters);

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 3 of 12

AcquiringtheresultsofICSEandISCcandidateslooked extremelystraightforwardbecausetheresultspagehadno propersecuritymechanismwhatsoever.Letmebreakdownwhat theformatofanICSEorISCrollnumberlookslike: ICSE:T/[4 digit school ID]/[3 digit student ID] ISC:B/[4 digit school ID]/[3 digit student ID] TheschoolIDandthestudentIDareinlinearorder.Therewere severalslightintricacies schoolIDsforthesameschoolwere differentforthedifferentexaminations.Eventually,itseemedlike ICSEschoolIDsrangedfrom4001 to5568 andISCschoolIDs rangedfrom9001 to9793. StudentIDsalwaysstartedat001 and continuedincrementallyuntilthelaststudentofthatschool.My taskwasmerelytowriteaprogramwhichfoundtheseranges andretrievedandstoredalltheresultsonmycomputer. [Technical] Technicallyput,Imerelyneededtowriteascripttoiterate throughthevariousschoolIDs,checkthedifferentservers,and startwithastudentIDof1yethaveawaytodetectwhenthere werenomorestudentsforagivenschool.Ihadtoretrievethe resultanthtmlfilesandparsethemtoextractalltheuseful information Name, Date of Birth, ID, School, Marks. Thiswasallprettysimple.Iinitiallywroteaprototypeofthe resultfetcherwhichworkedonhardcodedinputsandfetched oneschoolatatime.YouhadtoprovideStudentIDranges,the schoolIDaswellastheservernumberyouwantedtoquery.This methodwasobviouslystupid,butaha!Iwasfetchingsome valuabledata! Gradually,Ibuiltontheautomation,untiltheonlythingIhadto supplywasarangeofschoolIDsanditwouldfetchdatafromall studentsfromallthoseschoolsfromanymatchingserverthey foundandneatlystoretheresultsinacommaseparatedvalue (csv)file. BecauseIwasunawareoftheschoolIDrangeatfirst,Isimulated asimpleMapReducemodelandsplittheworkamongstabunch ofmycollegesmachines.Withafewkeyboardpressesand severalinstancesoftheseonseveralremotemachines,beforeI knewit,Iwasminingdataatincrediblespeeds! [/Technical] Severalhourslater,Ihadall theISCandICSEresultsonmyvery owncomputer,inabunchofcommaseparatedvaluefiles.Itwas trulyincredible.26megabytesofpure,magnificentdata.An ExcelfileIcouldntscrolltothebottomof.Justforkicks,I Ctrl+FdafewnamesIknewandwhatdoyouknow?Therethey were.Lineafterlineofnames,subjectsandnumbers.Itwastruly

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 4 of 12

mesmerizing. Takesometimeoutandimbibethesignificanceofwhatjust happened.One person had just acquired the exam results for the whole country. Notonlywasthisaviolationofanyandall formsofprivacyassociatedwithsomethingaspersonalasyour examinationmarks,butamassdivulsionofallsortsofpersonal information names,dateofbirthandschool.This was a privacy breach of the highest order a technological blitzkrieg. When 114,000AppleIDswerecompromised(AT&TWebsiteexposes dataof114,000iPadusers ),itwasahugedeal.Thisis informationofaround200,000peopleweredealingwith.Thisis myfirstmotivebehindwritingthisarticle todemonstratethe vulnerabilityofinformationonthewebinIndia.To demonstrate how few measures our education board takes to hide such sensitive information. Evenwithoutanysuchfancy programming,anybodycaneasilypeekaglanceathisfriends resultsbyqueryingforanyofthe150orsorollnumbers associatedwithhisschoolID.Thisutternegligenceofprivacy withregardstogradesissomethingIfindintolerable.Marks shouldbelongtoyouandonlyyou.

BeingthenerdthatIam,Iwasinchingtogetmyhandsonallthis dataandcrunchsomebadassnumbers.Ideasrushedthroughmy mind regression tests on correlation between English marks and Science,citybased statistics,afinal conclusive revelation of the national "toppers" andagenerallookatthelargerscheme ofthings.IdelvedintodeeperanalyticsassoonasIcould.THE RESULTS WERE SHOCKING. IdealwithICSEpurely,forthetimebeing. Herearesomestandardresultsfirst themarkdistributionsof the5mostcommonICSEsubjects. The English (ENG) Distribution

Highest: 97 Lowest: 15 Mean: 69.93

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 5 of 12

Median: 69 Total Candidates: 140681 Standard Deviation: 13.8119 Comments: Huh?Whatkindofhorriblegraphisthis?Whereare allthenumbersinbetween?Mustbeacalculationmistake,I thought.Otherwise,abimodaldistributionisquiteinteresting. Theplungeat80isquiteweirdaswell.EveryonetakesEnglish, sothehighnumberofcandidatesisnotsurprising.Whats shockingisthatthisgraphjustlookswrong.

The History, Civics and Geography (HCG) Distribution

Highest: 100 Lowest: 12 Mean:68.9846 Median: 72 Total Candidates: 140672 Standard Deviation: 17.6493 Comments: Woah,thingsarestartingtogetweirdnow.What kindofmistakecouldIhavemadeinmydataretrievalthatIjust missedoutcertainvalues?AmIthatcareless?Also,whatswith thatmassivedropfrom90to95?Andthosecertainpointswhere everythingpeaks?Strange.Allinallitseemslikethecurveleans tothehigherend,withthemedian>mean.Thestandard deviationisabnormallyhighaswell.Thehighnumberof candidatesisnosurprisehereeither,asHCGiscompulsory. The Distribution of Computer Application (CTA) Marks

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 6 of 12

Highest: 100 Lowest: 2 Mean:80.8846 Median: 83 Total Candidates: 86557 Standard Deviation: 13.9073 Comments: Okay,itsnotevenfunnyanymore.WhyamIgetting jaggedgraphs?Andalso,whendideverybody becomesogreat withComputers?Ah,butwait!Iremember inCTA,50%ofyour gradecomesfromyourschoolteacher.Clearly,studentsare beinggrantedfreemarksthere.Assumingeverybodyjust securedthat50,themeanintheactualCTApaperbecomesa morerealistic62asopposedtothe81itstandsatnow.Thisgraph isleaningwaytotheright.Thejaggededgesstillstandout,and hey,theyseemtobeinsimilarplacestoo. The Distribution of Hindi (Hindi) Marks

Highest: 99 Lowest: 15 Mean:80.732 Median: 83 Total Candidates:97128 Standard Deviation: 11.3388 Comments: Igiveup.IguessIwrotemywholeprogramwrong. Whatisupwiththesegraphs?Otherthanthat,peopleseem exceptionallygoodinHindi.Thisgraphlooksnormaloverallifit werentforthosegaps. The Distribution of Science (SCI) Marks

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 7 of 12

Highest: 100 Lowest: 16 Mean:62.061 Median: 60 Total Candidates:126254 Standard Deviation: 17.4817 Comments: IthinkIjustdied.Areyoukiddingme?Isthata distributionorahedgehog?Ordidmybrotherjustscribblethat? Weirdjaggededgesatequalintervals thisisweird.Thisis definitelynotevidenceofastatisticalresult. [Update] IleftoutMath,stupidly,mypersonalfavoritesubjectand definitelyoneoftop6mostpopularonesintheICSE.My apologies. The Distribution of Mathematics (MAT) Marks

Highest: 100 Lowest: 7 Mean: 70.1274786076387 Median: 76 Total Candidates:135913 Standard Deviation: (notyetcalculated) Comments: Yetagain,thegraphdisappointsme.Itseemstobe somewhatbimodal,butnoneofthesesubjectgraphsseemto resembleanythingstatistical. [/Update]

Putting them all together:

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 8 of 12

IfeellikeScoobyDoofoundaclue.Thisissomeshockingresults itseemsthatwhenyouplotallthedistributionstogether,allthe spikesseemtoalignandthesamevaluesaremissingforall subjects.Couldthisbesomeweirdconspiracytheory?

Enoughisenough.Idecidedtotakeall theICSEmarksinall subjectsandplotthedistribution.Hopefullyeverythingwould evenout.Theresultswereshocking. This was the resultant graph:

Marks Received in any Subject vs. Quantity of Students who received it Myhypothesiswascorrect theexactsamenumberswere missingfromeverybody's resultsinall subjects. Evidence: 1. Therewerespecificnumbers,innorealpattern,thatwere missingforthedistributionoftheentire distributionofall subjectsachievedbyall students.Andthesemissingnumbers wereregularlyinterspersedonthenumberline.Forexample, 81,82,84,85,87,89,91and93werevisiblymissing.Irepeat, no one in India had achieved these marks in the ICSE. 2. 32,33and34werevisiblyabsent.Thischainof3consecutive numbersisthelongestchainofabsentnumbers. Coincidentally,35happens to be the pass mark. 3. Fromthe66numbersbetween35,thepassmark,and100,the maximumpossible,ONLY 33 WERE ATTAINED. 4. Letmerepeatthat,50% of the possible pass marks were attainableintheICSE.Heresacompletelistofunattained

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 9 of 12

marks 36,37,39,41,43,45,47,49,51,53,55,56,57,59,61,63,65,67, 68,70,71,73,75,77,79,81,82,84,85,87,89,91,93.Yes,thats 33numbers!

Analysis and Inferences: 1. Weveallheardaboutgracemarks.Itsalwaysbeenahuge mythandanoutcome,manybelieve,ofconstantreligious faith.Well,itsmythnomore.Iinferthattheygaveaway gracemarkstoeveryonewhogota32to34toturnitintoa35 ormore.Clearly, marks are tampered. 2. 33outofthe66possiblemarkswerenotattained.Couldthis meanthatalloftheseunattainedmarksweresimply promotedtothenextmark,makingitunattainable?Possibly, butwellneverknowwhichonesarepromotedordemoted andbyhowmuch?Allweknowarethatthemarksare tampered. 3. Oneofthemostcommoncritiquesofmytheorywasthis maybetherewerequestionswithonly3or4markintervalsin all subjects makingcertainmarksmathematically unattainable.Mycounterargument?Allnumbersfrom94to 100are attainableandhavebeenattained.Whatdoesthis mean?Itmeansthatincrementsof1to6areattainable.By extension,allnumbersfrom0to100areachievable. Letmegiveyouanexample.If99and98weredefinitely achievablewithdeductionsof1and2respectively,thismeans oneoftwocases thereisaquestionAworth1markthat made99occur,andaquestionBworth2maksthatmade98 occur,whichmeantgettingAandBbothwrongwouldmean 97couldoccur.Case2 QuestionAwasworth1mark,and questionBwasworth1marktoo.The99gotAwrong,and the98gotAandBwrong.Bythislogic,if97werenot possible, itwouldmeanthatthereisnootherquestionof1 markintheexaminationorthatnobodygota2pointquestion wrongandquestionAorB. Itsslightlycomplicated,andIdidahorriblejobofexplaining it,butifyouthinkaboutitandreasonaboutthiswithregards tothepointdivisioninhowtheICSEisstructured,youll realizeitsalmostimpossible thatallofthenearly150,000 candidatesinanysubjectjustdidnotgetacombinationof questionswrongthataddedupto7.Itsstatisticallyimpossible. 4. Evenifyoubelievethattheaboveproofisenoughtoascertain thatdefinitelysomeamountofmarktamperingoccurred,you cantguaranteethatitwasharmlessandasmalloneortwo pointboost.Evenifitwerejustaoneortwopointboost, marktamperingisunfair. Further,itishighlyunlikelytoassertthesimplersolution thatitwasauniformcaseofmarkpromotionatcertain marks.Wedonotknowiftheyloweredorincreasedpeoples

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 10 of 12

byaninsignificantnumber.Theymighthaveboosted somebodyupby5forallweknow. Further,thereisnogapsinthedistributionfrom94to100. Thiscouldmeanoneoftwothings theideal,thatnoneof thesemarksaretamperedforaspecialreason,ortwo,these marksarealsotamperedunevenlybutwedontseethe resultsonthegraphbecausethereisnobreakinthe distribution. 5. Youmightbethinkingrightnowhowmuchofajokethis articleis.YoumightberollingyoureyesthinkingComeon, cantitjusthappenthatcertainmarkswerentachieved? IfyoureaskepticandstilldontbelievewhenIsaythe absenceofa93isstatisticallyimpossible,readon.Onestotal ICSEscoreisbroadlygaugedbyoneof3metrics Overall Average, Best 5 subjects,andBest 4 subjects, plus English. Statisticssaysthatifyoutakeenoughsamplesofdata, regardlessofthedistributon,itwillaverageoutintoaNormal distribution.WhenIplotthedistributionofthesemetric, voila!

Whatwasinitiallyajaggedmesshasallofasuddenbecomea refinedslightlyaskewbell.Statisticsmagicallytransformed thatjaggedmessintoanicecurve.Itisthesamestatistical theorythatsaysthatitisnotpossibleforthat93andthose32 othernumberstobeabsentfromthepreviousdistribution. 6. Iknow,Iknow.Therewillalwaysbehaters.Onemightstill besaying,Maybethisoneexaminationwasalittlestrange, butImsuretheydoitrightmostofthetime.Ipresentto you,theISCresult,theclass12versionofthesameexam offeredbythesameboard:

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 11 of 12

Shocked? In the ISC, the pass mark is 40. 24 of the 61 numbers between 40 and 100 are unattained. Thats a little more than 39% of them all. Here, grace marks rage on. Everything from 35 onwards, and most things from 23 onward seem blindly promoted to a pass mark. The ISC determines college admissions to a wide array of Indian colleges that impose strict cutoffs for admission. One mark can change your fate. In such an abhorrent system, even the simplest case of making a 93 a 92 could change a future. Adulteration of these marks is absolutely unacceptable.

In my opinion, there is not a shadow of doubt in my mind that the CICSE board is fraudulent and guilty of mark tampering. Whether they changed some results by plus or minus 1 or plus or minus 5 is irrelevant. Fact is, they changed some results. This is the second motive behind my writing of this article to draw out this fact.

Disclaimer: The total number of candidates I parsed maybe slightly short of the complete actual number. I may have missed some corner cases when fetching the data, and there may have been absentees during the examination. Also, for detailed analysis, I removed everybody who didn't complete the requisite number of subjects in the ICSE, which is why the number is slightly less than it should be Prologue: For those readers who are still not convinced, I'll be updating this post on request to include more of the ISC data. For those of you who are interested, I recently also cracked the CBSE class XII security and have managed to attain most of the results there too. This hack presented a whole host of new technical challenges. Fetching 1 million results as opposed to several hundred thousand is an order of a magnitude increase and required me to scale up my retrieve and data processing methodology. It should make for a good technical read. The results are eyeopening, to say the least. Relevant Links: The results page ICSE, ISC Results for X and XII Board Examinations on NDTV Updates: 1. GitHub repo is now private. Sorry guys. 2. Added Math Distribution 3. Twitter / Search icse 4. I haven't read all of these so I don't know how accurate their

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013

Hacking into the Indian Education System - On the Stepping Stone - Quora

Page 12 of 12

content is. I spoke to the Times Of India (linked below) and I would like to clarify whats been written in the article. The article states "A 20 yearold Indian student from Cornell University hacked into the database ... " This is technically incorrect. I did no such thing. I did not illegally access any database system. All I did was access information that was available to any person who entered a number into the website could access. I simply mined the data and then analyzed it to reveal some interesting and disturbing trends" Daily Mail: These marks have been tampered with: Sensational claim of US student who hacked CISCE results Outlook India: http://blogs.outlookindia.com/default.aspx? ddm=10&pid=2988&eid=31 Daily Bhaskar: College student hacks 10th, 12th board results,reveals system loopholes Hindustan Times: College boy hacks ICSE, ISC results Hindustan Times The Times of India: Indian student in Cornell University hacks into ICSE, ISC database The Times of India Firstpost: College grad hacks ICSE, ISC results, shows up Indias cyber flaws
156+ Comments Report 8:59 on Tue Jun 4 2013 46201 Views

Recommended Posts From Other Blogs Is There A Complaint Department?: The Story Of My Wedding Dress by Cyndi Perlman Fink Leading a better life: Why do we need confidence? by Oliver Emberton Leading a better life: You will still be here tomorrow, but your dreams may not by Oliver Emberton Miss Cranky Pants: My Immutable Truths - Part 1 by Cyndi Perlman Fink theseparticles: Why I Hate Going Out by Anonymous
About Privacy Terms Login Sign Up

http://deedy.quora.com/Hacking-into-the-Indian-Education-System

6/6/2013