The VTEnviro Memorial 73.4k

[NJmike PE]

This is true

 

[akwooly]

Just gettin off work.

 

[NJmike PE]

Unless I get booted from the bed for snoring

 

[akwooly]

Now must drive. Can't be on phone.

 

[NJmike PE]

Then I could be on the couch and ready to spam

 

[akwooly]

Ha you too!?

 

[NJmike PE]

See ya

 

[NJmike PE]

54k and then quitting thyme

 

[akwooly]

Zombie spam

 

[Sapper PE LS]

What I did was log into NCEES and notice see both my most recent exam authorization and my last exam result from FS in 2010. I opened the FS result and just by chance noticed that the URL had a specific unique numerical identifier in it. On a hunch I opened the exam authorization and found a number with the same amount of digits in the URL of that, so on a whim I put the number from the authorization into the URL for results and bam a result letter popped up. It didn't say anything different than what was already available on the NCEES site, ie no actual result was shown, but it was kind if cool to see the result letter with the exam I had just taken. So anyway I thought it was neat and no big deal because nothing was really shared that wasn't supposed to be and so I posted how to do it in the results thread.

About 10 minutes later the little loophole had been closed and then I got an email from Tim @ NCEES ( director of exam services) saying he was disappointed, pointed out that such information publicly posted could lead to more malicious intentioned people finding more severe vulnerabilities and that even by cutting and pasting the stuff together it was still in violation of the user agreement with their site. He said they were considering the matter closed (implying that they weren't taking any action) and asked that I contact him directly in the future if I discovered any more such possible weaknesses and not post it publicly. I apologized and we're moving on.

 

[akwooly]

Truck needs car wah

 

[NJmike PE]

So had you not posted your findings then nothing would have happened. I get it

 

[NJmike PE]

Amazing at how quickly they caught on thougj

 

[NJmike PE]

Glad nothing came of it

 

[Sapper PE LS]

Yeah it was more about sharing the potential weakness, which yeah, I understand wasn't the most professional thing to do. I'm an imperfect man.

 

[NJmike PE]

We all do stupid things. I think they realized that too

 

[NJmike PE]

Sounds like it, away way

 

[NJmike PE]

So if engineering doesn't work out, I'm thinking of a hot dog truck

 

[NJmike PE]

Simple

 

[Sapper PE LS]

Yeah, well it helps that I've been an admin on this site for almost a decade and they know that I'm not trying to undermine exam security. So, it was a slap on the wrist that I deserved and if nothing else showed a whole new batch of test takers that NCEES does monitor this site and doesn't mess around.