SEB Windows v3.6.0 security improvements

[nvarghese-rm]

Hi

The latest release for v3.6.0 flags important security improvements from exploits discovered by students.

We are trying to assess how urgent the need may be to upgrade to the latest version. The release notes do not state or recommend that users upgrade to the latest version due to a significant vulnerability. We understand the recommendation is always to upgrade but we are having to balance this against packages we have already rolled out in a previous version, and having to redo those.

Are you able to advise if the security enhancements are of a critical nature or are the improvements more defensive improvements to reduce ease of known ways to exploit SEB?
Are these exploits from vulnerabilities introduced in a specific version?
Has the risk profile for vulnerabilities in SEB Windows significantly increased recently and these security improvements are needed to counter that?

Thanks

[menzies1990]

I also have the same question. @danschlet are you able to shed some light here?

[danschlet]

Is there a critical vulnerability? Hard to assess. Not a super-critical one I would say, but yes, cheating attempts with SEB have increased over the years so it's not a good idea to strictly stick with one SEB version for a whole year or one semester. If you have a deployment solution then it's best to do quick updates. If that's too time consuming maybe you're using the wrong deployment solution (just asking, I'm used to Mac solutions like Jamf Pro where it's a matter of minutes to do deployment updates)?

[danschlet]

Please study the Release Notes for version 3.6 and try to make this assessment for yourself. This would be a too lengthy discussion, which we can only offer to SEB Alliance Gold or higher members.
In general, if you're concerned about possibility of students cheating then you should update. Sorry that this involves work, but as previously discussed, we currently don't think it would be feasible to provide an auto update functionality in SEB (and would create new possible issues).
Note that there is a known issue with the new isolated (private) clipboard feature in SEB 3.6: Copy-Paste doesn't work between SEB browser windows (which isn't intended).

[Rapacioli]

Good afternoon. I would like to know how safe it is (how much fraud prevention is) when taking exams through SEB with manual configuration of Moodle 4.3 on students' devices (Mac, iPhone and Windows).
At the moment we note that it is possible to log in with the same user from another device, a fact that implies that the original user must, when he want to continue with his exam, log in again, but this does not remove him from the SEB or blocks the exam. From already thank you very much

[kabonKoda]

seb is just a browser ... its not going to help you manage student authentication ... you can configure moodle to prevent multiple authentication or ask your dev team to help manage multiple authentication