Project Status

[gucci-on-fleek]

(TL;DR: Respondus's internal bug tracker has linked to this repository, suggesting that the Lockdown Browser will soon be updated to prevent this tool from working.)

Project Status

Background

Back when COVID first hit, some of my professors began to mandate that we use Respondus Lockdown Browser and Respondus Monitor to write our exams. I was incensed that we were required to install this invasive software on our personal computers and submit to being recorded by some random company, with no option to opt-out. I argued with my professors that this requirement was both unnecessary and unethical, but they refused to budge.

I proceeded to submit a formal complaint to the administration, and after a protracted series of emails, they eventually offered an alternative, and having no other options, I accepted. But this alternate writing method was fairly arduous: before each exam, I would drive to the campus, check out a laptop, and drive back home. On my personal laptop, I would start a video call with my professor who would watch me while I wrote the exam; on the campus laptop, I would use the Lockdown Browser (without Monitor) to take the exam. Once I was finished, I would drive back to campus to return the laptop. And furthermore, I was the only student who was allowed to use this method—everyone else was still required to use Respondus Monitor.

Development

So then why did I decide to write this project?

1. To show that the Browser is ineffective.

   All of my complaints were ignored because the university considers “preventing cheating” to be more important than the privacy of its students. But if the Browser were shown as being completely useless, then the university would have no reason to continue using it.

2. Help honest students protect their privacy.

   Not all students were as lucky as I was to be offered an alternative writing method. I released this project to help the students who legitimately care about their privacy to partially alleviate some of the Browser's flaws.

   Of course, it is certainly possible to use this project to cheat on exams, but you could say that about nearly any technology. The mere possibility of cheating is not a valid reason to invade the privacy of every student.

Present Day

Four years ago, I started this project. It has now been three years since I transferred to a different university that does not use any invasive monitoring software, and two years since I have had any access to a computer that runs Windows.

What does this mean for the project? It means that I have little motivation or ability to make any significant updates to it. I do try to reply to issues and discussions whenever possible, but I've been quite slow at responding for this past year since I've been busy with other things. I tend to respond quicker to pull requests though.

Future

So why am I posting this update now? Well, the project has recently jumped in popularity:

Which has likely lead to this:

respondus2.com is an official Respondus domain, and Trac is bug tracking software. This repository being linked to from an internal Respondus bug tracker suggests that the Browser will soon be updated to prevent this project from working.

So what comes next? Well, it's up to you. If you're able to find a way to patch around the Browser's upcoming update, then submit a pull request. Otherwise, you'll need to wait for someone else to do so.

Links

• “Federal Judge: Invasive Online Proctoring "Room Scans" Are Unconstitutional”, EFF

• “After Students Challenged Proctoring Software, French Court Slaps TestWe App With a Suspension”, EFF

• “A Long Overdue Reckoning For Online Proctoring Companies May Finally Be Here”, EFF

• “The Security Failures of Online Exam Proctoring”, Schneier on Security

• “The extremely shady "educational integrity" industry”, Cory Doctorow

• “The pandemic showed remote proctoring to be worse than useless”, Cory Doctorow

• “Can You Trust Your Computer?”, Richard Stallman

• “The Right to Read”, Richard Stallman

[ericswpark]

@gucci-on-fleek have you ever looked into running LDB on something like QEMU or VirtualBox? I gave it a shot last weekend but failed, probably due to LDB recognizing the QEMU device names which apparently cannot be changed without applying patches to the QEMU source and recompiling. Seems like it should be doable though as one comment I came across said that LDB only checks for the device name stuff and what not, and doesn't go as deep as RDTSC checking as checked by pafish. Any idea if this will be more resilient against Respondus potentially patching it out down the line?

EDIT: this should also hopefully help with the alt-tab/minimize issues mentioned here: #54

[gucci-on-fleek]

probably due to LDB recognizing the QEMU device names

Yeah, that's why I used the Windows Sandbox in the first place, since it looks almost identical to a real installation.

which apparently cannot be changed without applying patches to the QEMU source and recompiling

Try just deleting the driver files then removing the device from “Device Manager”. Deleting the driver files shouldn't affect any drivers that are already loaded, and removing the device from “Device Manager” shouldn't actually unload the drivers for anything important. That's kinda what I'm doing right now inside the Sandbox:

lockdown-browser/runtime_directory/sandbox_run.ps1

Lines 17 to 24 in 7248e29

	Get-ChildItem -Path "HKLM:\HARDWARE\DESCRIPTION" | Remove-ItemProperty -Name SystemBiosVersion -ErrorAction Ignore
	rm HKLM:\HARDWARE\DESCRIPTION\System\BIOS -ErrorAction Ignore
	# We're in a short-lived VM, so we can safely delete any necessary files
	$vmcompute_path = "C:\Windows\System32\VmComputeAgent.exe"
	takeown /f $vmcompute_path
	icacls $vmcompute_path /grant "Everyone:(D)"
	rm $vmcompute_path

Take a snapshot first though, since the machine might not boot afterwards.

without applying patches to the QEMU source and recompiling

Which might actually be really easy, depending on how good/awful their build tooling is. The only tricky thing would be if the Windows drivers are digitally signed, because then recompiling would be impossible.

have you ever looked into running LDB on something like QEMU or VirtualBox

If I were to try running the Browser again, I'd probably try running a regular Windows installation inside KVM/QEMU, then running the Windows Sandbox inside of that. Nested virtualisation used to be pretty painful if not impossible, but I've heard that it works reasonably well on modern hardware.

Any idea if this will be more resilient against Respondus potentially patching it out down the line?

Probably less resilient, since VirtualBox and QEMU leave way more evidence than the Windows Sandbox does. Starting with Windows 11, the entire base Windows installation is virtualized by default, so a blind “is this system virtualized” check would be useless.

But possibly more resilient, since it's possible to modify the VirtualBox/QEMU source to directly rename any of the obvious references. It's not really possible to modify the Hyper-V/Windows Sandbox source.

[ericswpark]

@gucci-on-fleek so I realized that the first lockout only checks the device names, and managed to proceed further by just using regedit (see my blog post here: https://ericswpark.com/blog/2024/2024-02-20-i-hate-lockdown-browser/). However, the second lockout with the stupid "virtual moose" thing shows up during the exam, and I'm guessing it relies on some other VM detection technique. Maybe someone might find a workaround with the QEMU XML changes I documented but these ones are really basic and I have no idea how much more changes are required.

[gucci-on-fleek]

Huh, I've screwed with the Lockdown Browser quite a bit and I've never seen that moose before. Must be a (somewhat) recent addition. I've also never seen it do any sort of detection after it's completed the startup process either, so I'm a little surprised.

Provided that you have somewhat recent hardware, you can try running the Windows Sandbox inside KVM/QEMU. Here's a random guide on enabling nested virtualization. I'm not sure whether running two VMs will cancel each other out or just make it more prominent, but it should be fairly easy to enable, so it's worth a try.

And if you're trying to figure out how the Lockdown Browser is detecting that it's in a VM, I used Process Monitor and Detours traceapi. There's a lot of output though, so you kinda need to know what you're looking for first.

Another option would be to try a macOS VM. To make macOS boot on non-Apple hardware, you already have to trick it into thinking that it's booting on genuine Mac hardware, so in theory, there should be nothing for the Lockdown Browser to detect. No experience with this, but Googling macos kvm gives tons of results.

[carrie-leigh-221]

I'm not a programmer by any means, but love your project. It took me a few hours to get up a running, but it has worked flawlessly for about a year now. I don't have the ability to work around any future updates to LDB, but could potentially sponsor someone else's efforts should this current method fail.

[ericswpark]

Honestly, if you are willing to pay, I would recommend grabbing a used laptop from eBay or a used marketplace and using that for the semester. Any software-based workarounds run the risk of detection. Sure, it's a bit wasteful, but if your institution refuses to change policy then it's the only reliable option. Plus, you could even sell it after the semester is over.

Alternatively, try asking your instructor if the requirement can be removed. One of my professors actually got rid of the LDB requirement! You might be pleasantly surprised, just ask :)

[carrie-leigh-221]

I'm not following -- what would a used laptop from eBay solve? I'm sorry, I feel like there's something very obvious that I'm missing here.

[ericswpark]

My suggestion was to use some sort of burner laptop as the primary way of running LDB. That way it stays separate from your main machine and can't touch your files or mess up your computer.

[gucci-on-fleek]

Please open a new issue for this.

^{(Although I would guess that the problem is that you didn't install the Visual Studio C++ Tools properly.)}

[kiwi08522]

[carrie-leigh-221]

I can confirm it's still working on my setup as of today.

[gucci-on-fleek]

Is this solution still effective?

Probably. trac.respondus2.com aged out off the “Referring sites” list after 2 weeks, without any additional views ever showing up. There was maybe a Browser update right after their referrer showed up, but it was maybe well before this. I haven't heard any complaints recently about it not working (well, aside from the constant influx from people who don't follow the instructions properly), so it's probably still fine.

[FIM43-Redeye]

Honestly, while I'm quite incompetent myself, I would assume that it's entirely possible that using Windows Sandbox to do the magic could put Respondus directly at odds with Microsoft, and incurring their active wrath for bypassing their own security policies in a way far more obviously a rootkit could be far more trouble than it's worth.

[gucci-on-fleek]

@FIM43-Redeye

I would assume that it's entirely possible that using Windows Sandbox to do the magic could put Respondus directly at odds with Microsoft, and incurring their active wrath for bypassing their own security policies in a way far more obviously a rootkit could be far more trouble than it's worth.

I doubt that Microsoft really cares what the Lockdown Browser is trying to do. As long as the Browser is just trying to detect if it's running inside the Windows Sandbox or not, then as far as Microsoft is concerned, that's the program's business and not theirs. And if the Browser somehow succeeded at escaping the Sandbox (which it isn't even trying to do), then they'd get $250 000.

In general, I can think of 3 scenarios where Microsoft would care what your program does.

1. Using unsupported internal interfaces.

   Microsoft doesn't like it if you use undocumented internal Windows interfaces, and the Browser definitely does this in a few places. But the worst that can come of this is that Raymond Chen makes fun of you (1, 2, 3) and the interface is removed.

2. You're writing a kernel driver.

   If you're writing a kernel driver, then you can't run it unless it's signed by Microsoft. For Microsoft to sign your driver, you need to follow a very specific set of rules, and if you break the rules, then they'll refuse to sign your drivers and potentially revoke/disable your older ones. But the Browser doesn't load any drivers (kernel or otherwise), so this doesn't apply.

3. You're writing malware.

   Windows Defender will remove any programs that it considers to be malware or a PUA (potentially unwanted application). Looking at the categories of malware and PUAs, the Browser might fall under “lack of control” or “poor removal experience”. However, Microsoft has their own locked-down browser, and given their history with suppressing alternative browsers, they would be very reluctant to have Windows Defender remove the Lockdown Browser.

So as disappointing as it is, Microsoft is unlikely to block or otherwise inhibit the Lockdown Browser.

[FIM43-Redeye]

Hey, just so you all know, it happened. Respondus got around to it. No longer safe.

[carrie-leigh-221]

Pardon me, I'm kind of dumb. Does this answer your question?

[kiwi08522]

Yes it does, thank you. Your version is a bit more 'outdated' than mine, I'm on 2-1-2-02, and the person who posted this is on 2-1-2-04, so I'm wondering if updating to the newest version would make it not work anymore. I have no idea if the LDB installer pulls updates automatically, but if it doesn't, it should still be confirmed to work at 2-1-2-02 and would always work as long as you don't get a new installer.

Respondus says:
Version 2.1.2.04, 3-14-24
Improvements to security
Version 2.1.2.03, 2-16-24
Hotfix for a startup issue that was affecting some Windows computers
Version 2.1.2.02, 1-30-24
Added Canvas Classic support for ReadSpeaker TextAid
Improvements to security
Version 2.1.2.01, 12-19-23
Fixed a screen recording issue introduced in the previous release

It seems to me, since it's still working for you, that it will continue to work for anyone who has an installer before 2.1.2.02, which I am on. I am not sure about 2.1.2.03. But the Lockdown installations are linked to your school so it will be hard for anyone to get an installer that is on a specific version unless they can find someone at their school who will give them the file and hope that person has the installer still saved.

[carrie-leigh-221]

@kiwi08522 any idea how to make LDB not auto update? If I run 2.1.2.02, it auto updates to 2.1.2.04, which detects the VM.

[bluesangheili]

The ban may be done by your institutional account, as I tried it on two entirely different computers. I am very screwed unless I figure out a way out of this.

[ThunderRuler]

@kiwi08522 any idea how to make LDB not auto update? If I run 2.1.2.02, it auto updates to 2.1.2.04, which detects the VM.

I would also like to know