August 27, 2023
|
5 min read
The US Department of Education's Privacy Technical Assistance Center has documented how data breaches and malware attacks have affected education systems across every sector. Most online proctoring services require browser extensions or plugins that create exactly the kind of installation-based malware vector that security researchers flag as high risk. This post examines the threat, what organizations should require from their proctoring vendors, and why a no-installation approach eliminates the risk at the source.

The US Department of Education's Privacy Technical Assistance Center published a presentation titled Security Threats: Education Systems in the Crosshairs, in which security advisor Mike Tassey documented how data breaches, hacks, and privacy incidents have affected organizations across virtually every sector, from NASA and Citigroup to local school systems.
The warning is directly relevant to any organization using online proctoring. The data that proctoring services collect, including names, government-issued ID, biometric images, and session recordings, is exactly the kind of information that makes education systems a target.
Cyber-theft has become fully commoditized. There is an active black market for personal data, and an underground economy where over two million pieces of malware are built and sold every year. This malware is designed to gather precisely the kind of information proctoring platforms collect: Social Security numbers, addresses, birth dates, and identity credentials.
Tassey specifically noted that children's identities are particularly valued by data thieves because they are, in his words, fresh. A child's identity may go undetected for years before the theft is discovered, making it a high-value target for long-term fraud.
The alarming part is how malware typically gets onto devices. It is not usually through pirated software or poor security settings. It enters through plugins and browser extensions that users install themselves, often for legitimate purposes. The installation is the vector.
Most online proctoring services require users to install browser extensions or plugins to enable monitoring. Each of these installations represents an opportunity for malware to enter the device, either during the initial installation or through a subsequent update, without the user's knowledge or permission.
Tassey's research notes that on average there are one to five bugs for every 1,000 lines of code. For organizations that have not completed independent code reviews of the proctoring software they deploy, those bugs represent an unexamined attack surface. Malware can be introduced into code updates without detection, meaning a plugin that was clean at installation may not remain so.
At minimum, organizations should be instructing learners to disable or uninstall proctoring plugins and extensions immediately after use. The risk does not end when the exam does.
Organizations that require learners to install proctoring software should conduct, or require their vendor to provide evidence of, a code review that addresses:
If a vendor cannot provide clear answers to these questions, the software should not be deployed on learner devices.
The most effective way to eliminate installation-based security risk is to remove the installation requirement entirely. Integrity Advocate's platform is browser-based and requires no plugin, extension, or application installation in most cases. There is nothing to install, nothing running in the background after the session ends, and no update mechanism that could introduce malware without the user's knowledge.
For use cases that do require a lockdown browser, Integrity Advocate's solution uses fully open source code, does not accept automatic updates after installation, and does not transmit data beyond what is required for the session. The code is publicly available for inspection.
The US Department of Education's guidance on protecting student privacy points to the same principle: the safest data handling approach minimizes what is collected, minimizes how long it is retained, and minimizes the software footprint on learner devices.
{{post-cta}}
Find answers to the most commonly asked questions from our clients.
Browser extensions and plugins require installation on the learner's device, which creates an opportunity for malware to enter during installation or through subsequent updates. Security research cited by the US Department of Education's Privacy Technical Assistance Center indicates that there are one to five bugs for every 1,000 lines of code on average, meaning unreviewed proctoring software may contain vulnerabilities that can be exploited without the user's knowledge.
Malware can be embedded in the original plugin code or introduced through an automatic update pushed after installation. Because most users do not conduct code reviews of the software they install, and because updates often occur silently in the background, the malware may be present for an extended period before it is detected.
Security advisor Mike Tassey, in a presentation made available by the US Department of Education's Privacy Technical Assistance Center, noted that data thieves place particular value on children's identities because they are unused. A child's credit history is clean, and identity theft may go undetected for years, making it highly valuable for long-term fraud.
A code review is an independent examination of software code to identify bugs, vulnerabilities, and potential malware. For proctoring plugins and extensions, a code review should assess what data the software collects and transmits, whether automatic updates could introduce malicious code, and whether any existing vulnerabilities could be exploited by third parties. Organizations that deploy proctoring software without a code review are accepting an unexamined level of security risk.
Integrity Advocate's platform is browser-based and requires no plugin, extension, or application to run.