Intel's 12th Gen CPU Can't Handle the Bar Exam - Slashdot

Posted by msmash

• ›

  And once again, legitimate users get screwed over by terribly written anti cheat software.

  It's getting a tired refrain by this point, but in this case they don't even have the option of just sailing the seven seas for it.

  • Yes, the title really should have been reversed: "Bar Exam Software Can't Handle Intel's 12th Gen CPU".

    But I guess "Company You Never Heard of Screws Up" doesn't get as many clicks as "Tech Giant Screws Up".

    • Yes, the title really should have been reversed: "Bar Exam Software Can't Handle Intel's 12th Gen CPU".

      But I guess "Company You Never Heard of Screws Up" doesn't get as many clicks as "Tech Giant Screws Up".

      Hey, I know! Let's piss off a ton of future lawyers by putting their livelihood at risk!

      What could possibly go wrong??

      • what are they gonna do, shoot up the place?

        Sounds to me like they're potentially pissing off a bunch of wannabe lawyers who can't take the bar exam.
        The actual lawyers won't give a fuck.

        • Re: what are they gonna do, shoot up the place?

          Probably will give a positive fuck, since less Bar Exam passes means less competition. On a technical level, what is the 12th gen doing differently from its predecessors?
          • 1 hidden comment

          • Re:

            I think it has to do with the "thread director". Basically it is a behind the scenes movement of threads from core to another in 12th gen chips.

            In older processors, if you run on bare metal, a thread would be only moved from core to another by the operating system. But if you run something in a virtual machine, the VM host software might also do strange manipulations to load balance between VM guests.

            Thus I guess the poorly written software is triggered by the thread director and thinks it is a VM host doin

          • Re:

            It monitors and analyzes the currently running processes and distributes them between "Performance" and "Efficiency" cores.

            • Re: what are they gonna do, shoot up the place?

              Sounds like the cheat software needs to go away. Besides, what is wrong with VMs? Nothing. Especially if it is a windows app running within a Mac ala parallels

        • Re:

          Those that do pass the Bar Exam despite of the unnecessary and unrelated obstacles put into their way by Examplify, may do so while harboring some resentment towards Examplify.

  • Re:

    What I notice is that many exams do not leverage the expanded assessment opportunities of computers. Like the time when people wrote memos in spreadsheet, and that was all they knew, testing is just a matter of copying multiple guess questions to the computer. As it multiple guess tests are becoming intractable to administer and keep secure. If we want to test on computers, we must develop methods that are not from the 1900s.

• If hardware manufacturers make it impossible to determine if a system is running as a VM, software makers like these won't be able to place restrictions on software based on it being on a VM or not. This is a good thing as virtualization shouldn't be discouraged.

  • Re:

    Maybe we should not only include an Evil Bit, but also a Cheat Register.
  • This is actually really important for anti-virus / anti-malware research and protection. Software shouldn't know if it's in a VM or not. Typically software only knows it's in a VM by using hacks such as detecting the video card and such and isn't reliable anyway.

    • Re:

      Why wouldn't a virus want to infect a virtual machine?

      • A virus would want to infect a virtual machine. The ability to detect being in a virtual machine (or not) is an information leakage that is useful for an adversary.

      • Re:

        Since so many things run in VMs these days, I'd guess it's less prevalent, but once upon a time the purpose of VM detection in malware was to prevent running in sandboxes or on honeypots so as to avoid detection/analysis.

      • Re:

        One reason is that researchers use VMs to analyse malware. Much like Volkswagen if you suspect you're being tested, best not to use the normal profile and get caught, better to act differently and throw off the people doing the testing.

      • Some try to avoid running in a debugging environment which is also a virtual machine environment. They don't want security researchers to be able to watch it in action and develop countermeasures.

        Notably, an early virtualization technique in Linux utilized the ptrace system calls intended for debugging to run a Linux kernel as a user mode program in Linux.

  • Re:

    Hardware manufacturers can't prevent someone from detecting whether a machine is virtual. Virtual machines are decoupled from actual hardware, which is the whole point. If you examine the "hardware" in any virtual machine you can plainly see that's it's virtual hardware, not physical. This is particularly obvious with things like graphics adapters and disks. You will see drivers for VMware, or Hyper-V, or whatever flavor of hypervisor is used.

    • Re:

      Devices which are specific to the hypervisor are used because it performs better, but it's not essential. Hypervisors are perfectly capable of presenting simulations of actual hardware, and they do this for compatibility purposes (eg to install an os that doesn't have specific drivers for the hypervisor).
      You can also pass through real devices from the host, so you could have a virtual machine with access to a real GPU.

      • Re:

        Yes, there is support for passing through actual hardware devices, but there are limitations, especially on Hyper-V. The bottom line is that you're never going to see a VM with zero virtual devices. At that point it would no longer be a VM.

      • Re:

        Not disagreeing with you, but it becomes an arms race: those trying to obscure virtualization have physical possession of the hardware. Those trying to detect virtualization have timing attacks, fingerprinting, possibly TPM/secure boot/remote attestation, and first mover advantage.

    • Re:

      They're doing a good enough job of it that the cheat detection has to rely on unreliable heuristics rather than a deterministic test in order to decide if it's running in a VM. And TFA shows that it sometimes gets it wrong.

      It got it wrong because they don't actually test for a VM, they test a handful of quirks and hit the tilt switch if the quirks don't match a known hardware CPU.

      For their next trick, I suppose they'll dispense with all those questions and just examine the lines on your feet and the bumps o

      • Re:

        This likely has to do with where they're testing from, and with what level of access, rather than anything intrinsic about detecting virtualization.

        On another note, why would they give a shit whether your computer is virtual or not? In what way does being on a VM enable cheating on a test?

  • Re:

    VM shouldn't be identifiable. What's the use of a virtual machine if it doesn't emulate the machine correctly?

    • Re:

      It's probably not the machine.

      You can bet the graphics driver is called "Oracle(TM) Virtual Graphics Driver(R)" or something lame like that.

  • How does one check for a virtual machine?

    What are the principles? And examples of how the check is carried out?

    • Re:

      What are the principles? And examples of how the check is carried out?

      Many ways.

      1) Check for presence of nonsensical hardware - e.g., an Intel 440BX chipset with an AMD CPU. Or a 440BX chipset with anything newer than a Pentium III.

      2) Test the "guest additions" interface. All VM software has support for guest additions to do quality of life things like mouse integration, display resizing and other things (like memory management - the VMWare "balloon" driver that allows a VM to give up memory when the hyperv

• • Re:

    Correction: fewer licensed lawyers, more armchair lawyers that are actually OK.

• • 1 hidden comment

  • Re:

    Exactly. How the heck do they allow such high stakes tests to be taken at home / on users own machines?! It seems like cheating would be relatively easy Examify or not. Unless they maybe they require like 3 or 4 streams of video and audio from multiple angles streamed in realtime and analyzed closely for communication.
    (but even so... could you really detect it? a hidden camera pointed at the screen would be very hard to detect afaik. As would e.g. a vibration based device on the body to at th

    • Re:

      It's not offered at home. The issue is that the bar exam is typically only offered in a couple of locations and only twice a year statewide. When I took the New York bar exam, it was literally thousands of people taking it at once in a giant conference center. No test center has the hardware to do such mass proctoring.

• So I'm guessing this what I heard about months ago, where it has regular and low-power cores, and the software freaks out when it runs on a different type of core? I think the only surprising part is how long the problem has been known, but stuff is still tripping over it.

• I recently got a new ThinkPad X1 Yoga (Gen 7, w/ 12th gen cpu). I was having issues with VMware Workstation and VirtualBox both thinking I was running in a hypervisor. msinfo32 and systeminfo showed that Virtualization Based Security was enabled, and that a hypervisor was detected.

  I tried all the usual methods of disabling them. Hyper-V wasn't installed and VBS was disabled through the group policy. Nothing worked and the system kept insisting it was running in a hypervisor.

  I then discovered that "Firmware Protection" under "Core Isolation" in Defender Device Security was using a relatively new feature called "Defender System Guard" which seems to also enable Virtualization Based Security, even though it may be disabled via other means. Once I turned this off, VBS was disabled and the system no longer detected a hypervisor. Workstation and VirtualBox then both ran normally.

  My pervious system was a C940 w/ 11th gen CPU, but more of a consumer model, and it did not have the same security features. Not sure if this was due to the 12th gen chip, or the system being a more business focused ThinkPad. Either way, I wonder if the Bar exam software is using the same check and if that feature is enabled, simply disabling it would get it to work. Not that I endorse such a check for anti-cheat.

• • I think "testing software not updated for new processors" would be a more accurate and informative headline.

• For sale, is one well-used 486 desktop with a 3dfx voodoo card and a 50MB hard drive. It also has a 3.5" floppy. Perfect for bar exams! It comes with Windows 3.1 as an added bonus!

  $250K OBO

  • Re:

    Best I can do is tree-fiddy.

  • Re:

    Ah, but the testing software also requires Windows 10 or 11. So you need a laptop new enough to run Windows 10, but not so new that it won't run the bar exam software. This is a perfect test of how do deal with the illogical roadblocks that the real world puts in your way:-)

    • Re:

      Ok, so $249,999 then.

  • Voodo 3 3500 with TV in/out

    Mine is the one with a Voodo 3 3500 with TV in/out!
• Ignoring the browser, any reasonable "anti-cheat" or "proctoring" software should have to run on all modern POSIX compliant Operating Systems, without the need for platform locking or platform regulation based detection. Reading the Examplify Requirements, it's shocking that anyone could pick that software thinking it meets the needs of both the users and the administrators trying to run the testing!
  
  This seems to be another classic case of bad software dictating the landscape, over the software being forc
  • 1 hidden comment

  • "proctoring" software may need be in an test cente

    "proctoring" software may need be in an test center with locked down VM images and software that WILL run in that VM.

    • Re:

      Sure, that's a good solution to me.

  • Re:

    Is Linux even POSIX compliant?

    • Re:

      It wasn't. Unless they've changed the specs it still isn't. Still, it's "close enough" for almost any reasonable purpose. Not, however, close enough for the difference to be undetectable. (Well, *I* couldn't detect it, because I've forgotten what the difference was.

      Just a second... https://unix.stackexchange.com... [stackexchange.com]

      So I guess the answer is, "Linux isn't necessarily POSIX compliant, but it can be.".

      • Re:

        I recall there being a difference with pipes, something about blocking in a case where posix defines it shouldnt....

        • Re:

          Na. POSIX is very lenient.
          Linux does not strive to be POSIX compliant, but it can be is the correct answer.
          
          POSIX compliance isn't really worth that much. The actual spec is a fucking disaster. What you really want to aim for is what Linux aims for- POSIX-like.
          I.e., you're using the primitives that a POSIX programmer with some experience is used to, but you're not constrained to some of the idiotic ambiguities in POSIX.

    • Re:

      It's close to being POSIX without being certified (unless that recently changed), and again except in limited circumstance where some distro's do have POSIX certification. If a software is written with POSIX compliance in mind, it will run on all major Linux Distro's that I'm aware of, certainly Fedora, Debian, Ubuntu, Mint, PopOS, Arch, Gentoo, etc....
      
      Instead of mentioning Windows 7,8,10,11, Mac OS X (blah), Android, iOS (is that what it's called?), just implement against the standard interface, and then

  • Re:

    "Don't pick tools which can't run on Windows, Mac or Linux!"

    I'm curious, what OS are you using?

    • Re:

      Right now:
      
      Work Dev Computer: Pop!_OS 22.04 LTS
      Personal Dev Computer: Fedora 35:
      Personal Non-Dev Computer: Fedora 35 / Gentoo (because I wanted to).
      Server 1: Debian 11 Stable
      Server 2: Debian 11 Stable.
      NAS: Ubuntu Server 20.04 (I think)

    • Re:

      MVS for life, bruh! http://www.hercules-390.org/ [hercules-390.org]

• by groobly ( 6155920 ) on Thursday July 14, 2022 @12:41PM (#62702644)

  Actually, no, it's the crappy software that can't handle a new cpu.

• Say in your best Jack Nickelson voice.

  • 1 hidden comment
• ... let's kill all the lawyer exams!

• I took the bar exam over 10 years ago, but Examsoft was a nightmare back then too.

  My year, there were a non insignificant percentage who failed or could not complete the bar exam over that POS. Keep in mind that the exam is only offered twice a year, and failing effectively prevents you from working for an entire 6 months, so this is a pretty high stakes piece of software. Back then, there was the option to hand-write, but the exam is so time limited that being able to type is a huge competitive advantage.

  • 1 hidden comment

  • • Re:

      I'm sure it's possible to do it handwritten, but there's no way I would have completed the essays in the allotted time if I had been handwriting. Plus, my handwriting is illegible, even more so when I'm in a hurry. Just have terrible fine motor coordination. I literally received zero credit the first time I took the SAT II writing section because the grader could not read my hand writing.

• They've had eight months to test Alder Lake. Did they fire the guy who could add a new CPU check to the code?

  It should have been an x.x.1 update, not a press release.

  So why?

  • Re:

    Here's why. I have lots of friends who are lawyers. I'm an IT guy.
    
    Lawyers don't understand computers at all. I mean not at all. For God's sake, the US legal professional used Word Perfect until not that long ago because nobody was smart enough to figure out how to use anything else. No joke there. Word Perfect has been singlehandedly kept in business by American lawyers since the beginning. And you probably either never heard of it or remember it from so far long ago that you thought that

    • Re:

      You must work for a court, your words are so true. I'm flabbergasted that in 2022 we have clerks, courtroom deputies, and judges still banging out documents with WP. I have intimate knowledge of this because the fed court i work for is full of PCs running WP.

• If it was good enough for grandpa, it should be good enough for me!

  This just in: "Back in my day, we didn't have to sit for a bar exam, or even go to law school to practice law." -- ghost of one of Abe Lincoln's contemporaries

• Looks like the bar has been raised...

  It is literally the name behind the term.

• This isn't Intel or Microsoft's fault, they just didn't update their own "security check" nonsense to play nicely with modern hardware. These processors aren't that new. This shouldn't be a thing.