SEB/moodle cheating and user logs

[DaanBLD]

Hello,

In our school we're using the Safe Exam Browser in combination with moodle for testing. Recently we've had some suspicions about cheating. We suspect that some students use a VM to bypass the SEB. I've been trying to find a way to prove this, and I've noticed that the moodle logs show that for a not-suspected student an automatic save of the test and corresponding log is being made every 1-2 minutes during the entire time they are working. The students that we do suspect to be cheating show gaps in their autosaves of up to 10 minutes.

Our hypothesis is that this can be explained by them switching away from their VM during that time, that the VM during the switch loses internet connection and that moodle therefore can't autosave and shows gaps in the logs.

Are we on the right track here? Do the gaps in the logs indeed show that there is something wrong happening?

[danschlet]

Hi,

This is an interesting case. I forwarded this question to our Moodle specialists, maybe they can answer if the autosave gaps would indicate a missing internet connection.

Do you know which SEB version (for Windows or macOS/iOS?) the suspected students were using? We had reports that the VM detection at least since SEB 3.5 cannot be circumvented anymore without patching SEB itself. Are these exams being taken on-site and could you in the next exam check if students use an unmodified SEB version using the SEB Verificator (Windows/Mac)?

Given the long gaps in the autosave log events, could increased attention by proctors potentially help to uncover cheating attempts?

[DaanBLD]

Hi,

Thanks for your reply. I'm curious to hear what the Moodle specialists have to say!

I don't (yet) know what version they were using as I haven't talked to the students yet. Our students bring their own devices, and usually those are windows devices. We try to ensure that students have the latest version, however some students don't update and/or are able to find a cracked/patched version of SEB. The tool looks very interesting, I'll use it to check if they use/have used an unmodified version.

Based on this situation we are already thinking about ways for the proctors to easily check if everything seems to be in order. My question is mainly so that we could potentially prove cheating afterwards, in case the student isn't caught in the act.