Hidden in plain sight: five ways a LAN-based exam leaks
Most public argument about exam security is about people — invigilators, candidates, phones smuggled past a metal detector. Meanwhile, in a great many computer-based test centres, the question paper spends the morning in readable form on a server, and travels to the desks over a local network that the examination body does not own, did not build and cannot watch. Five well-documented techniques take the paper off that network. Not one of them breaks encryption. Not one of them needs what most people would call a hacker.
In short
- LAN-based computer-based testing (CBT) puts the paper in readable form on hardware the exam body does not control.
- Five techniques defeat it. Two attack the courier media, two are ordinary administrative features of the centre’s own switch, and one is a piece of passive hardware.
- Two of them leave the original media byte-for-byte unchanged, so a physical inspection passes and a checksum still matches.
- A passive network tap has no MAC address and no IP address. It cannot be found by scanning the network — only by physically following the cable.
- Every counter-measure is a procedure a person must perform correctly on exam morning. That is the whole problem.
- In May 2026 the Staff Selection Commission shut down terminals during a 46-lakh-candidate exam because they were under attack. Doing so removed the seats it needed — and the overcrowding, cancelled shifts and protests followed from that.
Where the paper actually goes
The standard architecture is a chain. Papers are prepared on a confidential server. They are carried to the centre on removable media by a person. They are loaded onto an exam server in the centre. From there they cross a managed switch to the candidate terminals, where — necessarily — they become readable. Each link in that chain is a place to stand.
USB courier
managed switch
cable run
Where each technique sits on the path. The numbers match the five below.
The five
The hidden partition
An operating system does not scan a disk to find out what is on it. It reads the partition table and enumerates what that table declares. Sectors no entry claims — a gap between partitions, or unallocated space past the last one — are invisible to every ordinary tool: the file manager, the directory listing, the antivirus scan, a checksum taken over the visible volume. Data copied there is recoverable, but only by imaging the raw device. A courier drive carrying a second copy of the paper in that space looks, to anyone who plugs it in, completely clean.
The palm-sized duplicator
Standalone drive duplicators are legal, cheap and about the size of a paperback. They need no computer and no drivers: two sockets, one button, and a sector-by-sector copy at hardware speed. Two consequences matter here. First, the window needed is minutes, not hours. Second — and this is the part usually missed — sector-by-sector means it copies the unallocated space too. Technique 02 silently carries away technique 01. And because the read is non-destructive, the original media goes on to the exam server unaltered, still matching whatever hash was recorded for it.
None of these five breaks the encryption. Each of them simply waits at a point where the paper has to be readable.
Malicious port mirroring
Every managed switch can mirror one port’s traffic to another — SPAN, in the usual vendor language. It exists for legitimate diagnostics, and network staff use it routinely. Someone with administrative access to the switch can mirror the exam server’s port to a spare port and attach a listener. From the network’s point of view nothing has happened: no new device announces itself, no traffic pattern changes, no alarm has a reason to fire. The copy delivered to the spare port is complete. This is not an exploit of a flaw — it is the feature working exactly as designed, pointed the wrong way.
Access-control list misconfiguration
Port security and access-control lists are, in the end, lists that a human being maintains. Adding one hardware address to an allow-list, or opening one path between network segments, is a single line of configuration and is indistinguishable from routine maintenance in the logs. There is no malware to detect and no intrusion to trace, because the access granted is authorised. The only defence is that somebody notices the line, later, and asks why it is there.
The silent tap
A passive network tap is inserted into the cable run and copies the signal to a third port. It is not a computer on the network; it is a component of the wire. It has no MAC address and no IP address, it answers nothing, and a passive tap does not even drop the link if it loses power. This is precisely why taps are the preferred instrument for regulated monitoring in banking and defence — they add no addressable device to the link being watched. The same property makes one undiscoverable by any network scan. It can only be found by physically walking the cable.
What the five have in common
Look at the counter-measures rather than the attacks. Seal the exam session the moment it ends. Inspect and hash the courier media. Audit the switch configuration before and after. Walk the cable runs. Keep the server physically isolated from any network.
Every one of those is a procedure, performed by a person, on the morning of an exam, under time pressure, in a building the examination body visits once a year. The security of the paper is not a property of the system. It is a property of somebody’s diligence — and diligence is not a thing that can be audited in advance or proved afterwards.
This is not hypothetical
In December 2024 the Central Bureau of Investigation registered four First Information Reports naming ten railway officials over computer-based departmental promotion examinations conducted in Western Railway. The allegation, which remains under investigation and is not proven, is that results were digitally manipulated after the examinations had concluded. Reporting on the case describes what forensic checks are said to have found: exam sessions left open for two days rather than sealed at the end, remote-access software installed on the systems in that window, gaps in the digital audit trail — and internet connectivity still active on the exam server despite rules requiring its complete isolation.
The rule requiring complete isolation of the server already existed. What failed was the enforcement of it.
It is not an isolated pattern. The CBI’s investigation into the 2021 JEE (Main) examination centred on candidates’ papers being solved remotely from a chosen examination centre, with the examination platform itself alleged to have been tampered with. Different technique, same shape: the architecture allowed a path, and a procedure was supposed to close it.
May 2026: when the defence became the disruption
The clearest illustration arrived while this argument was being written. The Staff Selection Commission’s General Duty Constable recruitment for 2026 — roughly 46 lakh candidates, run in three shifts a day from 30 April to 31 May — broke down at several centres in the last week of May. Shifts were cancelled in Prayagraj, Kanpur and Gorakhpur in Uttar Pradesh and in Muzaffarpur in Bihar. At the Prayagraj centre about 450 of the 600 allotted candidates were present when the server failed; computers and furniture were damaged and the Prayagraj–Varanasi highway was blocked. At one Kanpur centre, 819 candidates had been allotted against a capacity of 399. Re-examinations were held on 29, 30 and 31 May.
What makes this worth reading closely is the Commission’s own account of it. There was no paper leak — the Commission said so plainly, and there is no reason to doubt it. Its Chairman instead described a different problem: that attempts to break into the online examination system happen every day, that “the biggest threats for our exams are remote answering and technical hacks”, and that several computer terminals had been shut down after suspicious external access was detected. He also acknowledged mismanagement in how the aftermath was handled.
Follow the sequence that produced the chaos. Terminals were taken out of service because the defence worked. That left fewer safe terminals. Fewer safe terminals meant thousands of candidates had to be squeezed into a shorter window at the centres that remained — which is what produced the overcrowding, the cancelled shifts and the scenes that followed. Nobody did anything wrong in shutting a suspect machine down. It is simply that, in this architecture, the security response and the examination are drawing on the same pool of terminals.
Every terminal taken out of service to protect the exam was a terminal the exam could no longer use.
This is the same shape as the jammer problem. A centre that installs radio jammers to stop smuggled phones finds that its own exam delivery runs on radio, so it is asked to switch the jammers off. Here a commission that shuts down compromised terminals finds that its capacity to seat candidates was those terminals. In both cases the defence and the delivery are competing for one resource, and somebody has to decide which one loses.
One more detail from the same recruitment. On 10 May, at an online test centre in Ranchi, six candidates were arrested after invigilators noticed questions being answered on screen without visible manual input. Police alleged the machines were being driven by remote-access software from an external server, with a solver group supplying answers in real time. Whether anyone at the centre assisted is still under investigation. But note what the technique requires: a terminal that something outside the room can reach. The Commission named remote answering as its single biggest threat, and remote answering is not a property of examinations. It is a property of connected terminals.
The difference an architecture makes
Defended by procedure
- The paper exists in readable form on a server inside the centre.
- It travels over a network the examination body does not own or observe.
- Every defence is a configuration or a physical check somebody must get right on the day.
- A failure surfaces afterwards, through forensic audit — if it surfaces at all.
Defended by architecture
- No local network carries question papers, and no exam server holds them in readable form.
- Each capsule is encrypted to one specific candidate device and does not open before the exam hour.
- Devices are offline and in kiosk mode; hand-overs are edge-mated Face-Taps, not network sessions.
- Every hand-over emits a signed receipt, so the record is built while the exam runs, not reconstructed later.
It is worth being exact about that difference, because it would be easy to overstate. CORTEX does not defend against malicious port mirroring, access-list errors, rogue devices on the local network, flat-network interception, broadcast sniffing, address spoofing, silent taps or fail-open network authentication. It has none of those things to defend. There is no switch carrying question papers because there is no network carrying question papers. An attack surface that has been removed does not need a counter-measure, and claiming one for it would be a kind of dishonesty. As for the courier media — techniques 01 and 02 — the answer is not that the copy is prevented. It is that a copy is worth nothing: what sits on the media is already sealed to a device that has not been reached yet, and to an hour that has not arrived.
Remote answering is worth stating separately, because an examination body has now named it as its biggest threat. Driving a candidate’s screen from an external server requires a path from that server to that screen. A terminal that is offline and locked in kiosk mode has no such path — not one that is monitored and blocked, but one that does not exist. And because no terminal is ever taken out of service to contain a network intrusion, the defence never eats into the seats available. The capacity to run the exam and the measures protecting it stop competing.
What this does not remove
A trusted insider with physical access is a real threat to any system, and no architecture makes that go away. CORTEX does not claim to. Nor does being offline stop a person who is physically in the room from helping a candidate — it stops the room being reached from outside it. What changes is what such a person can obtain and whether it stays hidden. Copying storage yields ciphertext bound to a device and an hour, not a paper. And because every hand-over produces a signed receipt, an action out of sequence shows up as a gap in a published record rather than as something a forensic team may reconstruct months later. The claim is not that nobody can act badly. It is that acting badly stops being silent.
On the cases cited
The Western Railway and JEE (Main) matters are allegations under investigation by the Central Bureau of Investigation. The Ranchi arrests are established; the alleged solver network, and whether anyone at the centre assisted, remain under investigation. The Staff Selection Commission material is the Commission’s own public account of its 2026 examination, as reported in the press — it is quoted here as candour, not as an accusation, and the Commission’s statement that there was no paper leak is reported alongside it. Nothing here should be read as a finding against any individual or organisation, and no individual is named. These cases are cited because the reporting describes the mechanism clearly, and the mechanism is the point: a rule requiring isolation does not itself produce isolation, and a defence that consumes the exam’s own capacity will eventually be asked to stand down.