VSSCORM » Further Reading

Cheating on SCORM Courses – It’s Not Difficult

Steve Addison — Fri, 31 Jul 2009 18:36:18 +0000

Since I’ve spent much of the last 10 years working in the slightly paranoid world of information security, I’ve always been concerned about SCORM’s dependence on JavaScript for communicating with a LMS. It’s always seemed to me that it would be very vulnerable to being hacked. And, a couple of months ago, Philip Hutchison at pipwerks created a stir by demonstrating one way to do this.

As he says:

SCORM – the most common communication standard in e-learning – is fairly easy to hack. It uses a public JavaScript-based API that is easy to tap into and feed false data, and because it’s a standard, you know exactly what methods and properties are available in the API. It doesn’t matter what vendor or product produced the course (Articulate, Adobe, etc.) ? if it uses SCORM, it’s vulnerable

He’s developed:

… a proof-of-concept bookmarklet that when clicked will set your SCORM course to complete with a score of 100 (works with both SCORM 1.2 and 2004).

That’s worrying if you’re a training manager, and you’re depending on SCORM courses to prove your compliance with laws and regulations!

You can find more details (but NOT the exploit code!) on this page on Philip’s website. The ADL has also published some suggestions for ways to make assessments secure from this form of hacking, but it’s important to understand the problem really stems from the use of JavaScript as the communications mechanism.

Does this make SCORM useless? Not really, as long as you’re prepared to accept the limitations inherent in asynchronous WBT and in unproctored assessments. Any unsupervised online assessment should always be considered to be an “open-book” exam since the student could be using books and/or manuals, web access to resources such as Google, or even just a helpful coworker sitting beside him/her during the test. You’ll find a more detailed discussion of this on Mike Rustici’s blog.

SCORM 1.2 Cookbook

Steve Addison — Thu, 16 Jul 2009 19:20:53 +0000

The late Claude Ostyn – in his role as Learning Standards Strategist for Click2Learn – created a wonderful SCORM 1.2 Resource Kit aka the SCORM Cookbook. Sadly, despite its popularity, SumTotal Systems (the descendent of Click2Learn) removed the SCORM 1.2 Resource Kit from its website.

Fortunately, there are several places on the Internet where you can still find a copy of this document. Here’s a couple of places you can look:

A SCORM Primer from ADL

Steve Addison — Fri, 05 Jun 2009 18:02:59 +0000

Just a brief aside … I’d forgotten about this SCORM Primer from Philip Dodds at ADL.

It’s a pretty high-level overview of the subject but might help you see how the SCORM RTE – the subject of the work I’m describing right now in this blog – fits in with SCORM as a whole.

You might also find useful information in the ADL Community SCORM section.

Background Reading

Steve Addison — Sun, 31 May 2009 06:46:24 +0000

SCORM – the Shareable Common Object Reference Model – started as an initiative from the Advanced Distributed Learning Initiative (ADL – part of the US Department of Defense) – and built on earlier projects such as AICC.

The ADL website can be a little hard to navigate, especially if you’re looking for older documents rather than the SCORM 2004 documents. So, if you have trouble locating the SCORM 1.2 documents, you can use this link to download them from the VS SCORM website.

An excellent introduction to SCORM can be found on the website of Rustici Software including a technical overview of SCORM 1.2.