Good afternoon James, thank you for your prompt and detailed feedback. Now that I have had a little sleep, I can provide context. A student had sent in a ticket to our help desk claiming that Canvas/Proctorio were acting slow, and delayed in providing pages to him while he took a test. He claimed that Internet speed was fast, and he should not be having problems with a slow Canvas/Proctorio test. Investigating, I saw that the student had three browsers (and two devices) up simultaneously. In light of the fact that the student had up so many windows, was on Proctorio, was probably in a common room with other students also seeking bandwidth, the hiccups and delays the student was experiencing was not surprising. It was in the context of investigating the student's technology at the time of the test that I came across these web addresses with the "roos". With a little further investigation this morning, I saw that the "roos" are a source folder for .svg images that indicated Internet speed.
So, the repeated appearance of these URLs now makes sense, in light of the student's concerns about Internet speed.
I take it that this appears more than once.
Yes, multiple times.
Are the urls that follow the roos valid?
Yes, they are valid URLs for images. Last night, when I looked at the URLs, they were an address of an .svg file. When I clicked on it, the graphic downloaded. Last night I was on a Mac laptop. Today, on a hardwired PC when I click on the same links I get an invalid page response by Canvas. At the end of the day, these are addresses of images. Here is a fuller look at one of the examples.
https://xxxxx.instructure.com/courses/xxxxx/roos/2/1/105/assets/icons/new-connection-average.svg
I'm not familiar with "roos", but having anything between /pages/ and the url for the page would break the page router in Canvas. It would not take you anywhere.
You were correct
roos does not appear anywhere in the Canvas open source anywhere.
I've seen web log entries that shouldn't be there. Any webserver routinely gets requests for pages with known vulnerabilities, even though they don't appear on the server. Someone is probing to find an exploit.
If this is tied to a student (and not just a random page from the weblogs), is there other evidence that the student's account has been hacked?
No other evidence at this time, and I think the student was just trying to check the speed of his Internet connection. A browser-based Security check said that the page was secure. (I've attached a partial screenshot)
Perhaps the student was trying to automate something and had a bug in their program? Maybe the student was doing something else and randomly inserted roos in there (my laptop routinely jumps me to a place I wasn't at and then I finish typing before I realize it, although getting an extra slash in there would be difficult to explain).
I don't think so. From the context of his worries, I think he was simply trying to get Canvas to deliver his test more quickly. One of the pages he had open was his grades page at the time. Repeated checks of the Internet speed and having his grades page open, as well as, contacting the teacher that he was worried about being able to finish his test in order to get a good grade all point to me, at least, as someone busy trying to get Canvas/Proctorio to work faster for him, so that his grade would not suffer.
Is it possible that the bad link is contained within a page or assignment within Canvas?
I went to the files section of the course, and could find no folder "roos". When doing a search for the files, I did a generic search for .svg, and came up only with one "getstarted-here.svg" .svg. I did not find the .svg's that were the speed indicators of Internet speed in the course itself.
Can you identify where the student was before that link showed up and then see if that page has a bad link on it?
An external tool that was visited right before the "roos" folder URL showed up was an external link to Proctorio. Apparently, one can add a "Speed Test" extension to test Internet speed. with the following example:
"Add the “speed test” extension to test your internet speed."https://support.aktiv.com/s/article/Proctorio-System-Requirements
Are you aware of a way I can track whether such an extension has been added to the student's Proctorio?
What was the http status code for those requests?
A 404 error, I have attached a screenshot. (Presented as one of those generic "Page Not Found" pages from Canvas.)
James, thank you so much for all the great questions. I would not have looked at it as fully without the questions you presented.
Warmest regards,
Sharon Austin
