OSCP cheating allegations a reminder to verify hacking skills when hiring

For years the notoriously difficult OSCP exam signaled to employers and colleagues alike a minimum level of technical competence, but a former student's claim should motivate hiring managers to test candidates before making a job offer.

Few infosec certifications have developed the prestige in recent years of the Offensive Security Certified Professional (OSCP), an entry-level penetration testing certification with a reputation for being one of the most difficult out there.  Run by Offensive Security (OffSec), the makers of Kali Linux, whose motto is "Try harder," the OSCP features a grueling 24-hour exam that requires students to hack a variety of machines on a test network. (Full disclosure: This reporter previously paid to self-study for the OSCP but did not take the exam. He plans to #TryHarder.)

However, a kerfuffle erupted last week when a critic going by the handle cyb3rsick, annoyed at what they claimed was widespread cheating on the notoriously difficult exam, published a brain dump of one of the exam machines, and threatened to publish half a dozen more, raising questions about the integrity and continued value of the OSCP as a certification.

The OSCP (Offensive Security Certified Professional) has the reputation as one of the most difficult entry-level penetration testing certifications out there, with a grueling 24-hour exam that requires students to hack a variety of machines on a test network. Created and run by OffSec, whose motto is "Try harder." (Full disclosure: This reporter previously paid to self-study for the OSCP but did not take the exam. He plans to #TryHarder.)

The drama began, as it so often does in infosec, on Twitter, with a link to this now deleted web page (archived here). The author says they are hiring penetration testers and are increasingly disappointed by OSCP holders who know nothing about hacking. "OSCP is losing its credibility by not updating the exam machines which allowed thousands of guys to cheat and pass the exam," the author writes. "It’s just turned to be a brain dump exam which always kill the beauty of the competition."

To continue reading this article register now

FREE Download: Get the Spring 2019 digital issue of CSO magazine today!