// HACKER NEWS — CYBERSECURITY
Reverse engineering my ADHD test
One night, while chatting with friends, I looked up and noticed the stars. Light pollution usually makes them difficult to see, so I was surprised by how clear it all was. I stared for several minutes before deciding,
"I need a telescope." I ordered one on Amazon that same night. I've always picked up new hobbies this way. However, I could never stick with them.
I chalked it up to being a spontaneous person. It wasn't until a friend shared their recent autism diagnosis that I decided to get evaluated for ADHD. The psychiatrist explained that getting evaluated was a good idea. "Untreated ADHD can sometimes go hand in hand with depression and anxiety", she told me. She had me take an online assessment, warning me that once it began, she wouldn't
be able to talk to me. Unsure of what I was about to experience, I clicked the "Begin Test" link sent to my email.
The link brought me to a blank page with what felt like an early-2000s Flash game. The task was simple: press Space whenever a card with three red hearts appeared, otherwise, do nothing.
I sat there pressing the spacebar as instructed. There was no timer or score to keep track of, only flashing
cards. Eventually, other pieces of clip art began appearing alongside them, seemingly as a way to distract me. Still, I followed
the task of pressing my spacebar when the card with three red hearts appeared. This dragged on, eventually introducing audio of crying
babies and police sirens into the mix. At one point, it felt like this would never end, so I would spam spacebar in the hope of finishing the seemingly endless examination.
Curiousity struck, and I had the bright idea to capture the page source and any outbound requests. I opened DevTools, saved all page scripts, and continued the exam.
Thankfully, the end came! The psychiatrist told me she would let me know my results the following week.
With all the scripts saved, I began digging. A quick grep for keyCode showed me how the test handled my spacebar presses:
They were clearly tracking every time I pressed space, along with every "bad" key I pressed (Anything other than Space or enter).
They can tell when the test lost focus (If you open a new tab for example). Interestingly, I also discovered that it swapped
the assets based on whether the subject was an adult or a child. Children were capped at 15 FPS, adults 24. Children heard sounds of birds,
bowling, sabers, and planes. Adults heard babies crying, car crashes, and police sirens.
The final payload contained only the timing of my spacebar presses, the timing of my "bad" pressed, and the total time the window had been out of focus. I wondered how that alone could provide a diagnosis. I could make some guesses, but the scoring model wasn't apparent anywhere in the source code.