4 ms·

At the beginning of the school year, I noticed some strange HTTP traffic going through my home router to China and India endpoints. So, I traced the traffic to

At the beginning of the school year, I noticed some strange HTTP traffic going through my home router to China and India endpoints. So, I traced the traffic to the Chromebooks my kids in public school were using. About that time, my son was unable to access his drum lessons (Steven's Drum Shed, highly recommend) because safety software provided by the school was blocking him. After analyzing the chromebook more, I discovered the traffic going to China was requesting ads and then requesting the hyperlink for the ad (ok, so ad fraud it is). I also noticed that the safety software was logging all HTTP requests to their server. So, I went to the school district and requested they remove it. They initially said, "if we remove it, your kids won't be able to access their academic work." So, I sent a letter to the Superintendent that politely asked they remove the safety software from my family's chromebook as it violated my children's and my family's rights (unreasonable search, get a warrant). I also told them I would hold them responsible for the cost of having the software removed by an expert (which my lawyer suggested would be the thing that got their attention and we'd be able to win in small claims court). The next day, they removed the "safety" software.

dekhn 6y ago
As a reminder, if you want to achieve anything with chools, this is how you do it. A polite letter, nonthreatening, filled with facts, and a cost to the school if they continue.
- lotsofpulp 6y ago
  The threat of costs from the small claims court system is the only reason they achieved anything.
  - deleted 6y ago
    [deleted]
  - reaperducer 6y ago
    Probably not. School districts have lawyers on staff. It's not you or me who would have a new expense of $x/hour for a lawyer.
_fat_santa 6y ago
So the safety software was committing ad fraud? Were you able to pry anymore details from the requests or did you simply go to the school and ask that it be removed?
- indymike 6y ago
  I was able to identify about 200 fraudulent ad clicks. BTW - I don't know if it was the safety software or something else that was force-installed by the software. I wasn't looking to do a deep analysis, I suspected the safety extension was doing more than it should and confirmed it. I gathered enough evidence that a competent admin would conclude the safety software was not safe and connected with the school.
drzoltar 6y ago
Could you elaborate on the suite of tools you used to do this kind of network traffic analysis?
- err4nt 6y ago
  Not the original commenter but I've heard of people debugging smart TV's using https://www.wireshark.org https://www.wireshark.org to see the network requests, you would connect the device you want to inspect to a network being shared through your computer running Wireshark, and then you can analyze every request going in and out (or at least see them and be aware of the traffic)
  - cgriswald 6y ago
    Alternatively, put your NIC into promiscuous mode and capture the traffic that way.
    - nitrogen 6y ago
      That only works if you use a hub instead of a switch, or if the traffic is broadcast, or if you somehow convince the switch to give your port all traffic. It's easiest to just use two NICs bridged in one PC as a MITM.
      - mschuster91 6y ago
        You can also easily run an ARP spoofing attack, and not just to sniff but also to manipulate. Done that quite often back in my school time, oh the glorious days when web traffic was mostly plain HTTP. There were entire command lists going around specifying what exactly one needed to replace, say, the logo of an online newspaper with a picture of a dong.
      - dialamac 6y ago
        Even an el cheap basic managed switch will do port mirroring
  - 6y ago
acfou 6y ago
hi indymike, what extension in chrome was causing the ad fraud?
- indymike 6y ago
  Would prefer not to share this with everyone here. Reach out to me (I'm easy to find on Linkedin and twitter).
908B64B197 6y ago
Had it not worked, I wonder if a letter to Congressman/Senator would also have worked. Shady traffic with personal information of a CHILD going straight to CHINA sounds like it might get some traction on the issue.

dekhn 6y ago

As a reminder, if you want to achieve anything with chools, this is how you do it. A polite letter, nonthreatening, filled with facts, and a cost to the school if they continue.

lotsofpulp 6y ago
The threat of costs from the small claims court system is the only reason they achieved anything.
- deleted 6y ago
  [deleted]
- reaperducer 6y ago
  Probably not. School districts have lawyers on staff. It's not you or me who would have a new expense of $x/hour for a lawyer.

_fat_santa 6y ago

So the safety software was committing ad fraud? Were you able to pry anymore details from the requests or did you simply go to the school and ask that it be removed?

indymike 6y ago
I was able to identify about 200 fraudulent ad clicks. BTW - I don't know if it was the safety software or something else that was force-installed by the software. I wasn't looking to do a deep analysis, I suspected the safety extension was doing more than it should and confirmed it. I gathered enough evidence that a competent admin would conclude the safety software was not safe and connected with the school.

drzoltar 6y ago

Could you elaborate on the suite of tools you used to do this kind of network traffic analysis?

err4nt 6y ago
Not the original commenter but I've heard of people debugging smart TV's using https://www.wireshark.org https://www.wireshark.org to see the network requests, you would connect the device you want to inspect to a network being shared through your computer running Wireshark, and then you can analyze every request going in and out (or at least see them and be aware of the traffic)
- cgriswald 6y ago
  Alternatively, put your NIC into promiscuous mode and capture the traffic that way.
  - nitrogen 6y ago
    That only works if you use a hub instead of a switch, or if the traffic is broadcast, or if you somehow convince the switch to give your port all traffic. It's easiest to just use two NICs bridged in one PC as a MITM.
    - mschuster91 6y ago
      You can also easily run an ARP spoofing attack, and not just to sniff but also to manipulate. Done that quite often back in my school time, oh the glorious days when web traffic was mostly plain HTTP. There were entire command lists going around specifying what exactly one needed to replace, say, the logo of an online newspaper with a picture of a dong.
    - dialamac 6y ago
      Even an el cheap basic managed switch will do port mirroring
- 6y ago

acfou 6y ago

hi indymike, what extension in chrome was causing the ad fraud?

indymike 6y ago
Would prefer not to share this with everyone here. Reach out to me (I'm easy to find on Linkedin and twitter).

908B64B197 6y ago

Had it not worked, I wonder if a letter to Congressman/Senator would also have worked. Shady traffic with personal information of a CHILD going straight to CHINA sounds like it might get some traction on the issue.