4 ms·

A school IT specialist told me about a clever student hack. Their school blocks all sorts of traffic, but teachers can allow exceptions via a password. One stu

A school IT specialist told me about a clever student hack. Their school blocks all sorts of traffic, but teachers can allow exceptions via a password. One student installed a keylogger onto his BYOD laptop (many schools allow kids to bring their own, or use a mediocre school-provided device), and then made up a plausible excuse to hit the firewall (e.g., doing a report on anatomy, but innocuous site was blocked because the word "breast" appears). Then the student presents the laptop to the teacher, who types in the exception password. Since the keylogger is running, the student can now grant himself exceptions to his heart's content. The school eventually figured this out. It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices?

casey2 4y ago
>do you tell teachers never to grant exceptions on student-owned devices? Yes. This is correct from both a security and educational perspective. What kind of example does the opposite set for children?
prepend 4y ago
I run a pihole and clients can request an exception and then I grant it on my own device. Having root type into someone else’s machine that they control is a total noob move and it’s funny the teacher fell for it. Of course since the student is using a custom machine it’s likely they have a specific ip, host name, and traffic pattern that can identify them (eg, look at the requests across 7 different classrooms and find the single student that’s in all of them before the password spreads too much). Then they can intervene and punish the kid. Keyloggers aren’t particularly clever or “hackery” and are just a social engineering hack so it’s more malicious than exploratory. But I’d hope the school doesn’t crack down too hard and instead uses it to teach kids that if you want to be clever you have to be very clever.
kbelder 4y ago
Don't worry about blocking it via firewall; just log traffic, make it against the rules, and punish kids when they're caught?
- cykros 4y ago
  Have you met kids before? You'd never get any actual educating done if you were busy constantly punishing them for things they did first and thought about later.
GoblinSlayer 4y ago
To do it the lazy way: 1) change your password to hunter2, 2) use hunter2 on byod laptop, 3) revert your password.
- gnicholas 4y ago
  That doesn't sound like the lazy way to me!
faeriechangling 4y ago
There's actually many solutions to this. >You can use certificate based authentication instead of password based. Certificate based authentication COMPLETELY prevents this attack because the student's computer never sees the private key which actually authenticates the teacher to bypass >You can use time based one-time passwords/HMAC instead of using certificates, with a teacher pulling up an app >You can have the computer have its password managed by a centralised store which has the ability to rotate said password. When the teacher needs to unlock a computer, they request that computers password from the centralised store, and after it's used, the password is then rotated. >What I would recommend the most, is just giving each teacher their own credentials and sending the teacher an alert when their credentials were used. You could easily lock this down, but I honestly don't think it's a good idea. I think using weak security measures actually has a merit, as it grants the teacher some degree of flexibility in how to deal with things, and it grants the kids a greater degree of freedom and education in both what weak security looks like and how cracking security just because it's weak might not be the best idea.
switch007 4y ago
There are plenty of better ways. You make the student auth in some manner then grant an exception from your own computer. Entering the password on the student’s BYOD is pretty stupid
- tigeroil 4y ago
  Wholeheartedly agreed. Even if the student has the absolute best of intentions, you have no way of knowing that the laptop doesn't have say, malware on it.
  - bombolo 4y ago
    So then what? The student just can't go ahead with the assigned task? This probably happens like 20 times a day for them.
  - creatonez 4y ago
    Usually these sorts of passwords are single-purpose just for getting around mundane firewall blocks, so they're not that critical.
- gnicholas 4y ago
  > Entering the password on the student’s BYOD is pretty stupid I wouldn't say it was stupid of the teacher to enter the password, given the amount of technical expertise that elementary school teachers can be expected to possess. The blame should probably go to the person who set up the exception-granting system, who should have used a system that doesn't involve authenticating on a non-trusted device.
  - prepend 4y ago
    If teachers are to be trusted with the password then they need training on how to protect the training. And a simple “only enter this password in secure locations” is necessary.
  - kugelblitz 4y ago
    I didn't read it as "it was stupid of the teacher to enter the password" but rather "the system making teachers enter the password on that computer is stupid".
aaronblohowiak 4y ago
> It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices? the target of the exception and the device granting the exception do not need to be the same device necessarily. if you have that figured out then yes only allow password entry on locked-down devices.
out-of-ideas 4y ago
TOTP would do well here for this case for a really simple path forward - but then having the student login themselves and the request be formally logged and allowed via not-their-computer would offer a bit more scaleability and auditability
- spiffytech 4y ago
  > TOTP would do well here for this case Indeed: this is almost exactly the attack type TOTP was designed for. The idea was that if someone intercepted your network traffic and captured your password, it wouldn't do them any good without also having your code generator. It turns out that if you have a live MitM connection there are ways around that problem, but TOTP is still helpful against other attacks. I agree that for this situation, it's probably better to focus on detection than bulletproof enforcement.
creatonez 4y ago
> The school eventually figured this out. It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices? Make it so the firewall exception process on student devices gives a 6 digit code which the instructor enters into a staff-only interface on the instructor's device, so that the process always requires input on both a student and an instructor's computer.
- geraldwhen 4y ago
  This requires two devices to have working internet, which is often not the case at schools. Teachers are computer illiterate, to boot.
  - guffins 4y ago
    To be fair, TOTP works offline.

casey2 4y ago

>do you tell teachers never to grant exceptions on student-owned devices? Yes. This is correct from both a security and educational perspective. What kind of example does the opposite set for children?

prepend 4y ago

I run a pihole and clients can request an exception and then I grant it on my own device. Having root type into someone else’s machine that they control is a total noob move and it’s funny the teacher fell for it. Of course since the student is using a custom machine it’s likely they have a specific ip, host name, and traffic pattern that can identify them (eg, look at the requests across 7 different classrooms and find the single student that’s in all of them before the password spreads too much). Then they can intervene and punish the kid. Keyloggers aren’t particularly clever or “hackery” and are just a social engineering hack so it’s more malicious than exploratory. But I’d hope the school doesn’t crack down too hard and instead uses it to teach kids that if you want to be clever you have to be very clever.

kbelder 4y ago

Don't worry about blocking it via firewall; just log traffic, make it against the rules, and punish kids when they're caught?

cykros 4y ago
Have you met kids before? You'd never get any actual educating done if you were busy constantly punishing them for things they did first and thought about later.

GoblinSlayer 4y ago

To do it the lazy way: 1) change your password to hunter2, 2) use hunter2 on byod laptop, 3) revert your password.

gnicholas 4y ago
That doesn't sound like the lazy way to me!

faeriechangling 4y ago

There's actually many solutions to this. >You can use certificate based authentication instead of password based. Certificate based authentication COMPLETELY prevents this attack because the student's computer never sees the private key which actually authenticates the teacher to bypass >You can use time based one-time passwords/HMAC instead of using certificates, with a teacher pulling up an app >You can have the computer have its password managed by a centralised store which has the ability to rotate said password. When the teacher needs to unlock a computer, they request that computers password from the centralised store, and after it's used, the password is then rotated. >What I would recommend the most, is just giving each teacher their own credentials and sending the teacher an alert when their credentials were used. You could easily lock this down, but I honestly don't think it's a good idea. I think using weak security measures actually has a merit, as it grants the teacher some degree of flexibility in how to deal with things, and it grants the kids a greater degree of freedom and education in both what weak security looks like and how cracking security just because it's weak might not be the best idea.

switch007 4y ago

There are plenty of better ways. You make the student auth in some manner then grant an exception from your own computer. Entering the password on the student’s BYOD is pretty stupid

tigeroil 4y ago
Wholeheartedly agreed. Even if the student has the absolute best of intentions, you have no way of knowing that the laptop doesn't have say, malware on it.
- bombolo 4y ago
  So then what? The student just can't go ahead with the assigned task? This probably happens like 20 times a day for them.
- creatonez 4y ago
  Usually these sorts of passwords are single-purpose just for getting around mundane firewall blocks, so they're not that critical.
gnicholas 4y ago
> Entering the password on the student’s BYOD is pretty stupid I wouldn't say it was stupid of the teacher to enter the password, given the amount of technical expertise that elementary school teachers can be expected to possess. The blame should probably go to the person who set up the exception-granting system, who should have used a system that doesn't involve authenticating on a non-trusted device.
- prepend 4y ago
  If teachers are to be trusted with the password then they need training on how to protect the training. And a simple “only enter this password in secure locations” is necessary.
- kugelblitz 4y ago
  I didn't read it as "it was stupid of the teacher to enter the password" but rather "the system making teachers enter the password on that computer is stupid".

aaronblohowiak 4y ago

> It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices? the target of the exception and the device granting the exception do not need to be the same device necessarily. if you have that figured out then yes only allow password entry on locked-down devices.

out-of-ideas 4y ago

TOTP would do well here for this case for a really simple path forward - but then having the student login themselves and the request be formally logged and allowed via not-their-computer would offer a bit more scaleability and auditability

spiffytech 4y ago
> TOTP would do well here for this case Indeed: this is almost exactly the attack type TOTP was designed for. The idea was that if someone intercepted your network traffic and captured your password, it wouldn't do them any good without also having your code generator. It turns out that if you have a live MitM connection there are ways around that problem, but TOTP is still helpful against other attacks. I agree that for this situation, it's probably better to focus on detection than bulletproof enforcement.

creatonez 4y ago

> The school eventually figured this out. It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices? Make it so the firewall exception process on student devices gives a 6 digit code which the instructor enters into a staff-only interface on the instructor's device, so that the process always requires input on both a student and an instructor's computer.

geraldwhen 4y ago
This requires two devices to have working internet, which is often not the case at schools. Teachers are computer illiterate, to boot.
- guffins 4y ago
  To be fair, TOTP works offline.