topic Re: Students Using The College Board App to Get Around the Web Filter in Peer-Peer Topics

Students Using The College Board App to Get Around the Web Filter

mpartenope4676 — Fri, 06 Dec 2024 19:00:14 GMT

These friggin kids! Bless them for their persistence. Hopefully one day it'll be put to better use. This YouTube Video show how to get around the web filter with the College Board kiosk app. Apparently this channel is filled with workarounds for all sorts of things!

https://www.youtube.com/watch?v=xkzDQO9H7hE

Re: Students Using The College Board App to Get Around the Web Filter

sundermannc — Fri, 06 Dec 2024 19:09:06 GMT

This is a pretty old workaround. I don't think it exists anymore as they (college board) don't use that app any more. Google this and you'll find a few reddit threads from 3 years ago.

To be fair, when this was a thing, it was something we dealt with a lot. Luckily, the kiosk apps we use don't have those kind of login workarounds any longer.

Re: Students Using The College Board App to Get Around the Web Filter

ddelboccio — Fri, 06 Dec 2024 19:10:05 GMT

I just blocked this kids entire channel.

Re: Students Using The College Board App to Get Around the Web Filter

steve — Mon, 09 Dec 2024 16:41:12 GMT

I think that kiosk app has been deprecated in favor of a Chrome extension that runs while the students are logged in (and hence should still be covered by your filter). See https://apclassroom.collegeboard.org/lockdown?SFMC_cid=EM1303493- and https://media.academicmerit.com/apclassroom/PreAP/CB+LockDown+Browser+for+Chromebooks_ADA.pdf?SFMC_cid=EM1303493- .

We just run their "Blue Book" kiosk app they have which doesn't seem to have this vulnerability?

Re: Students Using The College Board App to Get Around the Web Filter

9330cashmore — Fri, 06 Dec 2024 19:23:13 GMT

We also apply filtering rules to the different network /vLANs /subnets. Any device on the subnet student devices are on get the same filter rules just to stop things like this.

Re: Students Using The College Board App to Get Around the Web Filter

mpartenope4676 — Fri, 06 Dec 2024 19:34:36 GMT

I'll look into this, thanks! I feel like we tried it early on and it was glitchy so we continued with the kiosk app.

Re: Students Using The College Board App to Get Around the Web Filter

mpartenope4676 — Fri, 06 Dec 2024 19:39:59 GMT

We use LightSpeed and they advised us to not force devices to go through Relay Rocket/Network Agent/SmartShield or whatever it is they're calling it these days. They said to let the agent do the filtering. What I did just figure out however is a kiosk url blocking setting existings in the Admin Console here: DevicesChromeSettingsDeviceURL blocking. I just added policies.google.com and
support.google.com to the block list here. One could put an asterisk and block everything, but then one would have to figure out ALL the URLs are required for whichever kiosk apps you're using. 😞

Re: Students Using The College Board App to Get Around the Web Filter

9330cashmore — Fri, 06 Dec 2024 19:45:15 GMT

We are using LightSpeed Relay also. But in KIOSK mode Chromebooks dont have a "user session" to load the Relay extension. That is why LightSpeed DNS filter (Smart Shield /Network Agent /...) gets to do the work.

Re: Students Using The College Board App to Get Around the Web Filter

MarkLoundy — Fri, 06 Dec 2024 23:48:20 GMT

Forgive the public correction. It's "deprecated," not "depreciated."

Re: Students Using The College Board App to Get Around the Web Filter

sleeciambra — Mon, 09 Dec 2024 13:15:49 GMT

I read about this last week - https://github.com/Blobby-Boi/ExtHang3r

It brings students to a page where they can hang and then kill extensions. I was able to kill the GoGuardian extension using a student account on one of our devices. You can block data://* or Chrome extensions to prevent it from working.

Re: Students Using The College Board App to Get Around the Web Filter

ddelboccio — Mon, 09 Dec 2024 13:29:33 GMT

My BLOCKED URLs settings for students already include "data://*", and it did not prevent this page from loading.

Re: Students Using The College Board App to Get Around the Web Filter

mpartenope4676 — Mon, 09 Dec 2024 13:53:19 GMT

Ok, forgive my ignorance, what does data://* block? And this is something that is suggested we add to URL Blocking under User settings as well as kiosk?

Re: Students Using The College Board App to Get Around the Web Filter

sundermannc — Mon, 09 Dec 2024 13:55:28 GMT

@sleeciambra I can confirm this works as a bypass to Securly too. As usual, their support didn't understand what I was saying at first, so I had to demonstrate it for them.

https://drive.google.com/file/d/1rfj41JObtFgHEjgcPg2exFZbPVrPeJ1f/view?usp=sharing

We did block data:// and that worked to stop the bypass. However, we quickly learned that this breaks some sites... One site being PearDeck, which is used by our teachers, so we had to unblock it. We are now blocking chrome://extensions instead, but this may have it's own challenges, to be determined on that.

@ddelboccio Make sure your blocked settings are on the user settings, not device settings, and it will block the data://*, if you want to go that route. (however, be aware that this will break some sites as we learned.)

If you are using GoGuardian, complain to your rep. Same with Securly. They need to patch this exploit. Also @sleeciambra it might be worth you starting a new thread for this, since it's a different topic than the college board app.

Re: Students Using The College Board App to Get Around the Web Filter

ddelboccio — Mon, 09 Dec 2024 14:01:10 GMT

When testing this from my student chromebook, I did not have to complete the second step of opening the extensions tab and disabling.

My GoGuardian extensions we disabled just from step 1.

Besides, I already have the extensions page blocked for students, so they wouldn't be able to access that part.

Re: Students Using The College Board App to Get Around the Web Filter

steve — Mon, 09 Dec 2024 16:41:36 GMT

Thanks, I've corrected the post.

Re: Students Using The College Board App to Get Around the Web Filter

msnead — Wed, 11 Dec 2024 02:48:20 GMT

Two points:

#1) For the actual topic of this thread, we have this in the blocklist for the device settings (i.e. kiosks):

google.com
yahoo.com
bing.com
duckduckgo.com
tiktok.com
facebook.com
yandex.com
baidu.com
discord.com
youtube.com
ask.com
search.brave.com

along with "accounts.google.com" (without quotes) in the exceptions list. This prevents people from finding a way to navigate to most search pages and social media links, which are the primary means of exploiting the kiosks.

#2) @sundermannc thanks for your post and video link. I heard about this hack before but dismissed it when the data:// method didn't work for us, but the html code method worked just fine. We have also put in the chrome://extensions block for now.

In case anyone else is wondering, we tried just blocking the direct URL of the extension itself so that we didn't have to block the whole extensions interface. While the block works when going to the link directly, if you just navigate to the extensions management screen (chrome://extensions) and click on your filter's extension, it ignores the URL block until you refresh the page (... and then the browser crashes, lol).

We submitted a support ticket to our filter vendor (Linewize).