Comment by indymike | Hacker News Reader

Comment by indymike | Hacker News Reader

At the beginning of the school year, I noticed some strange HTTP traffic going through my home router to China and India endpoints. So, I traced the traffic to the Chromebooks my kids in public school were using. About that time, my son was unable to access his drum lessons (Steven's Drum Shed, highly recommend) because safety software provided by the school was blocking him. After analyzing the chromebook more, I discovered the traffic going to China was requesting ads and then requesting the hyperlink for the ad (ok, so ad fraud it is). I also noticed that the safety software was logging all HTTP requests to their server. So, I went to the school district and requested they remove it. They initially said, "if we remove it, your kids won't be able to access their academic work." So, I sent a letter to the Superintendent that politely asked they remove the safety software from my family's chromebook as it violated my children's and my family's rights (unreasonable search, get a warrant). I also told them I would hold them responsible for the cost of having the software removed by an expert (which my lawyer suggested would be the thing that got their attention and we'd be able to win in small claims court). The next day, they removed the "safety" software.

As a reminder, if you want to achieve anything with chools, this is how you do it. A polite letter, nonthreatening, filled with facts, and a cost to the school if they continue.

The threat of costs from the small claims court system is the only reason they achieved anything.

Probably not. School districts have lawyers on staff. It's not you or me who would have a new expense of $x/hour for a lawyer.

So the safety software was committing ad fraud? Were you able to pry anymore details from the requests or did you simply go to the school and ask that it be removed?

I was able to identify about 200 fraudulent ad clicks. BTW - I don't know if it was the safety software or something else that was force-installed by the software. I wasn't looking to do a deep analysis, I suspected the safety extension was doing more than it should and confirmed it. I gathered enough evidence that a competent admin would conclude the safety software was not safe and connected with the school.

Could you elaborate on the suite of tools you used to do this kind of network traffic analysis?

Not the original commenter but I've heard of people debugging smart TV's using https://www.wireshark.org to see the network requests, you would connect the device you want to inspect to a network being shared through your computer running Wireshark, and then you can analyze every request going in and out (or at least see them and be aware of the traffic)

Alternatively, put your NIC into promiscuous mode and capture the traffic that way.

That only works if you use a hub instead of a switch, or if the traffic is broadcast, or if you somehow convince the switch to give your port all traffic. It's easiest to just use two NICs bridged in one PC as a MITM.

You can also easily run an ARP spoofing attack, and not just to sniff but also to manipulate. Done that quite often back in my school time, oh the glorious days when web traffic was mostly plain HTTP.

There were entire command lists going around specifying what exactly one needed to replace, say, the logo of an online newspaper with a picture of a dong.

Even an el cheap basic managed switch will do port mirroring

I got enough data on what was going on by just using dns logs and my router's built in logging.

You can see a lot just with tcpdump on your router: either buy one supported by openwrt or buy a model with shell access available out of the box.

You can also use tcpdump to save a pcap file that can then be analyzed with wireshark.

Could you suggest a small home router? I've been trying to find an 5Ghz / 802.11ax Wifi router with such features.

I’m not sure, you basically have to do the homework for consumer hardware: one issue you’ll run into is that consumer routers often depend on binary blobs and propriety drivers for WiFi functionality like MIMO. Netgear’s firmwares are based on OpenWRT, though, and nearly every netgear device I’ve owned has had some way to get shell access (my current device is a netgear Orbi (RBR40)). It has shell access and tcpdump is included in the base image.

If all you need are connection info, pump the pcap through zeek and you'll get a nice set of rich tab delimited log files you can analyze.

Yeah, zeek is a great tool. It took me a while to recognize it, though, the last time I used it, it was still called “bro”.

A consumer grade router with logging configured to dump to a linux box + opendns.

Had it not worked, I wonder if a letter to Congressman/Senator would also have worked.

Shady traffic with personal information of a CHILD going straight to CHINA sounds like it might get some traction on the issue.

hi indymike, what extension in chrome was causing the ad fraud?

Would prefer not to share this with everyone here. Reach out to me (I'm easy to find on Linkedin and twitter).

Reply on news.ycombinator.com