Hacker News Reader

Comment by gnicholas | Hacker News Reader

A school IT specialist told me about a clever student hack. Their school blocks all sorts of traffic, but teachers can allow exceptions via a password.

One student installed a keylogger onto his BYOD laptop (many schools allow kids to bring their own, or use a mediocre school-provided device), and then made up a plausible excuse to hit the firewall (e.g., doing a report on anatomy, but innocuous site was blocked because the word "breast" appears).

Then the student presents the laptop to the teacher, who types in the exception password. Since the keylogger is running, the student can now grant himself exceptions to his heart's content.

The school eventually figured this out. It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices?

View on HN

> The school eventually figured this out. It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices?

Make it so the firewall exception process on student devices gives a 6 digit code which the instructor enters into a staff-only interface on the instructor's device, so that the process always requires input on both a student and an instructor's computer.

This requires two devices to have working internet, which is often not the case at schools. Teachers are computer illiterate, to boot.

To be fair, TOTP works offline.

TOTP would do well here for this case for a really simple path forward - but then having the student login themselves and the request be formally logged and allowed via not-their-computer would offer a bit more scaleability and auditability

> TOTP would do well here for this case

Indeed: this is almost exactly the attack type TOTP was designed for.

The idea was that if someone intercepted your network traffic and captured your password, it wouldn't do them any good without also having your code generator.

It turns out that if you have a live MitM connection there are ways around that problem, but TOTP is still helpful against other attacks.

I agree that for this situation, it's probably better to focus on detection than bulletproof enforcement.

There are plenty of better ways. You make the student auth in some manner then grant an exception from your own computer.

Entering the password on the student’s BYOD is pretty stupid

Wholeheartedly agreed. Even if the student has the absolute best of intentions, you have no way of knowing that the laptop doesn't have say, malware on it.

Usually these sorts of passwords are single-purpose just for getting around mundane firewall blocks, so they're not that critical.

So then what? The student just can't go ahead with the assigned task? This probably happens like 20 times a day for them.

> Entering the password on the student’s BYOD is pretty stupid

I wouldn't say it was stupid of the teacher to enter the password, given the amount of technical expertise that elementary school teachers can be expected to possess.

The blame should probably go to the person who set up the exception-granting system, who should have used a system that doesn't involve authenticating on a non-trusted device.

I didn't read it as "it was stupid of the teacher to enter the password" but rather "the system making teachers enter the password on that computer is stupid".

Yes that’s what I meant. I totally understand the stress teachers are under, school funding challenges etc

If teachers are to be trusted with the password then they need training on how to protect the training. And a simple “only enter this password in secure locations” is necessary.

> It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices?

the target of the exception and the device granting the exception do not need to be the same device necessarily. if you have that figured out then yes only allow password entry on locked-down devices.

There's actually many solutions to this.

>You can use certificate based authentication instead of password based. Certificate based authentication COMPLETELY prevents this attack because the student's computer never sees the private key which actually authenticates the teacher to bypass

>You can use time based one-time passwords/HMAC instead of using certificates, with a teacher pulling up an app

>You can have the computer have its password managed by a centralised store which has the ability to rotate said password. When the teacher needs to unlock a computer, they request that computers password from the centralised store, and after it's used, the password is then rotated.

>What I would recommend the most, is just giving each teacher their own credentials and sending the teacher an alert when their credentials were used.

You could easily lock this down, but I honestly don't think it's a good idea. I think using weak security measures actually has a merit, as it grants the teacher some degree of flexibility in how to deal with things, and it grants the kids a greater degree of freedom and education in both what weak security looks like and how cracking security just because it's weak might not be the best idea.

I run a pihole and clients can request an exception and then I grant it on my own device.

Having root type into someone else’s machine that they control is a total noob move and it’s funny the teacher fell for it.

Of course since the student is using a custom machine it’s likely they have a specific ip, host name, and traffic pattern that can identify them (eg, look at the requests across 7 different classrooms and find the single student that’s in all of them before the password spreads too much). Then they can intervene and punish the kid.

Keyloggers aren’t particularly clever or “hackery” and are just a social engineering hack so it’s more malicious than exploratory.

But I’d hope the school doesn’t crack down too hard and instead uses it to teach kids that if you want to be clever you have to be very clever.

>do you tell teachers never to grant exceptions on student-owned devices?

Yes. This is correct from both a security and educational perspective. What kind of example does the opposite set for children?

Don't worry about blocking it via firewall; just log traffic, make it against the rules, and punish kids when they're caught?

Have you met kids before? You'd never get any actual educating done if you were busy constantly punishing them for things they did first and thought about later.

To do it the lazy way: 1) change your password to hunter2, 2) use hunter2 on byod laptop, 3) revert your password.

That doesn't sound like the lazy way to me!

Reply on news.ycombinator.com