Re:Parents demand academic publisher drop Proctorio surveill...
by indymike on Tuesday December 22, 2020 @10:12AM
(#25506946)
At the beginning of the school year, I noticed some strange HTTP traffic going through my home router to China and India endpoints. So, I traced the traffic to the Chromebooks my kids in public school were using. About that time, my son was unable to access his drum lessons (Steven's Drum Shed, highly recommend) because safety software provided by the school was blocking him. After analyzing the chromebook more, I discovered the traffic going to China was requesting ads and then requesting the hyperlink for the ad (ok, so ad fraud it is). I also noticed that the safety software was logging all HTTP requests to their server. So, I went to the school district and requested they remove it. They initially said, "if we remove it, your kids won't be able to access their academic work." So, I sent a letter to the Superintendent that politely asked they remove the safety software from my family's chromebook as it violated my children's and my family's rights (unreasonable search, get a warrant). I also told them I would hold them responsible for the cost of having the software removed by an expert (which my lawyer suggested would be the thing that got their attention and we'd be able to win in small claims court). The next day, they removed the "safety" software.
[ Parent
| on HN ]
Re:Parents demand academic publisher drop Proctorio surveill...
by dekhn on Tuesday December 22, 2020 @10:19AM
(#25507020)
As a reminder, if you want to achieve anything with chools, this is how you do it. A polite letter, nonthreatening, filled with facts, and a cost to the school if they continue.
Re:Parents demand academic publisher drop Proctorio surveill...
by lotsofpulp on Tuesday December 22, 2020 @12:24PM
(#25508716)
The threat of costs from the small claims court system is the only reason they achieved anything.
Re:Parents demand academic publisher drop Proctorio surveill...
by reaperducer on Tuesday December 22, 2020 @02:59PM
(#25510470)
Probably not. School districts have lawyers on staff. It's not you or me who would have a new expense of $x/hour for a lawyer.
Re:Parents demand academic publisher drop Proctorio surveill...
by _fat_santa on Tuesday December 22, 2020 @10:50AM
(#25507434)
So the safety software was committing ad fraud? Were you able to pry anymore details from the requests or did you simply go to the school and ask that it be removed?
Re:Parents demand academic publisher drop Proctorio surveill...
by indymike on Wednesday December 23, 2020 @10:26AM
(#25518511)
I was able to identify about 200 fraudulent ad clicks. BTW - I don't know if it was the safety software or something else that was force-installed by the software. I wasn't looking to do a deep analysis, I suspected the safety extension was doing more than it should and confirmed it. I gathered enough evidence that a competent admin would conclude the safety software was not safe and connected with the school.
Re:Parents demand academic publisher drop Proctorio surveill...
by drzoltar on Tuesday December 22, 2020 @11:34AM
(#25508004)
Could you elaborate on the suite of tools you used to do this kind of network traffic analysis?
Re:Parents demand academic publisher drop Proctorio surveill...
by fiddlerwoaroof on Tuesday December 22, 2020 @12:33PM
(#25508828)
You can see a lot just with tcpdump on your router: either buy one supported by openwrt or buy a model with shell access available out of the box.
You can also use tcpdump to save a pcap file that can then be analyzed with wireshark.
Re:Parents demand academic publisher drop Proctorio surveill...
by bane on Tuesday December 22, 2020 @03:42PM
(#25510995)
If all you need are connection info, pump the pcap through zeek and you'll get a nice set of rich tab delimited log files you can analyze.
Re:Parents demand academic publisher drop Proctorio surveill...
by fiddlerwoaroof on Friday December 25, 2020 @01:21PM
(#25538053)
Yeah, zeek is a great tool. It took me a while to recognize it, though, the last time I used it, it was still called “bro”.
Re:Parents demand academic publisher drop Proctorio surveill...
by fingerlocks on Tuesday December 22, 2020 @02:14PM
(#25509959)
Could you suggest a small home router? I've been trying to find an 5Ghz / 802.11ax Wifi router with such features.
Re:Parents demand academic publisher drop Proctorio surveill...
by fiddlerwoaroof on Tuesday December 22, 2020 @05:30PM
(#25512145)
I’m not sure, you basically have to do the homework for consumer hardware: one issue you’ll run into is that consumer routers often depend on binary blobs and propriety drivers for WiFi functionality like MIMO. Netgear’s firmwares are based on OpenWRT, though, and nearly every netgear device I’ve owned has had some way to get shell access (my current device is a netgear Orbi (RBR40)). It has shell access and tcpdump is included in the base image.
Re:Parents demand academic publisher drop Proctorio surveill...
by indymike on Wednesday December 23, 2020 @10:21AM
(#25518444)
A consumer grade router with logging configured to dump to a linux box + opendns.
Re:Parents demand academic publisher drop Proctorio surveill...
by err4nt on Tuesday December 22, 2020 @11:53AM
(#25508299)
Not the original commenter but I've heard of people debugging smart TV's using https://www.wireshark.org to see the network requests, you would connect the device you want to inspect to a network being shared through your computer running Wireshark, and then you can analyze every request going in and out (or at least see them and be aware of the traffic)
Re:Parents demand academic publisher drop Proctorio surveill...
by indymike on Wednesday December 23, 2020 @10:22AM
(#25518458)
I got enough data on what was going on by just using dns logs and my router's built in logging.
Re:Parents demand academic publisher drop Proctorio surveill...
by cgriswald on Tuesday December 22, 2020 @02:35PM
(#25510177)
Alternatively, put your NIC into promiscuous mode and capture the traffic that way.
Re:Parents demand academic publisher drop Proctorio surveill...
by nitrogen on Tuesday December 22, 2020 @02:46PM
(#25510305)
That only works if you use a hub instead of a switch, or if the traffic is broadcast, or if you somehow convince the switch to give your port all traffic. It's easiest to just use two NICs bridged in one PC as a MITM.
Re:Parents demand academic publisher drop Proctorio surveill...
by mschuster91 on Tuesday December 22, 2020 @03:32PM
(#25510880)
You can also easily run an ARP spoofing attack, and not just to sniff but also to manipulate. Done that quite often back in my school time, oh the glorious days when web traffic was mostly plain HTTP.
There were entire command lists going around specifying what exactly one needed to replace, say, the logo of an online newspaper with a picture of a dong.
Re:Parents demand academic publisher drop Proctorio surveill...
by dialamac on Tuesday December 22, 2020 @04:27PM
(#25511449)
Even an el cheap basic managed switch will do port mirroring
Re:Parents demand academic publisher drop Proctorio surveill...
by 908B64B197 on Wednesday December 23, 2020 @02:02PM
(#25520848)
Had it not worked, I wonder if a letter to Congressman/Senator would also have worked.
Shady traffic with personal information of a CHILD going straight to CHINA sounds like it might get some traction on the issue.