Students disconnecting from NSS (NetSupport School)

[Ticho]

I'm a fairly observant and tech-savvy guy, so it kinda irks me when someone gets the jump on me and learns how to get around NSS. The thing is that I work in a controlled jail-like facility, so everything is monitored, students and patted down every morning, and all personal belongings are removed from them long before they get to the classroom. The way students access a lot of assignments are through various websites and sub-websites, so instead of approved only, I leave them on block restricted.

 

The first (solved) problem: About a month ago, I noticed a student's computer was disconnected from the network, so that already triggered an alarm in my head. But I gave him the benefit of the doubt and had him move to another computer. Not even thirty minutes later, it happened again. Fortunately, we have cameras on both sides of the room, so after school I found out he was doing something with the LAN cable to disconnect it from my viewing it on NSS, but he could still go on the websites that weren't blocked. That ended that problem.

 

Second time around: Different student, but essentially same deal happening as before, although it didn't involve disconnecting the LAN cables. Happened on one computer, moved him, happened on the new one within five minutes, and had him removed until the staff and I could figure it out. We rolled back the cameras, but both times he made no movement to remove the LAN cables, but both times right before his computer disconnected, he looked around the classroom to make sure nobody was watching, and within five seconds, he types something in, ends a process or something, and you can see the screen flicker on the monitor (which is indicative of it being disconnected from NSS).

 

I've tried multiple things to reproduce the problem, but student computers are set up to not be able to close most processes, and the ones I could close didn't reproduce the bug. If anyone has anything to prevent students from doing stuff like this, it would be greatly appreciated. We could have an additional staff member sitting on one student, but that would be a ridiculous waste of resources.

 

Thanks for any support you can offer!

[angrycomputingteacher]

Boy. I don't use NetSupport but if they can disable it then anyone can. It's a serious issue.

[smurfomatic]

Any chance they've Googled it and are running a process explorer type program, as suggested here:

 

Stopping teachers from spying on what you are doing on school computers - All

[ITJS2015]

Do you have service running in the system tray where students can close the service ?

 

Is task Manager enable for students ?

 

I would look at these to first, I don't think it is necessary for students to have task manager on as even if the pc did not respond to any software it would reload any previous window before

[Ticho]

Any chance they've Googled it and are running a process explorer type program, as suggested here:

 

Stopping teachers from spying on what you are doing on school computers - All

 

We've disabled the ability to run applications outside of Word, Chrome, and videos that we put on there. USB drives are also disabled.

 

Do you have service running in the system tray where students can close the service ?

 

Is task Manager enable for students ?

 

I would look at these to first, I don't think it is necessary for students to have task manager on as even if the pc did not respond to any software it would reload any previous window before

 

Not running in the system tray, but I think it might be related to the task manager. I tried closing the two files related to NSS clients (client32 and crsrs) to replicate it, but no dice.

[ITJS2015]

I used LanSchool back in my old school and student got around from the teacher watching them by going in to safe mode which then stops the service in the back ground but still allow students to access there stuff

 

You may find out

[Al_NetSupport]

I'm a fairly observant and tech-savvy guy, so it kinda irks me when someone gets the jump on me and learns how to get around NSS. The thing is that I work in a controlled jail-like facility, so everything is monitored, students and patted down every morning, and all personal belongings are removed from them long before they get to the classroom. The way students access a lot of assignments are through various websites and sub-websites, so instead of approved only, I leave them on block restricted.

 

The first (solved) problem: About a month ago, I noticed a student's computer was disconnected from the network, so that already triggered an alarm in my head. But I gave him the benefit of the doubt and had him move to another computer. Not even thirty minutes later, it happened again. Fortunately, we have cameras on both sides of the room, so after school I found out he was doing something with the LAN cable to disconnect it from my viewing it on NSS, but he could still go on the websites that weren't blocked. That ended that problem.

 

Second time around: Different student, but essentially same deal happening as before, although it didn't involve disconnecting the LAN cables. Happened on one computer, moved him, happened on the new one within five minutes, and had him removed until the staff and I could figure it out. We rolled back the cameras, but both times he made no movement to remove the LAN cables, but both times right before his computer disconnected, he looked around the classroom to make sure nobody was watching, and within five seconds, he types something in, ends a process or something, and you can see the screen flicker on the monitor (which is indicative of it being disconnected from NSS).

 

I've tried multiple things to reproduce the problem, but student computers are set up to not be able to close most processes, and the ones I could close didn't reproduce the bug. If anyone has anything to prevent students from doing stuff like this, it would be greatly appreciated. We could have an additional staff member sitting on one student, but that would be a ridiculous waste of resources.

 

Thanks for any support you can offer!

 

Hi Ticho. I understand our tech team are in contact with you at the moment to investigate your scenario. I will check with them in a few hours to review progress. As you would expect this is not a typical scenario and not something we have had reported ( other than by schools with Students who had admin rights). Clearly not so in your case.

 

Al.

[mavhc]

About 15 years ago we had the Safe Mode issue with Impero, as a temp measure swapped the boot loader to one that disabled F8, they ended up making the service run in safe mode too I think.

 

Will be interested to hear what the actual problem and solution is for NetSupport

[smurfomatic]

Also, worth installing a keylogger on the machines then you can tell exactly what they've typed in...

[Matt_NetSupport]

Our UK and US support have been in contact with Ticho to assist, one of the suggestions (amongst others) is to monitor user activity using NetSupport School's keylogger feature - we are awaiting feedback.

 

Matt @ NetSupport