michaelmas Posted November 9, 2016 Posted November 9, 2016 Hi, We use Lightspeed here and the pupils are restricted in what they can do and access by time of day and age. We have found that they are bypassing the system using “HotSpot Shield”. They have the app installed on their own personal device and when on the school BYOD wireless they then use this to bypass the security and filtering. We have tested on a device logged in as a pupil and Hotspot Shield ignores and bypasses all filtering. We have implemented all the settings recommended by Lightspeed, but still no joy in stopping this. Have you experienced problems with pupils using Hotspot shield on their personal devices to bypass the school filtering? How have to stopped it? Pupils are on the school internet connection via the BYOD wireless network but the filtering is applied to this network. Thanks.
jhothersall Posted January 17, 2017 Posted January 17, 2017 im getting the same at the moment, got a call logged with BTLS
enjay Posted January 18, 2017 Posted January 18, 2017 Puffin Browser is another which gets round the filtering. With Lightspeed's help, I managed to block Betternet which was the VPN of choice here, but there are others which seem unblockable. Our AUP has clear sanctions for students found using them.
jhothersall Posted February 6, 2017 Posted February 6, 2017 Yeah, it seems to just be this one app. I have tested others. Lightspeed don't seem to be helping much..
Achandler Posted February 6, 2017 Posted February 6, 2017 You need to find the URL they are accessing through the App then block it, Opera Mini use to do this and was the first I remember doing it. They all access a URL or IP in the end though that you can usually block and it stops it working.
jhothersall Posted February 6, 2017 Posted February 6, 2017 That won't work either it's using genuine sll certs. When using it looks like your going to getadobe.com or even Mozilla.org
jhothersall Posted March 9, 2017 Posted March 9, 2017 Anyone got a update to this? I even contactec JANET (JISC) and they said that is is down to BTLS to filter these type of things.
michaelmas Posted March 9, 2017 Author Posted March 9, 2017 All the software VPNs are a nightmare. LightSpeed have offered suggestions, but none of them work. To be honest, I don’t think they know how to stop them. We had to block update.microsoft.com on our BYOD system as Hotspot Shield spoofs this address. They also use dynamic IP addresses, so you would be there for days blocking all the IP addresses, only for them to change again.. It is not just Hotspot Shield, there are hundreds of these things all designed to bypass any security and filtering you have in place. Our pupils change the VPN they use every few days to try and stay one step ahead of us. I just want a solution that stops them, but still allows Skype, etc so our overseas pupils can still contact home.
mcolbourn Posted March 9, 2017 Posted March 9, 2017 Michaelmas Does your firewall not provide layer 7 filtering? We also use Lightspeed for web filtering but we also have a Watchguard device and using application control we have locked down all outgoing rules by using whitelisting not blacklisting.
enjay Posted March 13, 2017 Posted March 13, 2017 With Lightspeed's help, we blocked the common VPNs but found we couldn't stop people connecting a VPN using their mobile data and then switching to our wifi.
jhothersall Posted March 13, 2017 Posted March 13, 2017 Michaelmas Does your firewall not provide layer 7 filtering? We also use Lightspeed for web filtering but we also have a Watchguard device and using application control we have locked down all outgoing rules by using whitelisting not blacklisting. We don't have a firewall on site just a Cisco box and light speed this is manged offsite
mcolbourn Posted March 13, 2017 Posted March 13, 2017 With Lightspeed's help, we blocked the common VPNs but found we couldn't stop people connecting a VPN using their mobile data and then switching to our wifi. Thats where L7 filtering comes in as it sees what application is trying to connect and drops it if necessary.
deano3693 Posted March 17, 2017 Posted March 17, 2017 Can I enquire as to what Lightspeed advice on this was. Our top domains visited our get.adobe.com and Mozilla.org etc which all sound like they are related to Hotspot shield!
jhothersall Posted March 17, 2017 Posted March 17, 2017 We did a report on users visiting emiratesnbd.com as we use Captive Portal and got users of the app. The URL is unusual and I can't find a good reason to view it.
jhothersall Posted March 17, 2017 Posted March 17, 2017 Thats where L7 filtering comes in as it sees what application is trying to connect and drops it if necessary. New Web Filter 3 will have later 7
enjay Posted March 20, 2017 Posted March 20, 2017 Can I enquire as to what Lightspeed advice on this was. Our top domains visited our get.adobe.com and Mozilla.org etc which all sound like they are related to Hotspot shield! For us, it was cloudfront.net, which is bit annoying as quite a few sites use this particular CDN, so we have blocked the entire domain and then unblock specific sub-domains on request. Only, our most-visited domain is currently download.microsoft.com
jhothersall Posted March 20, 2017 Posted March 20, 2017 For us that emirates site everyone is using the app.
jhothersall Posted March 22, 2017 Posted March 22, 2017 a few more URL's a get.adobe.com and mozilla.org, finally getting usage down and proactivaly running reports to stop use.
enjay Posted March 22, 2017 Posted March 22, 2017 a few more URL's a get.adobe.com and mozilla.org, finally getting usage down and proactivaly running reports to stop use. How are those domains being used to bypass? Have they got CDNs on them which are being used to run proxy bypass sites?
deano3693 Posted March 24, 2017 Posted March 24, 2017 We traced it back to duckshield.com after a week long investigation and monitoring proxy logs/firewall logs and once we blocked this the VPN can't even connect! Win Win! Lots of unhappy students now lol
jhothersall Posted March 27, 2017 Posted March 27, 2017 (edited) Perfect, thank you so much, it does do something but still works just takes longer to connect. Edited March 27, 2017 by jhothersall
enjay Posted March 27, 2017 Posted March 27, 2017 We traced it back to duckshield.com after a week long investigation and monitoring proxy logs/firewall logs and once we blocked this the VPN can't even connect! Our problem is students connecting the VPN over their 4G then switching to our wifi. Any suggestions how to block that greatly appreciated...
jhothersall Posted March 27, 2017 Posted March 27, 2017 We not got 4g here, but blocking duckshield.com not stopped it.
enjay Posted March 27, 2017 Posted March 27, 2017 We not got 4g here, but blocking duckshield.com not stopped it. Fair point. I should have said "mobile data" not "4G". In my experience of other VPNs, if the student connects the VPN over the cellular and then switches to WiFi, the VPN holds even if the site used to connect it is blocked.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now