Lightspeed and Hotspot Shield

[michaelmas]

Hi,

We use Lightspeed here and the pupils are restricted in what they can do and access by time of day and age.

We have found that they are bypassing the system using “HotSpot Shield”. They have the app installed on their own personal device and when on the school BYOD wireless they then use this to bypass the security and filtering.

We have tested on a device logged in as a pupil and Hotspot Shield ignores and bypasses all filtering.

We have implemented all the settings recommended by Lightspeed, but still no joy in stopping this.

Have you experienced problems with pupils using Hotspot shield on their personal devices to bypass the school filtering?

How have to stopped it?

Pupils are on the school internet connection via the BYOD wireless network but the filtering is applied to this network.

Thanks.

 

[jhothersall]

im getting the same at the moment, got a call logged with BTLS

[enjay]

Puffin Browser is another which gets round the filtering. With Lightspeed's help, I managed to block Betternet which was the VPN of choice here, but there are others which seem unblockable. Our AUP has clear sanctions for students found using them.

[jhothersall]

Yeah, it seems to just be this one app. I have tested others. Lightspeed don't seem to be helping much..

[Achandler]

You need to find the URL they are accessing through the App then block it, Opera Mini use to do this and was the first I remember doing it.

 

They all access a URL or IP in the end though that you can usually block and it stops it working.

[jhothersall]

That won't work either it's using genuine sll certs. When using it looks like your going to getadobe.com or even Mozilla.org

[jhothersall]

Anyone got a update to this? I even contactec JANET (JISC) and they said that is is down to BTLS to filter these type of things.

[michaelmas]

All the software VPNs are a nightmare.

LightSpeed have offered suggestions, but none of them work. To be honest, I don’t think they know how to stop them.

We had to block update.microsoft.com on our BYOD system as Hotspot Shield spoofs this address. They also use dynamic IP addresses, so you would be there for days blocking all the IP addresses, only for them to change again..

 

It is not just Hotspot Shield, there are hundreds of these things all designed to bypass any security and filtering you have in place. Our pupils change the VPN they use every few days to try and stay one step ahead of us.

I just want a solution that stops them, but still allows Skype, etc so our overseas pupils can still contact home.

 

[mcolbourn]

Michaelmas

 

Does your firewall not provide layer 7 filtering?

 

We also use Lightspeed for web filtering but we also have a Watchguard device and using application control we have locked down all outgoing rules by using whitelisting not blacklisting.

[enjay]

With Lightspeed's help, we blocked the common VPNs but found we couldn't stop people connecting a VPN using their mobile data and then switching to our wifi.

[jhothersall]

Michaelmas

 

Does your firewall not provide layer 7 filtering?

 

We also use Lightspeed for web filtering but we also have a Watchguard device and using application control we have locked down all outgoing rules by using whitelisting not blacklisting.

 

We don't have a firewall on site just a Cisco box and light speed this is manged offsite

[mcolbourn]

With Lightspeed's help, we blocked the common VPNs but found we couldn't stop people connecting a VPN using their mobile data and then switching to our wifi.

 

Thats where L7 filtering comes in as it sees what application is trying to connect and drops it if necessary.

[deano3693]

Can I enquire as to what Lightspeed advice on this was. Our top domains visited our get.adobe.com and Mozilla.org etc which all sound like they are related to Hotspot shield!

[jhothersall]

We did a report on users visiting emiratesnbd.com as we use Captive Portal and got users of the app. The URL is unusual and I can't find a good reason to view it.

[jhothersall]

Thats where L7 filtering comes in as it sees what application is trying to connect and drops it if necessary.

 

New Web Filter 3 will have later 7

[enjay]

Can I enquire as to what Lightspeed advice on this was. Our top domains visited our get.adobe.com and Mozilla.org etc which all sound like they are related to Hotspot shield!

 

For us, it was cloudfront.net, which is bit annoying as quite a few sites use this particular CDN, so we have blocked the entire domain and then unblock specific sub-domains on request.

 

Only, our most-visited domain is currently download.microsoft.com

[jhothersall]

For us that emirates site everyone is using the app.

[jhothersall]

a few more URL's a get.adobe.com and mozilla.org, finally getting usage down and proactivaly running reports to stop use.

[enjay]

a few more URL's a get.adobe.com and mozilla.org, finally getting usage down and proactivaly running reports to stop use.

 

How are those domains being used to bypass? Have they got CDNs on them which are being used to run proxy bypass sites?

[jhothersall]

Not sure, but Lightspeed reports this.

[deano3693]

We traced it back to duckshield.com after a week long investigation and monitoring proxy logs/firewall logs and once we blocked this the VPN can't even connect!

 

Win Win! Lots of unhappy students now lol

[jhothersall]

Perfect, thank you so much, it does do something but still works just takes longer to connect. Edited March 27, 2017 by jhothersall

[enjay]

We traced it back to duckshield.com after a week long investigation and monitoring proxy logs/firewall logs and once we blocked this the VPN can't even connect!

 

Our problem is students connecting the VPN over their 4G then switching to our wifi. Any suggestions how to block that greatly appreciated...

[jhothersall]

We not got 4g here, but blocking duckshield.com not stopped it.

[enjay]

We not got 4g here, but blocking duckshield.com not stopped it.

 

Fair point. I should have said "mobile data" not "4G". In my experience of other VPNs, if the student connects the VPN over the cellular and then switches to WiFi, the VPN holds even if the site used to connect it is blocked.