Python - Security Implicatons

[Bert123]

Hi All

 

I have a request from a the computing department to install Python onto 24 desktop PCs as part of GCSE curriculum.

 

I have concerns around the security implications for my network and I'm currently considering disconnecting the desktops from the network.

 

Any advice re safer alternatives or thoughts in general would be gratefully received.

 

Thanks

[FN-GM]

What security concern do you have? If you're properly setup already you shouldn't have any issues.

[Bert123]

Our ICT Suppliers installed and configured the domain over the summer, I'm concerned about students being able to cause havoc on my network :-)

[FN-GM]

But how could they use python to cause havoc?

[Ditto]

@Tefters has a thread (the one with the partially redacted expletives!) where a breach has happened. The conclusion would be that for the breach to occur, the setup must not have been right. How does one ensure the setup is 'proper'?

[kennysarmy]

Hi All

 

I have a request from a the computing department to install Python onto 24 desktop PCs as part of GCSE curriculum.

 

I have concerns around the security implications for my network and I'm currently considering disconnecting the desktops from the network.

 

Any advice re safer alternatives or thoughts in general would be gratefully received.

 

Thanks

 

Maybe you need this: https://www.virtualbox.org/

 

Set it up right and student will have a complete sandboxed environment in which to code, play and destroy the PC, with all changes being reset at each reboot.

[Passat1983ICTech]

have you thorght of putting on a vm and let them access the vm that for Python it works fine her

[Martin48]

Originally I set python on a vm on virtual box, got a few issues with service not starting on boot, but worked for the year.

 

Then we took another school what already had python in use, re-looked in to this and decided a computer program cannot do anymore then the user permissions it runs under (so setup security properly in the first place), that being said it can do it fast so it can do brute forcing, guesing passwords, and also network communication.

 

For this reason we got our software firewall to specifically block python and pythonw, and we setup a security group "student programmers" and only allowed applocker to run that for all staff and students in that group, allowing us to block it for bored 6th formers not doing IT and any student who posses a risk for anything. We have notifications for the brute forcing.

[Geoff]

If you are worried about Python, you need to remove Powershell as well (Hint: Powershell is a built in feature of Windows 10 you cannot remove).

[Martin48]

You can actually block the powershell exe's with applocker and stop scripts from running just as you can with cscript and wscript, however yes I take your point as if you are worried about python you can also just use the vbscript within any office document.

[Ditto]

Maybe you need this: https://www.virtualbox.org/

Set it up right and student will have a complete sandboxed environment in which to code, play and destroy the PC, with all changes being reset at each reboot.

 

Have gone a fair way down this route and am able to config a environment with the network card disabled (USBs disabled on host anyway) so I think on the way to 'setting it up right'. Two current challenges:

 

a) how to get the VM running without using the VirtualBox manager as that allows properties to be changed - and indeed complete new images to be created?

b) how best to roll this out to in ICT suite

Edited December 15, 2017 by Ditto

[Geoff]

Powershell is that embedded into Windows 10 I'd be hesitant to disable it for fear of causing issues. It's like trying to disable IE.

[mrcrazy04]

Powershell is that embedded into Windows 10 I'd be hesitant to disable it for fear of causing issues. It's like trying to disable IE.

I'd say it's as embedded as the command prompt, so you should be able to block it for low privileged users without issues (assuming you don't have PowerShell login scripts or similar running as those users).

I've seen it disabled in quite a few environments (it's one of the first things I go for when trying to gain elevated privileges on a system) without any problems.

[jthompson]

Set up a Virtual box VM for all Python coding here. The VM has no network access, and the Virtual box management interface is locked down to prevent modification or adding of any VMs (all done with a login script). The students can bust what they like in the VM, without it affecting the host machine or wider network in any way.

 

Prank scripts were quite common here (e.g. infinite loops spawning endless instances of calc.exe), but these now no longer bog down the physical PCs.

 

Students store their scripts in their usual user area, which is passed through to the VM using Virtual box options (i.e. not done as a direct drive map in the VM, as it has no network). The only place they can run them is in the VM, so they can store what they like.

 

The VirtualBox executable also has some custom permissions set, to allow us to ban individual users from launching if necessary.

[synaesthesia]

Have gone a fair way down this route and am able to config a environment with the network card disabled (USBs disabled on host anyway) so I think on the way to 'setting it up right'. Two current challenges:

 

a) how to get the VM running without using the VirtualBox manager as that allows properties to be changed - and indeed complete new images to be created?

b) how best to roll this out to in ICT suite

 

Search on these forums for virtualbox programming and you'll find a large thread with all the commands you need to start it headless with all the relevant restrictions in place (can't do it here as not on my PC). Next to nothing they can do to break it apart from shutting it down improperly.