Student Smoothwall Bypass For Youtube

[TriggerHappyUK]

Good morning all,

 

Hope you can help us out.

We've come across a weird Smoothwall bypass students are using to get onto YouTube. It doesn't give full functionality, but they can get to most, if not all, videos. Certainly all the random videos we've tested with.

 

Our Smoothwall update level is Leeds-59

The browser being used is Chrome.

 

What the students are doing is googling a video. Clicking on the search result. This brings up the Smoothwall content blocked page. All good so far...

But, students are then clicking the browser refresh button lots of times very quickly. Within about 2-3 clicks, the page opens and the video plays.

It's like the fast clicking overwhelms the Smoothwall block

 

Has anyone else come across this? If so, why does it happen and how can we stop it :-)

 

Thanks for reading

 

C

Edited May 11, 2022 by TriggerHappyUK

[slugshead]

You block youtube?

[TriggerHappyUK]

You block youtube?

 

For students, Yes

For staff, No

[DeGrimmy]

We're on Leeds-57, and I'm not able to replicate the issue following those steps. Perhaps it could be something with the newer version? We also installed a new Smoothwall box recently, so I don't know if that makes a difference?

[TriggerHappyUK]

Here is a quick video of the bypass in action:

 

 

Logged in as a student.

First I try to open Youtube - Blocked

Refresh page - Unblocked

Click on different video - Blocked

Refresh page - Unblocked

Search top 40 songs - Blocked

Refresh page - Unblocked

Choose video - Blocked

Refresh page - Unblocked

[drewp]

Do you have a HTTPS Inspection rule doing Decrypt inspect for Youtube?

 

Do you have a Content Modification Policy to remove QUIC Header? (Who=Everyone, What=Everything, Where=Everywhere, Action=Apply, Remove QUIC Header)

 

There is a Content Modification Policy that can remove YouTube Adverts (Who Everyone, What YouTube, Where Everywhere, Action Apply, YouTube:Remove Adverts)

[PaddyNewman]

Just block UDP 80 + 443 on your firewall, be specific when opening UDP 80 and 443 to other locations. If you can FQDN, makes it easier, but bulk deny on UDP 443 is all we do, if you NEED it, provide the destination etc.

[robyholmes]

We're having problems accessing YouTube for staff. Smoothwall logs show much requests from staff usernames have group information, some however are blank and they get a YouTube block. Refresh the page or try the link a few times and you get lucky.

 

I couldn't be that the group information missing from staff is being attached to students could it?

[TriggerHappyUK]

We're having problems accessing YouTube for staff. Smoothwall logs show much requests from staff usernames have group information, some however are blank and they get a YouTube block. Refresh the page or try the link a few times and you get lucky.

 

I couldn't be that the group information missing from staff is being attached to students could it?

 

This is the first time I've had a Smoothwall.

 

I'm still unraveling how things work here. Only took over completely last summer. Previous NM was a network/security guru. So lots of unique settings to work out what they are and why they are there.

[QwertyMash]

Just a thought but do you have any other products such as a Watchguard Firewall or even using group policy to block YouTube even if its just a stop gap while you maybe speak to Smoothwall support?

[TriggerHappyUK]

Do you have a HTTPS Inspection rule doing Decrypt inspect for Youtube?

 

Do you have a Content Modification Policy to remove QUIC Header? (Who=Everyone, What=Everything, Where=Everywhere, Action=Apply, Remove QUIC Header)

 

There is a Content Modification Policy that can remove YouTube Adverts (Who Everyone, What YouTube, Where Everywhere, Action Apply, YouTube:Remove Adverts)

 

Yes

No - None set

[TriggerHappyUK]

Just a thought but do you have any other products such as a Watchguard Firewall or even using group policy to block YouTube even if its just a stop gap while you maybe speak to Smoothwall support?

 

No, only Smoothwall does our filtering/firewall

[drewp]

You could turn on some advanced settings for the block page to show which group the user account is in, this might show if the user is in multiple groups with mulitple policies being applied.

Guardian> Block Page> Block Pages

Edit the block page you have configured, then click on Advanced. Select "Show user group"

 

You could use the policy checker to see what policies are being applied to the user or group

Guardian> Policy tester

 

Would be worthwhile creating a support ticket with Smoothwall!

[Oaktech]

I've got a smoothie at the same patch level on one of my sites - I'll try this tomorrow.

 

PS, Nice to see another South Coast tech!

[mrstrong]

leeds-56 and getting similar results (i.e. partially unblocked on refresh)

@TriggerHappyUK nice video by the way, what software do you use to record the screen like that ?

 

 

edit: just tried adding explicit block rule at top but made no difference:

 

Edited May 12, 2022 by mrstrong

[robyholmes]

Just out of interest, do you block Youtube by default in your core blocked rule (Bottom of the list), or do you block it on the Pupils group?

 

IE, do you allow staff / visitors access, or do you allow everyone but block pupils?

[TriggerHappyUK]

I've got a smoothie at the same patch level on one of my sites - I'll try this tomorrow.

 

PS, Nice to see another South Coast tech!

 

Will be good to know how your tests go.

 

Indeed, not just the South Coast. Practically neighbours

[TriggerHappyUK]

@TriggerHappyUK nice video by the way, what software do you use to record the screen like that ?

 

I was remoted onto one of our test computers using Impero, logged in as a student. Then used OBS on my PC to record the monitor that was showing the screen of the test computer.

[mrstrong]

testing on a chromebook, when they first go to youtube.com they get the

"Before you continue to YouTube" cookies popup,

if they click sign in they get default block page: url: https://accounts.youtube.com

but if they click "accept/reject all" the page partially loads (no video thumbnails)

though you can click on a video, one played yesterday but today just gettin spinning circle

lots of denied in the web filter log too but why no blockpage ?

[robyholmes]

How are people blocking YouTube? Do you have it default blocked then allow staff, or default allowed then block students?

 

We're having random issues with authenticated users not been put in to the groups. As we default block YouTube students aren't getting on, but staff are being blocked randomly with the group on the block page shown as 'N/A'. Smoothwall are trying to replicate it there side of things to see if it's a bug. I'm wondering if the issues you are seeing could be linked if you block it via a group. IE when students get access, it's because they don't have a group of 'Pupils' or 'Students'.

[mrstrong]

was set up by our LEA: in core blocked content YouTube is not ticked so I guess that means

by default everyone can access it and I've added the block for students at the top (1st web filter policy)

[robyholmes]

was set up by our LEA: in core blocked content YouTube is not ticked so I guess that means

by default everyone can access it and I've added the block for students at the top (1st web filter policy)

Interesting. Can you add a rule too decrypt and inspect to not inspect YouTube and see if it fixes the issue? I have a feeling it might (Although not a solution of course, but intestering to see).

[robyholmes]

Interesting. Can you add a rule too decrypt and inspect to not inspect YouTube and see if it fixes the issue? I have a feeling it might (Although not a solution of course, but intestering to see).

 

Did anyone try this? Did it make a difference?

[TriggerHappyUK]

**UPDATE**

The Smoothwall Triage Team have reviewed this Ticket and concluded this needs to be escalated to our 2nd Line Team for further analysis.

 

Interesting... They must be able to replicate the issue, if it's going upstairs.

Edited May 18, 2022 by TriggerHappyUK

[robyholmes]

**UPDATE**

The Smoothwall Triage Team have reviewed this Ticket and concluded this needs to be escalated to our 2nd Line Team for further analysis.

 

Interesting... They must be able to replicate the issue, if it's going upstairs.

 

Did you try adding YouTube to a 'Don't inspect' HTTPS rule to see if it fixes it? We had 2nd line look at our Smoothwall and we found anything not being inspected worked correctly, but as soon as you inspect it we'd have things go through the filter with no group information (But username info, showing authentication working). This would account for students being allowed YouTube if you block it via a group.