Smoothwall, Google Classroom and YouTube - An exploit to bypass Smoothwall block

[DeGrimmy]

Here's a tricky one - We've just seen that some students have discovered a way around our Smoothwall blanket block of YouTube using Google Classroom. Our policy is as such:

 

- YouTube is set to Moderate Restricted Mode in Google Workspace. Users can watch restricted and approved videos.

 

- Smoothwall blocks YouTube for students, EXCEPT for an allow list which allows students access to specific YouTube links only. This way, students cannot go to YouTube.com and start searching for videos - Videos must be sent to us by teachers and approved by us before students have access.

 

The issue is this: The student will go into Google Classroom, to one of their classes. On the Stream tab, if posts can be made by students (which is by default ON in Google Classroom), they can click on "Add YouTube video" and then just start searching for YouTube videos. Moderate Restricted Mode still applies, so many of the videos are unapproved. However, this means our Smoothwall allow list is bypassed, as students can search for and click on videos that have not been added to the allow list in Smoothwall.

 

We've found a setting in the Classroom settings that will disallow students from posting to the Stream tab and only allows comments, which disables the workaround. However, as far as we can see, there is no way to turn this off for all Classrooms, so the teachers would have to go through all of their Classrooms and switch this off manually.

 

I realise now that I've probably posted this in the wrong place, so I apologise in advance - But since it involves Smoothwall, I thought I'd post it here. As this is the only way we can see to remove this bypass, does anyone know of a way to change this setting in Google Classroom en masse? I don't think we can rely on teachers to go through every single class they have on Google Classroom and switch the setting off.

 

Thanks in advance!

[ibpalle]

Interesting workaround. I assume HTTPS inspection is off for classroom and/or youtube traffic?

[DeGrimmy]

Interesting workaround. I assume HTTPS inspection is off for classroom and/or youtube traffic?

We have HTTPS inspection on for YouTube. Google Classroom is part of our Custom Allowed Content category, which is set to Do Not Inspect, and we're worried about what might happen if we remove it from there.

[David44]

Surely the youtube traffic should still hit any youtube rules you have set up unless Google Classroom is doing something like proxying the videos. As far as I can see it isn't doing that, Google Classroom just embeds the video like any other site would.

[CSmith]

Hi @DeGrimmy - it looks like the YouTube content is coming from gstatic.com/_/mss/boq-edu-youtube/ - if you add that URL to your custom blocked content category it should stop YouTube results from showing up via Google Classroom.

[DeGrimmy]

Hi @DeGrimmy - it looks like the YouTube content is coming from gstatic.com/_/mss/boq-edu-youtube/ - if you add that URL to your custom blocked content category it should stop YouTube results from showing up via Google Classroom.

Thanks! I'll set this up now and give it a test.

[DeGrimmy]

Hi @DeGrimmy - it looks like the YouTube content is coming from gstatic.com/_/mss/boq-edu-youtube/ - if you add that URL to your custom blocked content category it should stop YouTube results from showing up via Google Classroom.

Unfortunately, this has had no effect and students are still able to search YouTube through Classroom. Could this be because we have classroom.google.com in Custom Allowed Content?

[PaddyNewman]

I would suggest you decrypt it and if it breaks remove specific ones that break. Without actually decrypting all your content, its always going to give you spurious results like this.

 

Google can be fickle with this though, so make sure QUIC and the like are also denied.