Client-less way of checking what students type

[dmj]

Telling staff not to use Kahoot or Blooket doesn't feel like the right response.

 

Quite! Tell your DSL.

 

Anyway I thought there was a Government bill to stop people posting anonymously... isn't it illegal for the sites to do this already.

[enjay]

I'll appreciate it's not what the OP wants to hear but my feeling is that most schools will ultimately move away from BYOD for pupils in favour of school-issued and managed devices

 

You may be right, although for us that would be around £100K per year to maintain.

 

- - - Updated - - -

 

Quite! Tell your DSL.

 

That's who asked me to look into possible solutions!

[PaddyNewman]

If you are keylogging, you need to manage the machines, and to effectively do that, you NEED a client on a managed school device.

 

If you allow unmanaged devices on your internet, your obligation is to make sure that feed is filtered and firewalled. Either allow them and accept the short fall there which is "they are not school owned, therefore we cannot do more" or terminate BYOD personal devices. Try their 4G, get to all of the internet.

 

TLDR you cant do anything on your internet feed to keylog, its client based. You can SSL inspect and see the full URI/search/but typed content is not usually captured without a client.

Edited October 18, 2024 by PaddyNewman

[sigma]

The particular incident which brought this to the forefront was a highly offensive username in a Kahoot quiz or similar, but it sits amidst a rising trend of using various platforms to make anonymous libellous, reputation-damaging comments about our staff.

We’ve had the offensive usernames, and trapped them with Impero.

 

The comments about staff on various platforms can’t be made on school devices, but of course, that doesn’t stop them.

[mavhc]

You may be right, although for us that would be around £100K per year to maintain.

 

Give a laptop is about £350 and lasts for, say 5 years, that's £70/year out of the over £7000 per pupil funding per year, so it's 1% of your funding. Someone chose to make life harder for themselves and not fund IT properly

[jmak]

Give a laptop is about £350 and lasts for, say 5 years, that's £70/year out of the over £7000 per pupil funding per year, so it's 1% of your funding. Someone chose to make life harder for themselves and not fund IT properly

I know Mav's post will wind some people up and it's much easier to say then to achieve. But he's spot on.

 

I have similar conversations in my non-school setting. We're actually paying people and we could measure how much it costs us to fail to provide suitable IT kit for employees. It's still difficult to persuade people to spend the money.

[dmj]

Here's a method I think would work:

 

 

• Setup the wifi such that on connection it sends the user to instructions to add a public ssl key.
  
• Setup a mitmproxy using the ssl private key
  
• put the mitmproxy before your internet and use iptables to forward to the internet (mitmproxy)
  
• redirect outbound traffic to the mitmproxy gateway
  
• use mitmdump to intercept the traffic
  
• Either: inspect on the fly by piping through ripgrep using your word list (probably too slow?) or send all the logs to ELK/datadog/whatever for realtime analysis
  
• setup an alert on matched keywords
  

 

It's not trivial to setup but that's how I would attempt it if management didn't pursue any of the less crazy options.

[davinderkundi]

I totally get where you’re coming from—it’s tricky to monitor what students are typing without installing something on their devices. When I worked on a similar issue, we used a web filtering service that kept track of the sites visited and flagged anything inappropriate. It didn’t show everything they typed, but it definitely helped us catch some red flags. You could also look into network monitoring tools that give you an overview of traffic. Just remember to be open with the students about why you’re monitoring things; it helps build trust and keeps the lines of communication open.

[PaddyNewman]

Here's a method I think would work:

 

 

• Setup the wifi such that on connection it sends the user to instructions to add a public ssl key.
  
• Setup a mitmproxy using the ssl private key
  
• put the mitmproxy before your internet and use iptables to forward to the internet (mitmproxy)
  
• redirect outbound traffic to the mitmproxy gateway
  
• use mitmdump to intercept the traffic
  
• Either: inspect on the fly by piping through ripgrep using your word list (probably too slow?) or send all the logs to ELK/datadog/whatever for realtime analysis
  
• setup an alert on matched keywords
  

 

It's not trivial to setup but that's how I would attempt it if management didn't pursue any of the less crazy options.

Forgive me if I'm wrong, but this is just a web filtering setup. You've just described a proxy based web filter to me. That's going to capture the URI and the string, but won't have the context, content or ability to read inputs, just what is fed to the proxy.

[dmj]

Forgive me if I'm wrong, but this is just a web filtering setup. You've just described a proxy based web filter to me. That's going to capture the URI and the string, but won't have the context, content or ability to read inputs, just what is fed to the proxy.

 

Similar, but from what I can tell mitmdump will capture and decrypt the body if the http traffic, which should contain the offending language.

 

If it was using squid, I would qgree

Edited October 20, 2024 by dmj

[PaddyNewman]

Oh I think I get you, physically taking the content of the whole page and running that through a lookup, rather than relying on URI. Similar to doing a quick wget..

 

Interesting, even with compression that's going to consume storage, but I guess if you log the bad and bin the stuff considered safe... I might actually give that a pop at home.

[lukefowler2024]

logging people's keystrokes especially on their own devices is VERY creepy and should NEVER be done

[enjay]

so it's 1% of your funding

 

Or about 8% of our available / non-salary cost, but I take your point.

 

- - - Updated - - -

 

logging people's keystrokes especially on their own devices is VERY creepy and should NEVER be done

 

It would only happen during school time and on the school-provided WiFi, but I agree there are ethical questions to answer before doing it.

[TechMonkey]

Oh I think I get you, physically taking the content of the whole page and running that through a lookup, rather than relying on URI. Similar to doing a quick wget..

 

If I am understanding correctly, what is being said and the technology I am suggesting, this is a proper content filter, like Smoothwall or Openendium, and what KCSIE is saying should be moved to. URL checking is not enough.

[tom_newton]

Even doing full content filtering (which, as some have pointed out, requires as a minimum, a certificate on the device, and some sort of authentication... ) isnt necessarily going to catch typed content.

As someone above pointed out, that content probably *is* in post data somewhere, and if you effectively grepped the network traffic, you might find it. Having said that, we did that on outbound data for a while and it was a PAIN. Because you can't take a screenshot like you can with monitoring solutions, there's zero context, and because there isn't much textual context either you end up with overmatching. You can't block it, as you can't display a blockpage, so when something randomly overmatches some GUID that a site is using and blocks it, pop, the site is partially broken, but nobody knows why.

 

Add to that the increasing difficulty (ECH etc) of proxying unmanaged devices, and the increasing prevalence of alternate internet connections, and you have a lot of hard work for little return.

 

The only real option here is managed devices. From a budgetary standpoint there are some schools asking kids to BYO a from a set list of devices which then get managed by the school while that student is on roll. Also not perfect.

 

Apologies - no silver bullet, and a plethora of werewolves.

 

Happy to talk through with you and your DSL at any point.

[paulkerton]

Holy attempted massive over reach!

[mavhc]

The original request wasn't for capturing keystrokes or real time typing, it was capturing data sent to the internet, which is usually in a POST, or websockets, which if you have your own CA installed shouldn't be too hard

[mikes]

We ditched BYOD here, thing is even with managed devices staff need to be prepared that bad comments may be posted online - our kids won't lock their machines when they go across to print or whatever, it won't take long for someone else to slyly hop on and post something using their friends logon. "I didn't post that it was my friend on my account" etc.

 

So I'd say setting up something to read every single http POST generated site wide is a loooot of work for what? Plus the long random strings, you might get flags for "SH*T" or other 4 letter strings statistically, would you be able to see what the page was about or would you have to delve into the code ?

[mavhc]

You log it all, then when someone complains grep it for that word, if you find it, yay, if not nevermind

[enjay]

You log it all, then when someone complains grep it for that word, if you find it, yay, if not nevermind

 

That is the approach we would take. No-one has the time to trawl through logs looking for inappropriate content, but we could search for a specific string if something happened.

[flyinghaggis]

That is the approach we would take. No-one has the time to trawl through logs looking for inappropriate content, but we could search for a specific string if something happened.

 

I assume you still need to put a certificate onto a client device which lets you then analyse the decrypted POST content? Wouldn't the logs generated by monitoring and storing all that type of content be huge to to point of it not being workable? What kind of content would that allow you to monitor?

 

I'm not that familar with how it works practically in terms of HTTPS/web content so apologies if these are obvious questions! Is this something firewall/filtering providers would offer?

Edited November 5, 2024 by flyinghaggis

[tom_newton]

Yes, you would still need a cert on the client. And then you'd find you'd grep for a term and not find it because the post was trivially, but irreversibly-for-a-fragment encoded

[enjay]

Thanks everyone. I think I'll go back to the DSL and say it isn't possible!

[tom_newton]

You should probably also suggest that BYO devices will be increasingly difficult to manage from a filtering perspective, too.

[mavhc]

If you're not installing a cert on BYOD devices you're probably not compliant with anything.

 

You'd only need to store the POST data, so not too large