Steve21 presents: EduLock

[Steve21]

I downloaded your program yesterday and have been 'playing' with it today. Is it possible to remove the Steve21 from the lock screen? The only reason I ask is because a google search for steve21 comes up with info about the program and the less info you give the 'Little Darlings', the better.

 

Leigh

 

I can certainly change it from Steve21 to my name, or such. Just so there's no searchable link to here. But for obvious reasons still like some reference Even if it's just to stop people trying to claim it's theirs.

 

If that sounds good, I'll make a few changes this weekend, (or tonight if I get time).

 

Steve

Edited July 19, 2011 by TheScarfedOne
Language

[LeighMJ]

But for obvious reasons still like some reference Even if it's just to stop people trying to claim it's theirs.

Your name's still in the admin area but either way that'd be great.

[Steve21]

Your name's still in the admin area but either way that'd be great.

 

Aye But after one view (aka original setup) that page is locked and hidden "normally"

 

But yeah, can do that no probs.

 

Steve

[mobybrick]

Hi,

 

Thanks for this - all looks great. Will give it a go shortly.

 

But - just to clarify - how is the EduLock.exe normally executed by the workstation? As it is not a service, is it intended to be run from HKLM\...Windows\Explorer\Run ? How does this prevent GPO bypass if the cable is disconnected before Run... items are executed?

 

Thanks,

Moby

[Steve21]

Hi,

 

Thanks for this - all looks great. Will give it a go shortly.

 

But - just to clarify - how is the EduLock.exe normally executed by the workstation? As it is not a service, is it intended to be run from HKLM\...Windows\Explorer\Run ? How does this prevent GPO bypass if the cable is disconnected before Run... items are executed?

 

Thanks,

Moby

 

In terms of running it, there's a few ways, startup aka hklm/run etc, as a note I'm playing with writing it as a service, but taking a while

 

In terms of GPO, there's a test function within the program that will force gpupdate to happen when it "unlocks". So if it's removed during boot, it should reapply GPs once unlocked, aka once plugged in. But this is currently test function, again updating this as I go based on feedback

 

Steve

[mobybrick]

Thanks for this Steve. But consider the following scenario:

 

 

Seems IMHO that EduLock is helpful, but actually still has a hole in it

Edited July 18, 2011 by Steve21

[Steve21]

 

 

I feel you're slightly misunderstanding EduLock as such The main idea of it was to stop users disconnecting cables while logged on, to play games etc while networked apps can't connect to disable it. It will work in terms of if the cable isn't connected once it finialised login, as the program is running. But I doubt people will know when to plug it in, just to get files, but not GPOs

 

There's simple fix to the thing you're referring to Do a gpupdate on login. (or wait for the service re-code )

 

 

Steve

Edited July 18, 2011 by Steve21

[mobybrick]

Hi Steve,

 

From the beginning page it says that EduLock aims to prevent users bypassing GPOs. This is not correct. What you actually mean is that EduLock aims to prevent users bypassing 3rd party security applications that run outside of Group Policy.

 

Group Policy Objects are processed primarily at logon. They include software restriction (or Applocker) policies.

 

 

And if EduLock is deployed by group policy itself (i.e. as a login script) then this too will be disabled, as it will never be run.

 

Just my 2p worth, sorry. Until EduLock is *always* running in the background as a service, it is easily defeatable IMHO. Sorry!

 

Moby.

Edited July 18, 2011 by Steve21

[Steve21]

I'm not being funny, but that is a really silly statement...

 

It doesn't say that at all... It says playing games, and disabling GPOs. Disabling, isn't the same as bypassing. This isn't security software....

 

Ofcourse software won't deploy if it's done over network and the cable isn't plugged in. Name a piece of software that does?

 

And once again, just run a gpupdate script at start if you think it's such a big issue... or as I said, wait until it's re-coded.

 

Steve

[mobybrick]

Hi,

 

Thanks for this. I really do understand what you're trying to acheive.

 

But EduLock is deployed by GPO logon script, then users will quickly learn that it too can be defeated: By pulling out the cable sooner.

 

If a user pulls out the network cable during logon, group policy settings will not be loaded and EduLock will not be run. This would only be fixed if EduLock ran as a service that was always running.

 

If EduLock was implemented as a service, may I suggest that you incorporate a feature to allow nominated security groups for which EduLock will temporarily stop looking for disconnects whilst they are logged on (e.g. local admins, domain staff etc)..

 

Regards

Moby.

[Steve21]

You know this is getting boring now You're obviously not listening/understanding, or seems more like "don't want to". 5 posts in 2 years all arguing about what my program is "supposed" to do or be run as. How you interpret it isn't my choosing

 

"But EduLock is deployed by GPO logon script" If that's how you've chosen to do it, that's your choice... Logic says deploy the regkeys once, and you'll never need the gpo deploying again... so it doesn't matter if it's loading with or without logon script. If you're setting it to be a HKLM setting.... Unless you're telling me, that 100% of users are disabling GPOs every time, and you never login to any computers with GPOs deployed, your point is invalid... One login and it's set to run forever as such. I highly doubt you're trying to copy settings/program files over "every" login, for your example Lan Ranger. You copy it once, you don't copy it every time someone logs on. So whether GPO is disabled or not, makes 0 difference.

 

And in terms of feature to stop it looking for disconencts while admins logged in any reason for it? If it's an individual machine etc being fixed, you have the admin pass to disable it while you're logged on. If you're moving hundreds of machines etc they'd be logged off anyway?

 

Steve

 

 

*Edit - Seeing all you're doing is spamming now Moby I'll delete any posts. You're just proving my exact point you're not listening to anything I said, and causing problems for fun. Oh well. Steve

Edited July 19, 2011 by Steve21

[mobybrick]

Deleting someones post because you happen to disagree with it? Really, I don't think I'm the one who is not listening. It seems that you simply can't take any criticism.

 

Why not have an adult discussion, rather than simply deleting items you can't handle? I see you snip other posts to remove any critiscism. Others can then form their own opinion. Or are you worried about there being a proper discussion? Perhaps you'd rather people wasted their time thinking that you offered a complete solution. But it is not yet, sorry.

 

Moby.

[Steve21]

Deleting someones post because you happen to disagree with it? Really, I don't think I'm the one who is not listening. It seems that you simply can't take any criticism.

 

Why not have an adult discussion, rather than simply deleting items you can't handle? I see you snip other posts to remove any critiscism. Others can then form their own opinion. Or are you worried about there being a proper discussion? Perhaps you'd rather people wasted their time thinking that you offered a complete solution. But it is not yet, sorry.

 

Moby.

 

I'm deleting your constant spam, as I've already explained multiple times how it's meant to work, and you're ignoring it. I've asked you to stop posting things that are nothing to do with the software, just to cause arguements. And you continue.

 

10 posts of yours, 9 slagging off software for stuff it's never designed to do.

 

If you have a problem and would like something developed, as I've mentioned many a time, You can PM me it, or wait for new versions. However you resort to constant spam, and slagging off. If it continues I will ask admins to step in, as it's really getting boring.

 

Steve

[mobybrick]

Please, ask the admins to step in. I'm sure they'll see that none of my posts were spam. Re-posting items that I didn't see had been deleted (you did not leave a message) is not a crime. All of my items are to make a valid point: The execution of EduLock can easily be stopped by a students. There's no point providing something if it can be (easily) defeated.

 

Please ask the admins to review. Please. I've been nothing but polite.

[mobybrick]

Dear other forum viewers,

 

The EduLock program has a large security flaw IMHO, which could potentially allow students to bypass it. The author of the software as good as acknowledges this in my posts above, where he has snipped my posts (and removed others) on the basis of students seeing security sensitive information.

 

Rather than talk constructively, the author has labelled me as 'silly', a 'whiner' and 'boring' - but the fact remains, the software is insecure. I feel other users of the software - you - should at least know about the possibility of the problem, so you can make your own informed decision.

 

It seems we are not allowed to open in to a proper discussion on this forum, including ways to negate the problem on here, but if anyone would like more advice or help with this, then please PM me. I'll try my best to help to advise you how to prevent this hole as much as possible.

 

Regards

Moby

 

Don't post private correspondence that you don't have permission for

Edited July 19, 2011 by plexer

[LeighMJ]

Moby,

 

You talk about deploying/running EduLock via GPO. Why have a GPO to run EduLock when that just defeats the purpose?! Create a GPO to run a script that creates a folder, C:\Program Files\EduLock, copy the program there, create an entry in HKLM\Software\.\.\.\Run to run the executable. Hey Presto!!! You have a program that runs on it's own without a GPO.

[Steve21]

Moby,

 

You talk about deploying/running EduLock via GPO. Why have a GPO to run EduLock when that just defeats the purpose?! Create a GPO to run a script that creates a folder, C:\Program Files\EduLock, copy the program there, create an entry in HKLM\Software\.\.\.\Run to run the executable. Hey Presto!!! You have a program that runs on it's own without a GPO.

 

It's nice to see that others understand it oh well I'm sure we'll get more spam now.

 

On a side note Leigh, added option to change steve21 to full name on lock screen with regkey on new version. If you're still interested will try to upload it tonight or tomorrow.

 

Steve

[LeighMJ]

On a side note Leigh, added option to change steve21 to full name on lock screen with regkey on new version. If you're still interested will try to upload it tonight or tomorrow.

 

Steve

Yep, sounds good. Thanks

[Steve21]

To clarify the situation:

 

The "major hole" found is simply based on using a non-recommended/supported way of installing the program. Using the standard install which I'll explain better on the website later doesn't have the "major hole" as mentioned.

 

This has been explained to mods, and they're dealing with it as they see fit. Hopefully this will end the situation.

 

Many thanks,

Steve

[oxide54]

It's nice to see that others understand it :

Steve

 

or even understand "Chapter 1: Deploying simple applications on a windows network"

[oxide54]

to re-create

 

Close Lid of Laptop (HP 6735s, XP) --> Puts in standby mode

Open Lid of Laptop

Press On button (Wakes up from standby, not off or hibernation)

 

then edulock triggers the exception

 

not really sure its a problem, i only noticed cause i left edulock running from looking at it earlier/

 

 

See the end of this message for details on invoking

just-in-time (JIT) debugging instead of this dialog box.

 

************** Exception Text **************

System.ComponentModel.Win32Exception: The operation completed successfully

at System.Windows.Forms.Form.UpdateLayered()

at System.Windows.Forms.Form.set_Opacity(Double value)

at EduLock.Form1.startLock()

at EduLock.My.MyApplication.MyApplication_NetworkAvailabilityChanged(Object sender, NetworkAvailableEventArgs e)

at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.raise_NetworkAvailabilityChanged(Object sender, NetworkAvailableEventArgs e)

at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.NetworkAvailableEventAdaptor(Object sender, NetworkAvailableEventArgs e)

at Microsoft.VisualBasic.Devices.Network.raise_NetworkAvailabilityChanged(Object sender, NetworkAvailableEventArgs e)

at Microsoft.VisualBasic.Devices.Network.NetworkAvailabilityChangedHandler(Object state)

 

 

************** Loaded Assemblies **************

mscorlib

Assembly Version: 2.0.0.0

Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)

CodeBase: file:///c:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll

----------------------------------------

EduLock

Assembly Version: 1.0.0.0

Win32 Version: 1.0.0.0

CodeBase: file:///C:/Documents%20and%20Settings/alien/My%20Documents/Downloads/EduLock/EduLock.exe

----------------------------------------

Microsoft.VisualBasic

Assembly Version: 8.0.0.0

Win32 Version: 8.0.50727.3053 (netfxsp.050727-3000)

CodeBase: file:///C:/WINDOWS/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll

----------------------------------------

System

Assembly Version: 2.0.0.0

Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)

CodeBase: file:///C:/WINDOWS/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll

----------------------------------------

System.Windows.Forms

Assembly Version: 2.0.0.0

Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)

CodeBase: file:///C:/WINDOWS/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll

----------------------------------------

System.Drawing

Assembly Version: 2.0.0.0

Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)

CodeBase: file:///C:/WINDOWS/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll

----------------------------------------

System.Runtime.Remoting

Assembly Version: 2.0.0.0

Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)

CodeBase: file:///C:/WINDOWS/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll

----------------------------------------

System.Configuration

Assembly Version: 2.0.0.0

Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)

CodeBase: file:///C:/WINDOWS/assembly/GAC_MSIL/System.Configuration/2.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll

----------------------------------------

System.Xml

Assembly Version: 2.0.0.0

Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)

CodeBase: file:///C:/WINDOWS/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll

----------------------------------------

 

************** JIT Debugging **************

To enable just-in-time (JIT) debugging, the .config file for this

application or computer (machine.config) must have the

jitDebugging value set in the system.windows.forms section.

The application must also be compiled with debugging

enabled.

 

For example:

 

 

When JIT debugging is enabled, any unhandled exception

will be sent to the JIT debugger registered on the computer

rather than be handled by this dialog box.

[LeighMJ]

It's nice to see that others understand it oh well I'm sure we'll get more spam now.

 

On a side note Leigh, added option to change steve21 to full name on lock screen with regkey on new version. If you're still interested will try to upload it tonight or tomorrow.

 

Steve

Steve,

 

How did you go with uploading new version?

[Steve21]

then edulock triggers the exception

 

not really sure its a problem, i only noticed cause i left edulock running from looking at it earlier/

 

 

I think I know what that's for, as when I'm checking to see if the network changes I'm pulling an offline/online value. As standby probably disconnects the network card when it's rebooting it starts the program, before the card is "alive" as such, thus causing it to complain. Will take a look at it thanks!

 

 

Steve,

 

How did you go with uploading new version?

 

It's uploaded, If you download latest version, then put a regkey called "DisplayName" put it to anything over than blank for now, and it should do it. If that works ok, will prettify it later

 

Thanks both!

 

Steve

[rantonacci42]

Steve,

Thank you for creating such a useful program. I have 2 questions if you don't mind.

1. Where can I download the newest version.

2. We have been testing the software and found that even with it, if a student launches task manager, they can kill the process. Any ideas or changes you can make to avoid that?

 

Thank you so much!

Ryan

[Steve21]

Steve,

Thank you for creating such a useful program. I have 2 questions if you don't mind.

1. Where can I download the newest version.

2. We have been testing the software and found that even with it, if a student launches task manager, they can kill the process. Any ideas or changes you can make to avoid that?

 

Thank you so much!

Ryan

 

Hey,

 

The uploaded version is latest release, but been working on rewriting it as a service, just been a bit busy.

 

I made the assumption task manager would normally be restricted in schools but there is a way I could disable it. As a user can only have task manager open once I can make edulock open and hide it, therefore no-one else can launch it.

 

Steve