Student installed google chrome!

[mrbios]

Some kids found a game site called canvasrider.com, if you access that site using IE8 it tells you your browser is old and crap (basically, though they aren't exactly wrong) and it has links to chrome, firefox etc

 

Student clicked on the chrome link which took him to google.com/chrome, he clicked install and it poped up asking him for admin permissions, he clicked no and the next thing you know chrome is running!

 

Students have no rights what so ever to install things, yet this somehow worked, i've blocked google.com/chrome now but i thought i'd best let others know about this shoddy installer by google, not that it causes much of a problem because it still uses the same settings as IE but it's the principal of the thing!

 

anyone come across this before? anything similar i should lookout for with other browsers?

[round2it]

we had the same issue here

google chrome installed without admin permissions.

 

if google can get installed what about dodgy spyware etc

[FN-GM]

Block the students running .exe that will resolve it.

[K.C.Leblanc]

Some kids found a game site called canvasrider.com, if you access that site using IE8 it tells you your browser is old and crap (basically, though they aren't exactly wrong) and it has links to chrome, firefox etc

 

Student clicked on the chrome link which took him to google.com/chrome, he clicked install and it poped up asking him for admin permissions, he clicked no and the next thing you know chrome is running!

 

Students have no rights what so ever to install things, yet this somehow worked, i've blocked google.com/chrome now but i thought i'd best let others know about this shoddy installer by google, not that it causes much of a problem because it still uses the same settings as IE but it's the principal of the thing!

 

anyone come across this before? anything similar i should lookout for with other browsers?

 

Google Chrome installs into a user's profile.

 

Depending on how you've got your profiles setup you might be able to recreate the Chrome target folder and then put some permissions on it to prevent students writing to it.

 

Also Sophos has an option to block chrome, you can also add the download site to your filter list.

[SYNACK]

Yeap, this is designed behaviour. It is so that Googles devotees can take the true Google path and drink the shimmering Kool-Aid even if their evil overloard employers for some reason want to have some form of control over their own computers. You'll have to block exes or take other measures to stop users implmenting their 'Google' given 'right' to do whatever they want to someone elses computers.

[mrbios]

Google Chrome installs into a user's profile.

 

Depending on how you've got your profiles setup you might be able to recreate the Chrome target folder and then put some permissions on it to prevent students writing to it.

 

Also Sophos has an option to block chrome, you can also add the download site to your filter list.

 

Ah that'd explain why the only remains of the install i could find were in the all users folder (an icon file etc), we run mandatory profiles so the install is never stored permanently, quite annoying though.

 

I'll look into the sophos route of blocking chrome, sounds like the easiest method for us.

[AngryTechnician]

Google Earth works the same way I think. Google are a colossal pain in the backside about this sort of thing, many of their product groups seem to have no respect for the "IT department" whether its in business or education; they simply see 'us' as a barrier to people using their products.

[Thunderbird311]

Firefox also has this type of pivoting installer. I haven't worked with it yet, but I am told AppLocker takes care of this.

 

http://tekjournal.wordpress.com/2010/01/05/windows-7-application-installation-security-a-moving-target/

 

Applocker closes the hole… « Tekjournal

[TimmG6376]

I blocked Chrome using a combination of Software Restriction polices and Google Update for Enterprise ADM templates (link)

 

I created Software Restriction rules to disallow the following:

 

%LocalAppData%\Google\Chrome\Application\*\Installer\setup.exe
%LocalAppData%\Google\Chrome\Application\chrome.exe
%LocalAppData%\Temp\CR_*.tmp\setup.exe
C:\Documents and Settings\%username%\Local Settings\Application Data\Google\Chrome\Application\*\Installer\setup.exe
C:\Documents and Settings\%username%\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\documents and settings\%username%\local settings\temp\cr_*.tmp\setup.exe
chrome.exe
chrome_installer.exe
chromesetup.exe
gears-chrome-opt.msi

 

Not perfect solution as a savvy user can download the installer and rename it to circumvent the policy. I also created a 'Chrome Allowed' security and group which is denied access to this policy. This was because we had a small group of users doing web development that needed to have Chrome installed for testing purposes. Adding users to that group prevents the Software Restriction policy from being applied thus allowing Chrome to be installed/run.