Blocking Flash Games Software restriction Policies... Hash

[rasssp]

the problem we have now is that kids have figured out you can embed exe's into word documents.

 

cant find anything to get rid of them.

[NikChillin]

This is an awkward one. The students run them from pen drives - we stop that. The run them from email - we stop that too. We stop flash from running so they open them in explorer. How far do you go before you say to them it is their future and they have to take responsibility for it and not blame others when they underachieve?

[rasssp]

The only effective thing I have found so far is a part of the AB tutor control program. You can set a policy to block applications from opening by file name or what is displayed in the title bar. Most of the exe games are from miniclip so the policy will close any program open that has *miniclip* in the title bar.

 

Works great, but AB tutor has a habit of breaking things, which is why I removed from the network and now only have it on 6 machines.

[Azhibberd]

the problem we have now is that kids have figured out you can embed exe's into word documents.

 

cant find anything to get rid of them.

 

Which version of office are you running? if your running 2003 or + you can block all ActiveX that stops it, that or if your still looking into upgrading have you considered going to open office instead, We where running 2000 and couldn't block it, And we just couldn't afford upgrades so we are now using open office on student machines.

 

@rasssp - Ye we run Abtutor its great and all but i prefer to have everything set threw GPO, And i think i'm almost there blocking most ways i'll provide more info later.

 

@NikChillin - Ye we have got to that point now, i have just managed to block all flash from being dragged into IE that doesn't affect websites although still in the testing stage but i'm starting to draw the line because of the amount of time all this security takes to setup.

[User3204]

Which version of office are you running? if your running 2003 or + you can block all ActiveX that stops it.

 

Aye, that will stop all ActiveX within Office, (we tend to get them embedded in Excel files), but is there any way to stop JUST the SWF files, but allow others (I don't know what they are, but I suspect they might need it) ?

 

Ideally, we'd want to be able to have a black list (or a white list) of allowed SWF embedded files.. but this is not easy.

[spc-rocket]

Hello all,

 

We have got the usual issues with the shockwave flash games at our place as well. One of my ICT Tech. have developed a client/server application that runs in the background that blocks the shockwave flash games.

 

It does this by using the hash value of the game and then when the game is played in IE it closes this down if it matched the hash list. There is also an option to close the Adobe Flash player.exe to be killed as well. This does not affect the active x plug in so its okay.

 

It doe rely on creating a file with a hash value so he has also designed a hasher program which will generate the hash value from a directory which contains SWF games.

 

The program can also be told to copy a file (swf) to a central location that is not the list. This will capture all the swf files so it may include the legit flash movies as part of thier coursework. It doesn't remove the file just copies so if its a a game (manual check required) then you can create a hash value of it.

 

Using the hash value gets around the problem of users renaming the files to something else.

 

The program checks the file list on the server every 10 mins (can be changed in the ini file options) and updates its own file every 5 mins.

 

I don't know much of the other technical details but i will get him to tell you guys more and release to educational establishments once its all sorted out.

 

Ash.

[Azhibberd]

Ye we mainly had them coming in from excel, and well in all honestly not sure on that one I don't think so, but then blocking all activex here didn't cause any problems at all not totally sure why the kids would need it anyway, from what im mainly aware of activex is mainly used for flash.... Feel free to correct me?

 

"Ideally, we'd want to be able to have a black list (or a white list) of allowed SWF embedded files.. but this is not easy. " - I dont think thats possible at all would be good thought although we have moved to open office here so havn't looked into the lastest office GPO templates.

[User3204]

Hello all,

 

We have got the usual issues with the shockwave flash games at our place as well. One of my ICT Tech. have developed a client/server application that runs in the background that blocks the shockwave flash games.

 

It does this by using the hash value of the game and then when the game is played in IE it closes this down if it matched the hash list. There is also an option to close the Adobe Flash player.exe to be killed as well. This does not affect the active x plug in so its okay.

 

It doe rely on creating a file with a hash value so he has also designed a hasher program which will generate the hash value from a directory which contains SWF games.

 

The program can also be told to copy a file (swf) to a central location that is not the list. This will capture all the swf files so it may include the legit flash movies as part of thier coursework. It doesn't remove the file just copies so if its a a game (manual check required) then you can create a hash value of it.

 

Using the hash value gets around the problem of users renaming the files to something else.

 

The program checks the file list on the server every 10 mins (can be changed in the ini file options) and updates its own file every 5 mins.

 

I don't know much of the other technical details but i will get him to tell you guys more and release to educational establishments once its all sorted out.

 

Ash.

 

 

Hmm, this sounds like a useful little application.

 

..I wonder if I could get Mcafee to filter them out, as it does this sort of thing too... otherwise,

[rasssp]

Which version of office are you running? if your running 2003 or + you can block all ActiveX that stops it, that or if your still looking into upgrading have you considered going to open office instead, We where running 2000 and couldn't block it, And we just couldn't afford upgrades so we are now using open office on student machines.

 

We run office 2007 pro plus. Killing active x was the first thing we did, work great for about 30 min, till the teaching staff bombarded us saying the kids coursework didn't work anymore.

 

Does seem to be a way around it without blocking functionality.

[rasssp]

Hello all,

 

We have got the usual issues with the shockwave flash games at our place as well. One of my ICT Tech. have developed a client/server application that runs in the background that blocks the shockwave flash games.

 

It does this by using the hash value of the game and then when the game is played in IE it closes this down if it matched the hash list. There is also an option to close the Adobe Flash player.exe to be killed as well. This does not affect the active x plug in so its okay.

 

It doe rely on creating a file with a hash value so he has also designed a hasher program which will generate the hash value from a directory which contains SWF games.

 

The program can also be told to copy a file (swf) to a central location that is not the list. This will capture all the swf files so it may include the legit flash movies as part of thier coursework. It doesn't remove the file just copies so if its a a game (manual check required) then you can create a hash value of it.

 

Using the hash value gets around the problem of users renaming the files to something else.

 

The program checks the file list on the server every 10 mins (can be changed in the ini file options) and updates its own file every 5 mins.

 

I don't know much of the other technical details but i will get him to tell you guys more and release to educational establishments once its all sorted out.

 

Ash.

 

I would be very interested in this, if it can sit on each machine and read a list of swf and exe flash games via hash and prevent them from running.

 

classroom control is out of the window here I'm afraid

[spc-rocket]

I would be very interested in this, if it can sit on each machine and read a list of swf and exe flash games via hash and prevent them from running.

 

classroom control is out of the window here I'm afraid

 

Hiya,

 

The Technician who has designed this is not in this week but when he's back next week i'll get him to send you a beta of the program so you can see how it goes. It designed around CC3 but can be modified to run on vanilla networks as well.

 

Ash.

[john]

Hows the program progressing Ash?

[spc-rocket]

Hows the program progressing Ash?

 

Hi John,

 

I've just got back from Holiday yesterday so i'll update you guys on Monday. I'll inform the technician to post the beta of the program here so people can test it out etc. As always the manual and documentation is still in development so the instructions may be simple.

 

Ash.

[peterp]

Hello all.

I am just preparing the files for distribution, I've written some basic (very very basic) documentation.

I'll post a little later with where you can download the package from.

 

I appologise to anyone who looks through the source, it really is spaghetti code and badly commented.

[peterp]

Ok, here are the files needed. They are zipped up, so if you unzip directly to your packages directory (q:\applications\) you will end up with a directory called gamekiller2

 

In here are the files needed. Documentation and zips of the source for visual studio 2008.

 

To use the program as is, update package list, allocated it to stations, and create folders for the logs/hashlist

 

Need to create...

w:\mcplist (hidden read only folder)

w:\mcplist\logs (student writeable)

w:\mcplist\logs\tocheck (student writeable)

w:\mcplist\hashlist.txt (created with mcphasher)

 

Ok, adding an attachment doesnt seem to work. (6meg .zip file, maybe too big?)

Edited March 9, 2009 by peterp
cant include attachment

[bossman]

@peterp:

Could you not place them on your FTP server for us to gain access even with password if needed. ;-)

[peterp]

@peterp:

Could you not place them on your FTP server for us to gain access even with password if needed. ;-)

 

I will sign up to one of these filesharing sites later. Rapidshare or the like and post a link.

[NeoPlosive]

I will sign up to one of these filesharing sites later. Rapidshare or the like and post a link.

 

Have sent you a PM.

[apoth0r]

TerminatorX seems to do a resonable job with things like that, new version out too apparantly.

[NeoPlosive]

Hello all.

I am just preparing the files for distribution, I've written some basic (very very basic) documentation.

I'll post a little later with where you can download the package from.

 

I appologise to anyone who looks through the source, it really is spaghetti code and badly commented.

 

I've offered to host this. App is available: http://repository.neoplosive.co.uk/edugeek/packages/GameKiller2.zip

[Stuart_C]

I used a combination of blocking the ActiveX in Office documents and McAffee EpO/Virus Scan 8.5 and the user defined rules.

 

The first stops them being imbeded in excel/word (obviously) the latter I have used to prevent them funning any SWF (and BAT/EXE/MSI/CMD/COM/MP3) files from flash memory, their desktops, home areas and any other area that they can write too.

 

If I was in your situation I could also allow a small network location for pupils to save their course work and this could be agressively monitored. I also found that content checking the E-mail when this was going on here proved usefull for removing unwanted documents.

[msattar]

Ok, here are the files needed. They are zipped up, so if you unzip directly to your packages directory (q:\applications\) you will end up with a directory called gamekiller2

 

In here are the files needed. Documentation and zips of the source for visual studio 2008.

 

To use the program as is, update package list, allocated it to stations, and create folders for the logs/hashlist

 

Need to create...

w:\mcplist (hidden read only folder)

w:\mcplist\logs (student writeable)

w:\mcplist\logs\tocheck (student writeable)

w:\mcplist\hashlist.txt (created with mcphasher)

 

Ok, adding an attachment doesnt seem to work. (6meg .zip file, maybe too big?)

 

does gamekiller2 work with xp

[peterp]

Yes. You may need to tailor the paths that it uses as these are designed for our RM CC3 network, but its just a VB.net program that runs under windows xp.

 

All the paths that are used for config files are in the programs .ini file.

[msattar]

thanks for the solution will try that

[LWard]

Don't mean to be a pain, but does this work with a specific version of Internet Explorer? Can't remember what I did to get it working on Server 2003 but can't seem to get it to find a correct hash for a game in IE on one of our student workstations (Windows XP, IE 6 (A minor version number lower than that of Server 2003)). Almost every time it'll copy the game out even if it's in the hashlist if MAKECOPY is on. Registry file applied too, so it's not missing any of it's prerequisites as far as I'm aware. This said, it detects games properly if loaded in Flashplayer and closes flash player fine.

 

Anything really obvious I'm missing because I think I've nailed everything.