Blocking Flash Games Software restriction Policies... Hash

[irishpirate2000]

This looks great, just need some help/directions on implementing it on and windows domain. Any assistance is appreciated.

 

Thanks in advance,

Dave

[peterp]

Don't mean to be a pain, but does this work with a specific version of Internet Explorer? Can't remember what I did to get it working on Server 2003 but can't seem to get it to find a correct hash for a game in IE on one of our student workstations (Windows XP, IE 6 (A minor version number lower than that of Server 2003)). Almost every time it'll copy the game out even if it's in the hashlist if MAKECOPY is on. Registry file applied too, so it's not missing any of it's prerequisites as far as I'm aware.

It should work for any version of IE that I am aware of. It has only been tested under IE6 on CC3 (xp) workstations mind you as this is all we run.

It will only copy the file if it doesnt find a matching hash in the hashlist.txt file.

Are you sure you have correctly used the MCPHasher program to generate the hash of the game? (its a terrible peice of software currently, must get around to re-writing it)

The procedure is to copy the games out of the toCheck folder into a games folder, preferably stored on the C drive. Run MCPHasher, and go file-open, navigate to the MCPList directory and open hashlist.txt

Click ADD and navigate to the games folder on C. The new hashlist should be generated then, and any duplicate entries removed (based on hashvalue only. it will not remove duplicate names). Close the MCPHasher and it will prompt you to save the hashlist. Navigate to MCPList directory and double click hashlist.txt

 

If the MCPlist directory is readable from a student account, they should pick up the new list within 5 mins (default) or based on the timer you set in mcp.ini

 

 

 

This said, it detects games properly if loaded in Flashplayer and closes flash player fine.

 

Anything really obvious I'm missing because I think I've nailed everything.

 

For flashplayer it doesnt match any hashes, it just closes everything down, game or not.

[clareq]

Can I thank you peterp - I installed this little gem on our system on Monday, and the number of swf games stored in user areas has dropped to nil in only 3 days. Teaching and learning now has a chance!

[LWard]

It should work for any version of IE that I am aware of. It has only been tested under IE6 on CC3 (xp) workstations mind you as this is all we run.

It will only copy the file if it doesnt find a matching hash in the hashlist.txt file.

Are you sure you have correctly used the MCPHasher program to generate the hash of the game? (its a terrible peice of software currently, must get around to re-writing it)

The procedure is to copy the games out of the toCheck folder into a games folder, preferably stored on the C drive. Run MCPHasher, and go file-open, navigate to the MCPList directory and open hashlist.txt

Click ADD and navigate to the games folder on C. The new hashlist should be generated then, and any duplicate entries removed (based on hashvalue only. it will not remove duplicate names). Close the MCPHasher and it will prompt you to save the hashlist. Navigate to MCPList directory and double click hashlist.txt

 

If the MCPlist directory is readable from a student account, they should pick up the new list within 5 mins (default) or based on the timer you set in mcp.ini

 

 

 

 

 

For flashplayer it doesnt match any hashes, it just closes everything down, game or not.

 

 

Yeah, nailed it thanks. I didn't have any luck in getting MCPHasher to work initially so I used another tool to do it for me, which doesn't remove duplicates, and also capitalises all the letters in the strings, which might have been what was causing the unexpected behavior! MCPHasher is alright so long as, if you don't have a hashlist initially (You're trying it out for the first time) create an empty text file and get it to open it.

 

This is a very snazzy piece of software I must say. I did VB6 at college and it's quite interesting to see it's almost the same 9 years on in VB 2008. The code is really clear to read too, nice job! I'm a considerable stats whore so will probably look at adapting it with a web-based frontend for configuring it and compiling output logs, but no idea when I plan to look at doing that. Kids are going to love it, might be tempted to try this at home to see what my brother thinks of it!

[peterp]

Well, I have been teaching myself VB.Net for a couple of months now, and now I have found the Filesystemwatcher object I will be doing a complete re-write using these rather than timers.

 

The program will watch a list of specified drives for any file being opened, and then process them to see if they are games. This will also be able to detect SWF embeded in excel files (which our little dears use to get around IE, FLASHPLAYER and MEDIAPLAYERCLASSIC being filtered)

 

So hopefully in a couple of months there will be a shiney new version to play with.

 

On my wishlist is socket communications, so the client can be connected to from a server for instant updates, and logging, rather than the fileshare based system used at the moment.

[rasssp]

This will also be able to detect SWF embeded in excel files

 

Will this have the fuctionality for exe embeded in word?

[peterp]

Do you mean Shockwave flash? or VBA?

If i have a couple of samples of files I *MAY* be able to work out some sort of signature to check against.

 

For instance, I have a test harness running that detects embedded shockwave in excel files by checking the file for the string \.f.l.a.s.h...o.c.x which occurs in every file I want to target (and I very much doubt this string would occur naturally in a worksheet :-)

 

I may be able to do a similar thing to other files. (although my algorithm for checking for the existence of a string in a file that may be larger than available memory is VERY greedy and needs to be re-written)

[rasssp]

as we cant disable activex in office, the kids have now figured out that they can make word documents at home, drag in swf and exe files into word, or add them through the insert menu save the file as a word doc, then open it up here, double click the exe and it runs.

 

a massive massive security hole, I just wish ms had a gpo that you could specify which filetypes can be embedded in word.

[peterp]

as we cant disable activex in office, the kids have now figured out that they can make word documents at home, drag in swf and exe files into word, or add them through the insert menu save the file as a word doc, then open it up here, double click the exe and it runs.

 

a massive massive security hole, I just wish ms had a gpo that you could specify which filetypes can be embedded in word.

 

Do you use a CC3 network? I have just tried this here with an execuatable, it works as an admin, but when I try to open the same document as a student user and double click the executable embedded in the document, it gives an error stating 'Object was created in package. This application is not available to open this object ......'

[cbsc]

I've downloaded the gamekiller2 application and installed (as per your instructions) on our RM CC3 network. Leaving all the fields in the ini file as default it "kills" flashplayer whenever someone tries to run it. This information is also logged in the logs folder that I created in W:\mcplist\

 

I have tried adding a few swf files to the hashlist.txt (which appears to work), but if I try running any "new" swf files, it doesn't appear to copy the swf file to the "tocheck" folder that I also created. I don't believe this is a permissions problem as I have set the folder (temporarily) to EVERYONE, FULL CONTROL for testing purposes. Also there are instances where I would like flashplayer to run (for legitimate purposes), so I tried removing "flashplayer" from the mcp.ini file and so now it shows:

 

KILL=

 

....with no entries. In this state nothing gets blocked. It is essential to have a program entered in this field?

 

Just one last question. Do you have any updated versions, or is the link to the one you posted on 9th March the most current?

 

Cheers

[Nikthomas]

We block hash keys with a piece of software called Securus

[ctbjs]

Hi

 

I notice someone put a post up about getting it to work on a windows domain/vanilla network did you provide some instruction or confirmation as to whether it works on there also?

 

If not could you provide some detail please, very interested in this.

 

Thanks

 

Chris

[LWard]

Hi

 

I notice someone put a post up about getting it to work on a windows domain/vanilla network did you provide some instruction or confirmation as to whether it works on there also?

 

If not could you provide some detail please, very interested in this.

 

Thanks

 

Chris

 

We're on a vanilla network, kind of. We use RfN so I guess we're almost vanilla.

 

It does indeed work. The GameKillerApp.exe file (along with the other library files) goes on to a share (or C drive) which is completely hidden and inaccessible to the end user but can be reached by the local machine itself (Probably a share mapped during login, but made inaccessible via GPO or RfN). It relies on mcp.ini (local machine, but if you've got VB 2008 Express you can change this to get it's config directly from another drive), a directory to dump logs in, a directory in there called "tocheck", and of course the hashlist.txt file which is made courtesy of mcphasher.exe. We're still yet to deploy (Testing in Library at present) as I'm looking at how network communication is handled in VB2008 and hopefully look at a server-side portion or something to get it's configuration and hashlists from rather than a set of files, which works, but a console server would be great for debugging during pilot, and further additions as I wouldn't mind seeing if it's possible to drill down further in to the workstations and look at what file handles specific applications have open, like the standalone flash player.

 

We're not killing the flash player at the moment as the kids use flash buttons (DiDA) rather than making their own. The ICT teachers are wonderful but I do wish that they'd look at preventing the kids from using flash buttons after they've completed their current project and give them a selection of Photoshop PSDs and have them make up their own buttons (Infuriating as if we ever do a global search on our filestore for .swf files, there's millions of flash buttons between all the games, and nor can we just globally ban .swf files on the filestore otherwise my phone would light up brighter than Blackpool illuminations). I don't think Edexcel require they use Flash buttons in their DiDA projects so I don't see it being an issue.

[hagridsbeard]

We bought Impero at the beginning of the year and it's perfect for this problem.

 

Ok, we can't block flash from running as it is used legitiametly (Cida Dida etc), but as most users are embedding flash rather than launching directly, we can get Impero to listen for saflashplayer.exe and alert us when it's being used.

 

We periodically look at the alerts and if that exe is flagged up, we nip into the students area and delete the lot.

 

Frustrates the hell out of them.

[the_travisty]

Hi,

 

We have been using the gamekiller app on our vanilla network since it was released and I would just like to say what a wonderful piece of programming, I just wish I could even work out where to start when it comes to creating an app like yours. Anyway, I have moved off topic. It worked brilliantly for about a week. Really annoyed our year 11's to the point that they threatened the other technician here which was funny. Then, they found a way round the program.

 

If they open up flash, load there swf into it, publish a new swf and web page and then run the created html, they can not only play the game, but it doesn't appear in the copied games folder.

 

I am not sure if there is anything you can do about this one but I really do hope you can. The year 11's are leaving soon, but the rest of the school will no doubt know how to get the games to run.

 

the_travisty

[LWard]

Good greif, they're getting clever now. They are pretty much embedding the game inside another flash file, thus, creating a different hash (There's an additional wrapper around the game itself so the hash changes. The only way to get round this would be to look for a specific chunk of ASCII in the file(easiest, unless compression mangles it), or somehow conjure up heuristic scanning that nails it whatever they do, but I hardly think thats easy in VB.NET. Good learning experience this is I must admit, I'm learning things that I never went in to in college (in ye olde VB 6 days).

[peterp]

You can take the KILL= out completely. and currently this is the latest version. I am working (slowly) on a complete re-write between work at school. However we have been rather busy lately and progress is slow.

[peterp]

... We're still yet to deploy (Testing in Library at present) as I'm looking at how network communication is handled in VB2008 and hopefully look at a server-side portion or something to get it's configuration and hashlists from rather than a set of files, which works, but a console server would be great for debugging during pilot, and further additions as I wouldn't mind seeing if it's possible to drill down further in to the workstations and look at what file handles specific applications have open, like the standalone flash player.

....

 

Strange you should say that. Thats exactly the feature I'm working on in the new version currently.

having some problems communicating between threads in a multitheaded server app.

 

 

If anyone knows how to go about this problem is a little like this.....

 

Serverapp runs a thread that listens on a port for a connection.

When a client connects another thread is started to handle this connection.

The serverapp continues to listen for another connection etc.

 

The handler works and multiple clients can connect, however I cant then have the server enumerate through the clients sending data to each one.

 

The handler can recieve information, and respond, but another thread cant pick a client to talk to.

 

Back when I was a C and Unix programmer, I'd have a shared memory segment that all the clients would write to and read from, and from Java I'd be able to call methods in an array of threads eg.

threadList[n].sendText("Greetings client " + n)

 

in VB.net as the thread is a subroutine I cant make calls to the object.

[p858snake]

Really annoyed our year 11's to the point that they threatened the other technician here which was funny.

I hope they got punished for threating a staff member.... this is why IT techs get treated like because no one reports it. Edited April 27, 2009 by ZeroHour
No swearing please

[peterp]

Hi,

 

...

 

If they open up flash, load there swf into it, publish a new swf and web page and then run the created html, they can not only play the game, but it doesn't appear in the copied games folder.

 

I am not sure if there is anything you can do about this one but I really do hope you can. The year 11's are leaving soon, but the rest of the school will no doubt know how to get the games to run.

 

the_travisty

 

We find that most games are protected against being opened in flash. But there have been instances where they have done this here, and the game runs under flash, however I cant see how it can avoid being copied into the tocheck folder if they publish it as a .swf and run it in a web browser. Will have to look into it if I get time.

 

However the next version will not rely on open IE windows, but rather will watch any file system activity (so it can prevent the opening of hashed files in ANY application)

[Steve_T]

whenever you block one way, they find another and in fact the brighter ones see it as a challenge.....

 

I must admit to this, most of my 'early learning' was through the principles of security flaws and vice versa.

 

Change of management was always fun, different methods of thinking. The classroom management systems made it the hardest.

[EJWill]

Here, things have got so bad that we've had to setup ISA too block all SWF files from being downloaded. This does the job nicely and at least enables a whitelist for legit sites.

 

However, the real problem we face at the moment is kids bringing in their SWF games on USB sticks and what not.

 

As fellow IT techs are aware of too, classroom discipline is rarely upheld and the kids believe they can get away with it.

 

With Flash also being on the syllabus, we can't prevent SAFlashPlayer from running. So right now we have a nightmare trying to stop the wave of gameplaying.

 

Windows Server 2008 might have a solution for us for the future, but what with the state of the country and budgets we're now getting, we're stuck on Server 2003, with no proper filtering (and in some cases working)!

 

But to think, if FileSystemWatcher had an OnAccess event, we'd all be laughing. Is anybody aware of an open source on-access scanner? My searching has come up trumps.

[peterp]

FileSystemWatcher does indeed have an onaccess event.

The new gamekiller is going to be using it.

So far I can get it to see that a file has been opened, I can then read the file and hash it to check against the list of files to be killed.

 

However I have hit a major stumbleing block. The file is open, and I cant delete it (cus the kid has it opened in an application). I need to find out which application has the file locked, so I can kill the process.

 

I've been trawling around and discovered it can be done, using calls to ntdll.dll but there are no .net code bits for it, the calls are all undocumented by Microsoft and all the example code I can find is written in C++ or C#, and being a newbie to VB, and previously a Java programmer, I am having trouble converting it.

 

Sysinternals Forums - vb.net locked file information

[tom_newton]

Dirty, but you could shell out to pskill?

[zag]

I just use the open source monitoring software Italc, load it up every so often and mess around with boys screens who are playing flash games. Its hilarious to see them constantly trying to open a game when im closing it on their screen

 

Persistent offenders just get their accounts banned.

 

This works and we dont have a problem with people abusing flash any more.