Blocking Flash Games Software restriction Policies... Hash

[goodhead]

forget last post. I have it working for exe files as well.

 

Thanks very much for you help.

 

Good programming. Not sure what the banned.html and accessdenied.htm files do as they dont seem to pop up or any think.

 

Dan

[the_travisty]

These files are only used when flash games open up in internet explorer. If they open in standalone flash then they are just killed.

 

Trav

[goodhead]

sorry to bother you again.

I've just found a mortal combat game. its an swf file.

I have not added its hash to the txt file. When your app is running and i double click the game its kills it.

 

Why? its not been hashed.

 

Dan

[the_travisty]

It sounds to me like your default swf player is the standalone flash player. If you open the file in internet explorer it will check the hash and only block files that are in the hash list. If you open it in flash player and flash player is getting killed by the app then it will close it down whether it is hashed or not.

 

Trav

 

P.S. It isn't my app but I love it so much that I know it nearly inside out

[gjdb]

Somehow i can not get it to work properly.

 

Atm we have autumn holidays, so i have some spare time to test it at home.

The program installs and runs fine, but it does not collect any new games into the toCheck directory.

I`m testing on a laptop and all directories etc. are localy installed and i`ve full rights to those directories.

 

I`ve tested several game websites, which all use flash games, the .swf files are cached in the Temporary Internet Files directory but they are not copied to the toCheck directory.

 

My test setup/directory:

 

C:\Program Files\ags\mcp\accessdenied.htm

C:\Program Files\ags\mcp\banned.html

C:\Program Files\ags\mcp\GameKillerApp.exe

C:\Program Files\ags\mcp\Interop.SHDocVw.dll

C:\Program Files\ags\mcp\mcp.ini

C:\Program Files\ags\mcp\MCPHasher.exe

C:\Program Files\ags\mcp\mcplist\hashlist.txt

C:\Program Files\ags\mcp\mcplist\whitelist.txt

C:\Program Files\ags\mcp\logs\

C:\Program Files\ags\mcp\logs\toCheck\

 

My mcp.ini

 

PASSWD=stopit

LOG=C:\Program Files\ags\mcp\logs

BANNEDPAGE=C:\Program Files\ags\mcp\accessdenied.htm

HASHLIST=C:\Program Files\ags\mcp\mcplist\hashlist.txt

WHITELIST=C:\Program Files\ags\mcp\mcplist\whitelist.txt

DEBUGPASS=debugpass

CHECKTIMER=5

LOADTIMER=60

MAKECOPY=TRUE

 

Test OS = Windows XP SP3

Test browser = Internet Explorer 8

[LWard]

Has the GameKillerApp.exe process got write permission in the toCheck directory?

 

Just on the subject of GameKiller3, how's it coming along?

[Don__1]

Am I correct in thinking that only .swf files running in Internet Explorer are added to the 'tocheck' folder? The files run directly by double clicking them and using saflashplayer aren't currently added?

[Don__1]

Somehow i can not get it to work properly.

 

Atm we have autumn holidays, so i have some spare time to test it at home.

The program installs and runs fine, but it does not collect any new games into the toCheck directory.

I`m testing on a laptop and all directories etc. are localy installed and i`ve full rights to those directories.

 

I`ve tested several game websites, which all use flash games, the .swf files are cached in the Temporary Internet Files directory but they are not copied to the toCheck directory.

 

My test setup/directory:

 

C:\Program Files\ags\mcp\accessdenied.htm

C:\Program Files\ags\mcp\banned.html

C:\Program Files\ags\mcp\GameKillerApp.exe

C:\Program Files\ags\mcp\Interop.SHDocVw.dll

C:\Program Files\ags\mcp\mcp.ini

C:\Program Files\ags\mcp\MCPHasher.exe

C:\Program Files\ags\mcp\mcplist\hashlist.txt

C:\Program Files\ags\mcp\mcplist\whitelist.txt

C:\Program Files\ags\mcp\logs\

C:\Program Files\ags\mcp\logs\toCheck\

 

My mcp.ini

 

PASSWD=stopit

LOG=C:\Program Files\ags\mcp\logs

BANNEDPAGE=C:\Program Files\ags\mcp\accessdenied.htm

HASHLIST=C:\Program Files\ags\mcp\mcplist\hashlist.txt

WHITELIST=C:\Program Files\ags\mcp\mcplist\whitelist.txt

DEBUGPASS=debugpass

CHECKTIMER=5

LOADTIMER=60

MAKECOPY=TRUE

 

Test OS = Windows XP SP3

Test browser = Internet Explorer 8

 

From a workstation that is running Gamekiller, right click the icon down near the clock and enter the debug password into the box. See if there is any info in the debug screen that may help point to the problem.

[gperch]

Hi

 

I'd love to try Gamekiller (whichever version!) but the link doesn't seem to work?

 

Thanks

 

[peterp]

Hi all,

 

For those of you having trouble with gamekiller, sorry, but its really badly written and hacky.

It has two parts. The 1st is a hashing engine that monitors IE7 windows for url's ending in .swf

When found, it will obtain a copy of the file and generate an MD5 hash to check against a specified list of md5 hashes. If it exists on this list it will re-direct the browser window to a page specified in the .ini

 

The other part of the program will monitor the process list and kill any process who's name matches the KILL argument in the .ini

 

These are all forced to lower case.

 

eg.

KILL=outlook

KILL=flashplayer

 

This will prevent either outlook and flashplayer from running.

 

MAKECOPY=TRUE will make the program take a copy of any file that it can get that ISN'T matched by a MD5 hash check.

 

I have not used IE8 so I dont know if the methods for getting hold of URL's from open instances are the same as IE7.

 

Work on the new version (gamekiller3) is currently stalled due to workload at work, cisco sem3, and learning Android programming.

[Don__1]

The program has potential, thanks for the work so far.

 

Any plans in the futher to make hashes based on the programs running vis saflash.exe or similar?

Also, an option to disable the taskbar icon would be useful.

 

Thanks again.

[peterp]

The program has potential, thanks for the work so far.

 

Any plans in the futher to make hashes based on the programs running vis saflash.exe or similar?

Also, an option to disable the taskbar icon would be useful.

 

Thanks again.

 

It isn't possible to get files from running programs other then internet explorer, so getting the file opened by saflash.exe isn't possible. It is possible to kill all instances of saflash.exe with the KILL= line though.

 

If I sort out the problems with the new version, I will include an option to hide the taskbar icon.

 

The new version SHOULD be able to prevent the operation of ANY disallowed file, as it works by monitoring the OS calls to open file, it then snags a copy to hash, so it wont matter which program is doing the opening.

 

Saying that, certain filetypes dont seem to trigger the OS's event call for open file even though it should pick up ALL files on a given path.

 

If anyone wants a look, I have posted the code to sourceforge.net (search for the gamekiller project)

Edited November 11, 2009 by peterp

[Nutter]

Just had a look at your program and its a great idea we have the same problem with games etc

 

your program seems to be running from several filesystemwatcher objects which are not designed to detect files opening and after having a look around there only seems to be one way to detect these events in ntfs. by using a file system filter driver you need to download the windows driver kit from ms and in there is a minispy program written in c# once modified for your needs and compiled will give you the results you need to block any file from opening

Edited November 27, 2009 by Nutter

[jteegen]

Hello all,

 

I have stumbled across this thread in hopes to shut down games, and I think it is great what has been accompolished here! I would love to test this program out in my organization and contribute in any way possible. However, the download link provided is not working, and I don't think GameKiller3 on sourceforge is quite working yet. Could someone please repost a link to these files.

 

Thanks in advance,

 

jteegen

[Martin_ll]

I too would like to use the current working version of GameKiller?

 

I Presume gamekiller 3 is not ready yet ( I do hope peterp get's time to create this! It would be fantastic to stop the little wonders from being diverted to gaming during lessons)

 

What is the link to download the current version 2?

 

Thanks

Martin

[Don__1]

I'll host a copy for a while.

 

GameKiller 2

[Martin_ll]

Thanks for making that available!. We'll see if the software does the trick until ver.3 is unleashed.

[peterp]

Unfortunatly, with a change in job role meaning much more work at the moment, and problems with the filesystemwatcher objects not reporting correctly, version 3 may never see the light of day.

[eastofsmeg]

It isn't possible to get files from running programs other then internet explorer, so getting the file opened by saflash.exe isn't possible.

 

Does anyone know a way of forcing flash to open in internet explorer instead of the stand alone player? as i seem to be unable to kill the standalone player at all.

[ABennett]

Hello,

 

I would like to know if somebody has found a way to prevent these naughty flash games from loading (.swf) I found out that using Hash rules would stop many file types , but It does not work for .swf, at least not with me that I have tried.

 

please help because game invasion os on the rise on this school

 

Ricardo Carrera

ICT Technician

Moorside High School

 

Ricardo, have you set swf in the definition types entry in the policy element?

[linkazoid]

Could anyone host a copy of V2 for me or put it on RS? I downloaded it ages ago, but cannot find it.

 

Thanks

 

Michael

[Don__1]

Gamekiller2 Edited May 20, 2010 by Don__1

[linkazoid]

http://www.ns400r.co.uk/gamekiller2.zip

 

Ta very much!

[kili]

I think this is one of those areas where you have to accept that the problem is not technological so the fix is also not technological.

 

There's a whole raft of things which are not allowed in schools and that is enforced not by any kind of technology but by teachers saying "no" and, if necessary, dishing out punishments or sanctions.

 

Trying to find a "fix" for blocking some swf files but not others is pretty much doomed - you simply need to be able to report user "X" to a teacher, head of year etc and let them deal with it. Alternatively, if the school won't deal with it then don't let it worry you :-)

 

Ah.. common sense is always the first option. I'm with you on this one, you just cant stop everything no matter how hard you try. It's down to the teaching staff to deal with this one mate.

 

Kili

[Grayda]

We (were) facing the same problem at our organisation. At first we were using Group Policy's Software Restrictions to block unwanted programs, but students found ways around that, including opening the file in Notepad, changing a byte at the end then saving. One byte changed = brand new hash = not blocked. Worked quite well, even though they were editing it in Notepad.

 

So we took the extreme measure. We created a GPO that would:

• Prevent certain filetypes from being run (including EXE, BAT, DLL, OCX)
  
• Prevent certain filetypes from being copied anywhere
  
• Delete the offending filetypes from their home (H:\) drive
  
• ONLY run in the "Students" OU (So it didn't affect staff)
  
• Only run on H:\, C:\Documents and settings\%username%, D, E, F, G, I, J, K drives, %temp% (basically anywhere we can't monitor easily). This let us block content on USB drives too.
  
• Block FlashPlayer.exe and varients
  

 

And modified our WebMarshal rules to block all multimedia unless the site was in the "Allowed" group.

 

The results are astounding. Once GP was applied to all machines, game playing dropped to almost zero. We had students and teachers saying "Well what about those who do multimedia or programming?". And the answer is, our curriculum drive (Z:\) isn't affected by the block so students who do multimedia can put files in there (the folder is heavily moderated) and students who do programming don't compile their programs. They send the source to the teacher to view and compile.

 

Now, with games and other unwanted programs blocked, we have several things to look out for:

• Computer damage (bored students = graffitti, smashed screens, broken keys)
  
• Online anonymizer sites (Students were using Opera and Safari to get around website filtering)
  
• Frustrated students. Now that they can't play games, they would focus their attention on bullying others
  
• Emailing. Students are now using email (a provided resource) to "chat" with mates.
  

 

But at least now we have one way of managing what they do on the system. Next up, installing iTALC for staff to use!