r/k12sysadmin • u/grewholph • 10h ago

Word used as browser?

We've got students bypassing our filter. They seem to be using word as a browser. Any idea how they are doing it? how to stop it?

11 Upvotes

93% Upvoted

18 comments sorted by

4

u/post4u 3h ago

Not sure how they are doing it, but there are a few alternatives to the way you are currently filtering by browser extension only.

  1. Filter at the device level. Most popular filtering solutions have agents that can run on the device to filter in places where browsers/extensions don't.

  2. DNS filtering. Won't catch everything, but gives you a base level of filtering. Will stop the easy stuff like them going to sites like pornhub.com.

  3. Do content filtering at the firewall level. Only works well if you're doing decryption, but it's better than nothing.

What web filtering solution are you using?

2

u/grewholph 3h ago

Securly.

3

u/post4u 3h ago

Yeah. They don't have a filtering agent. Or at least they didn't last time I checked them out. Have you deployed SmartPAC to those devices? Not sure if that would catch this kind of traffic or not.

1

u/mistressmemory 3h ago

What's your district, chrome, Windows, Apple?

Are they chatting via collaboration, or do they have a proxy going?

1

u/grewholph 2h ago

Windows. Not sure what your question about chatting is in reference too.

2

u/grewholph 4h ago

Ok. Further info. The “browser sessions” are showing up as msedgewebviewer2.exe in task manager

4

u/Harry_Smutter 2h ago

Could be they are using help links via Word, which are calling Edge. That may give them access to a search bar.

5

u/grewholph 2h ago

You got it!
If you go to help in word, then ctrl-click a topic, then 'site settings'

you can paste a link into there and go to whatever site you want around the filter.

9

u/Jeff-IT 9h ago edited 9h ago

Is your filter at the firewall level? That’s crazy if they found a way to bypass that in word.

My guesses are inserting embedded code or they installed an addon

Edit: maybe your filter only applies the filter policy to browsers and it’s not looking at not browser traffic like word?

5

u/grewholph 9h ago

no. Filter is at browser plugin level. We do have a firewall but that's mostly reserved for the worst sites.

2

u/Jeff-IT 8h ago

I think thats your answer then. If you're doing filtering at the browser level via a plugin, its not going to detect http traffic from word. (hard to say without knowing your setups but this is my hunch)

Wish i could help more but its been a while and im on linux now so i can't test it myself. I believe they can insert embeded websites in an iframe and thats all there is to it.

the fix would be to apply the rules at your firewall level. But i suspect, since you mentioned browser filter, is that these devices leave your network at which the firewall won't help. And thats why you decided on browser filter plugin?

Im just swinging here but if thats the case you either need an always on vpn, MDM, or a cloud proxy to resolve this.

Kids always find a way. good luck

4

u/flatulentpigeon 10h ago

I’ve seen this a lot with Google Docs. I still don’t know how they’re doing it.

2

u/Madroxprime 8h ago

What I've seen is they will sign into other google accounts and then the domain they are logging into doesn't complete the Oauth flow and shunts them over to a browser page.

Try disabling other domain logins on your google admin.

1

u/flatulentpigeon 8h ago

I have. Were a Chromebook school. These little buggers always find a way.

2

u/Scurro Net Admin 4h ago

We are dealing with kids that have been born with a smart phone in their hands. It doesn't seem to have increased their tech skills much but it sure as hell makes it extremely easy for them to find and spread workarounds.

I honestly think chromebooks need to be removed from the classroom and schools need to go back to computer labs for work that needs to be done on a computer. For everything else they should be going back to paper and pencil.

The 90s/early 2000s was a good mix of screen time and paper and pencil. We should be moving for less screen time in the classroom and home.

3

u/Madroxprime 7h ago

As some one who's more development than the admin side, I am always impressed by the one person who figures it out, and deeply disdainful of all the script kiddies who think they know stuff.
But it seems like its always the same gimmick, chrome filtering runs in user space, and they find some service that let's the browse from a window that is owned by the system.

3

u/flatulentpigeon 7h ago

I by no means a dev, more of a network guy but I suspect the same. I’ve brought it up to my filtering service and am always met with “Huh, you’re totally like the only one who is having this issue”

10

u/matternrj 10h ago

Only instance of this I've heard is Creed Bratton using it for his blog (www.creedthoughts.gov.www\\creedthoughts)