Hacker News Reader

Comment by Retr0spectrum | Hacker News Reader

For me at least, my school's aggressive network filtering was a great learning experience. They used deep-packet-inspection combined with SSL MITM, so I designed my own obfsproxy-like tunneling protocol. In retrospect, I could probably have just used obfsproxy, but as I said, it was a great learning experience.

View on HN

We had filtered internet at home. I learned a lot about networking and VPN's because of that fact.

I'm doing the same currently but like any subject I encourage questions about the how & why. If we have a discussion about content that is filtered that has more to do with technical aspects I will, right now, always allow access. If it's about the actual content then it becomes a broader discussion that involves both parents.

My goal is that by keeping communication open early their moral compass will be developed enough to evaluate situations when the parental units have absolutely zero control over access. Pretty much like any other aspect of parenting except requiring more technical acuity.

The level of filtering at my school led to pretty much everyone knowing how to find and use a proxy - even some of the teachers would occasionally say to use one if something they needed was blocked. Watching the level of filtering ramp up over the last year of my time there, and the efforts by some students to side-step it, was rather entertaining:

* HTTP proxy server filtering traffic -> CGIProxy scripts found online to avoid the fixed filter list

* Alternative HTTP proxy server with a more thorough/updated list -> Self-hosted CGIProxy (at home)

* Network admins. actively monitoring for new proxy sites -> Self-hosted CGIProxy on a wildcard domain (unsurprisingly, that didn't last long)

* Locally installing monitoring software that would monitor the contents of any IE windows -> Portable Firefox + asking for the HTTP proxy server details (which unbelievably were given without question despite there being no allowed use for it - you weren't supposed to connect your own devices to the network or use your own software)

* More aggressive monitoring software (Impereo) that would kill any window with "Firefox" or "proxy" in the title -> Firefox extension to hide the window title

* Updated version of that software that would reliably kill Firefox (plus other behaviours which I forget) -> Exploit a weak password (single dictionary word....; hash cached on clients) to get domain admin. rights, then create an anonymous account that had sufficient rights to kill off any monitoring software (probably was another domain admin. account - I wasn't aware of the specifics)

Definitely a learning experience (and some of the teachers definitely knew but turned a blind eye as they knew it was motivated by curiosity rather than malicious goals), though perhaps not the education the school intended! The new account hung around for a surprising long time - it wasn't until someone malicious changed all of the machines' local admin. passwords[1] that it was discovered and disabled. That actually ended up being a lesson in OPSEC to some degree - turns out Impereo was tracking USB memory device names, and most of the people involved had changed it to include their name, thus tying them to the domain admin. account creation.

(Also, a side note, but if you have a VNC server on every machine in the school, maybe don't have a three-character password that is entered where students can watch the keyboard...)

[1] No idea who/why. It just wasted people's time for no reason, something I know the main group of people doing this tried to avoid - the most malicious thing they did (other than compromising the account....) was change a single pixel in the desktop background image as a proof of concept.

in the getting around a webfilter department... at previous job, the way to get around youtube filter?

Use google translate to "translate" the page you wanted to watch.

Reply on news.ycombinator.com