PDA

View Full Version : Network security = shocker



The Error Guy
07-10-2010, 09:41 PM
Just been thinking about the secure state of my schools network. its pretty much a shambles!

School PC's run norton somewhere which has become the school joke as a virus alert kept popping up during a telling off session from out deputy head. other than that I think they run some random business/network AV program so thats sort of ok.

however every wireless AP is unsecured, all traffic goes through a HTTP proxy and the connection is encrypted by base64 :eek:. the whole thing is a security mess, all it takes is a packet capture and then you have logons, log into proxy more captures and you could start capturing Admin passwords :drool

At one stage we thought we were clever and downloaded AB tutor control (the software on all school PC's, handy dictatorship style app) and tried to turn off random computers. only problem was they all had passwords, all except our network admins computer :clap, that was not passworded (i mean of all the computers the admins?)

There are virtually millions of flaws in the security, i wounder how long it is before someone exploits them? I'm trying to work with the staff to fix the blasted thing but its not going very far.:annoyed:

Anyone else had some schocker shocker networks?

nedkelly
07-10-2010, 10:08 PM
One of my old schools had a proxy setup that required all traffic to go through a specific port that required authentication, so one day when working there I asked if I could access the net from my laptop they said no so I was playing around on lunch-break, changed the port to access the internet to 443 and hey presto I had internet that was faster than any other computer in the school, shame I had the good nature to tell them about it.

The Error Guy
08-10-2010, 08:10 AM
Once one of the guys routed all network traffic from the server through one of the boarding house routers to his laptop, the router was a WRT54G, it failed to cope after 15mins. he also spoofed the servers MAC.

it gets epically boring sometimes, hence the fact we usually spend afternoons doing stuff we're not supposed to in the winter. summers great though. we pretty much spend the whole day at the river

Chilling_Silence
08-10-2010, 08:37 AM
They do it to keep students entertained, it's also a great way to find a prodigy child to pass on your knowledge to so you can one day pass the mantle ;)

berryb
08-10-2010, 09:41 AM
There many ways to lock down a system and many ways for the students to try and hack it.

Even school Zone provided by Telecom has holes the size of elephants when to comes to online access.

All one can do is try and keep one step ahead.

8ftmetalhaed
08-10-2010, 09:46 AM
Before my highschool's network admin got his act together (sort of) there were rather immense holes in the network. At one point a friend of mine used a live linux cd to access all the files on the school server as none were passworded. He changed the splash page image that people see when they log into the intranet from a chess set on a globe to a paint smiley face, then it got taken down, then he replaced it with a shoddy paint penis. It was bloody hilarious.
Since then there's been a new net filter added which is an absolute beast, blocking anything from google searches for proxies to blocking sites for being 'game' related when there's nothing of the sort on or even near them. I assume there's also been a password added to the server and some other fixes added but yeah, it was pretty terrible till that time.

nedkelly
08-10-2010, 01:39 PM
Your school left boot from cds enabled? Hilarious

robsonde
08-10-2010, 02:56 PM
I have some experience with school networks...
I ran a school network for a year.



1. sort out a good firewall.
even a free one.

2. lock down the WIFI.
WPA or better.

3. setup a proxy that has black lists and logging of URL's.
you NEED to be able to block some sites.

4. re-build every desktop.
you don't know what crud is in them.

5. get AV on every desktop.
even free AV is OK.

6. setup good desktop lock down policy.
lock down stuff students don't need.
block the install of random programs.
BIOS passwords and boot order.
control panel.

7. get some policy about hacking, enforce it on students who think the network is a play ground.
get parents to sign off on this before the child is given a network login.

8. if you find the right kind of student, ask them to help run the network.
often the "hacker" students are just board geeks, give them something productive to do.

9. keep up with the maintenance, read the proxy logs every day.
even write a few scripts to look for key words in the logs.
www.<adult word of choice>.com is almost always a bad site :-)



step 9 is the most important.
depending on the size of the network, this can be a full time job.
a guide line is more then 100 desktops = full time admin.



other questions include:
* backup?
* domain name?
* email accounts?
* printing?
* remote access?


.

The Error Guy
08-10-2010, 03:35 PM
That reminds me, BIOS is not passworded, set boot to my external. problem solved. at one time I had an internal HDD in one of the Boarding house PC's that was "broken" (its proper OS had packed up and died so no one used it)

Their proxy is fine but the actual internet provided is horrible 2mb/s, that gets pretty slow when 50ppl are using, so during classes its almost un-usable at times\

They use schoolzone so filtering is Ok except most people (especially boarders) disagree with a lot of content that the school blocks

Chilling_Silence
08-10-2010, 06:44 PM
50 using 2mbps (16m/bit?) is HEAPS! Somebody isn't QoS'ing properly ... Hell I've run over 100 people on 4m/bit successfully. Blocking YouTube and throttling other streaming video helps immensely.

The Error Guy
08-10-2010, 10:50 PM
Well, I don't know exact number of people online (or the QoS settings) I assume they are telco and windows server default Voice/gaming/other time sensitive with video and P2P on the bottom, but whatever it is it's bloody slow at times, could be the internal wiring or server problems (all all network traffic is routed through the server) FTP doesn't go through the server though, I seem to remember that was reasonable (ish) downloading via FTP on a server hosted in kapiti (server upload is about 5mb/s) got a 80-120kb/s download, SSH was about the same.

any of those "problems" wouldn't surprise me, the school does its best I guess its just not quite up to it. I haven't had it happen to me but teachers say the internet drops out quite regularly at random intervals. only time I get it is in the design room, but thats with about 20 apple PC's on an airport, so ill blame the big apple, just to be nasty :devil

Chilling_Silence
08-10-2010, 11:32 PM
The server would be either 100m/bit or gigabit. Anything from around 1Ghz upwards could easily suffice as a windows proxy, less for Linux .. Sounds more like QoS...

Agent_24
09-10-2010, 12:11 AM
http://www.dansdata.com/gz080.htm

The Error Guy
09-10-2010, 03:21 PM
Well, the boarding houses are linked with fiber (or supposed to be) however latencies are variable from 60ms distance 850m to 230ms 850m so its probable QoS, when I get back Ill have a poke around and ask if I can fix.

oh, and students don't have youtube access, except for our team :devil because of some handy SSH. whoever invented that was bloody legend

But unsecured AP's are my special fav. were once so useful for checking the google maps when roaming the streets or last min emails, now truely a rarity. bit of a shame they get abused.

8ftmetalhaed
09-10-2010, 06:01 PM
Our internet was often worse than dialup speed, because of kids in the info commons (nearest the server) nicking all the allocated bandwidth on flash games, of all things. In the areas with wireless networking setup, you'd often get cut off by seagulls landing on the transmitters.

And yes, booting from cd was available, as was booting from a usb (on compatible pc's), as was floppy. The main way of building a desktop was either remotely (if it was on and responsive) or phsically via 3 or 4 floppy discs which started up a build via the lan.
(During a short stint as IT help kid I rebuilt a few pc's, flipped some ram sticks around, logged certain pc's as just plain broken, etc. And also dealt with such problems as ethernet cables being unplugged.)
In terms of physical security, some of the pc's had key locks, others had cable ties. Others had nothing at all. Also the bios was unpassworded on a small number of machines to begin with... which led to some hilarious setting changes in some cases.


And up until the proper filter was installed it was a shocker what was available, and also was incredibly annoying to find what WAS blocked. Teachers were frequently pissed off at YT being blocked, and yet many, many chan, porn and game sites were open for the students to laugh at.

Almost all technical jobs (like setting up some new infrastructure or fixing problems with the software) saw the jobs outsourced to the system managers, as the tech guy was (still is) kinda useless. I mean, it would take about a month before any sites were blocked, regardless of their content. The old tech guy was much more onto it though.

Anyway, /technoramble.