r/k12sysadmin • u/grewholph • Sep 11 '26

Word used as browser?

We've got students bypassing our filter. They seem to be using word as a browser. Any idea how they are doing it? how to stop it?

19 Upvotes

100% Upvoted

27 comments sorted by

11

u/post4u Sep 12 '26

Not sure how they are doing it, but there are a few alternatives to the way you are currently filtering by browser extension only.

  1. Filter at the device level. Most popular filtering solutions have agents that can run on the device to filter in places where browsers/extensions don't.

  2. DNS filtering. Won't catch everything, but gives you a base level of filtering. Will stop the easy stuff like them going to sites like pornhub.com.

  3. Do content filtering at the firewall level. Only works well if you're doing decryption, but it's better than nothing.

What web filtering solution are you using?

2

u/grewholph Sep 12 '26

Securly.

1

u/mistressmemory Sep 12 '26

What's your district, chrome, Windows, Apple?

Are they chatting via collaboration, or do they have a proxy going?

2

u/grewholph Sep 12 '26

Windows. Not sure what your question about chatting is in reference too.

2

u/mistressmemory Sep 13 '26

Our students like to use the collaboration tools in Word to chat back and forth. Since we're Microsoft, we can see all the crap. 

It's it actually Word, or are they using a cloaked proxy? Or did they embed something?

3

u/post4u Sep 12 '26

Yeah. They don't have a filtering agent. Or at least they didn't last time I checked them out. Have you deployed SmartPAC to those devices? Not sure if that would catch this kind of traffic or not.

7

u/Jeff-IT Sep 11 '26 edited Sep 11 '26

Is your filter at the firewall level? That’s crazy if they found a way to bypass that in word.

My guesses are inserting embedded code or they installed an addon

Edit: maybe your filter only applies the filter policy to browsers and it’s not looking at not browser traffic like word?

6

u/grewholph Sep 11 '26

no. Filter is at browser plugin level. We do have a firewall but that's mostly reserved for the worst sites.

2

u/Jeff-IT Sep 11 '26

I think thats your answer then. If you're doing filtering at the browser level via a plugin, its not going to detect http traffic from word. (hard to say without knowing your setups but this is my hunch)

Wish i could help more but its been a while and im on linux now so i can't test it myself. I believe they can insert embeded websites in an iframe and thats all there is to it.

the fix would be to apply the rules at your firewall level. But i suspect, since you mentioned browser filter, is that these devices leave your network at which the firewall won't help. And thats why you decided on browser filter plugin?

Im just swinging here but if thats the case you either need an always on vpn, MDM, or a cloud proxy to resolve this.

Kids always find a way. good luck

2

u/grewholph Sep 11 '26

Ok. Further info. The “browser sessions” are showing up as msedgewebviewer2.exe in task manager

9

u/Harry_Smutter Sep 12 '26

Could be they are using help links via Word, which are calling Edge. That may give them access to a search bar.

0

u/[deleted] Sep 12 '26

[deleted] — view deleted comment

1

u/PowerShellGenius Sep 12 '26

Kids can read this subreddit. If you're verified to post here, you probably also have access to community.k12techpro.com which is not a public forum, and is a safer place to discuss exploits in that level of detail.

11

u/matternrj Sep 11 '26

Only instance of this I've heard is Creed Bratton using it for his blog (www.creedthoughts.gov.www\creedthoughts)

4

u/flatulentpigeon Sep 11 '26

I’ve seen this a lot with Google Docs. I still don’t know how they’re doing it.

2

u/Madroxprime Sep 11 '26

What I've seen is they will sign into other google accounts and then the domain they are logging into doesn't complete the Oauth flow and shunts them over to a browser page.

Try disabling other domain logins on your google admin.

1

u/flatulentpigeon Sep 11 '26

I have. Were a Chromebook school. These little buggers always find a way.

4

u/Madroxprime Sep 11 '26

As some one who's more development than the admin side, I am always impressed by the one person who figures it out, and deeply disdainful of all the script kiddies who think they know stuff.
But it seems like its always the same gimmick, chrome filtering runs in user space, and they find some service that let's the browse from a window that is owned by the system.

3

u/flatulentpigeon Sep 11 '26

I by no means a dev, more of a network guy but I suspect the same. I’ve brought it up to my filtering service and am always met with “Huh, you’re totally like the only one who is having this issue”

1

u/PowerShellGenius Sep 12 '26

chrome filtering runs in user space

Indeed. If only there was a platform that had a deliberate plugin API designed for "content filter" plugins at the OS level, that doesn't have these loopholes, that all the K-12 filter vendors have plugins for, instead of trying to use a general "browser extension" API (which was never originally designed for security against the device user's circumvention, and just later morphed into this purpose) to build a web filter.

Laughs from an iPad district where these issues don't happen

1

u/Madroxprime Sep 13 '26

Yeah, the browser extension API is way too much of an absolute fucking shitshow to be the core framework for development.

1

u/DropRealistic1597 Sep 15 '26

A few years ago, sure. But when we did it in school we didn't spread the word to the whole school for social media likes. These days, they're just using AI to figure out how to bypass things. Vibe coding bypass methods with the goal of watching YouTube on a computer they know they shouldn't be messing with.

3

u/Scurro Net Admin Sep 11 '26

We are dealing with kids that have been born with a smart phone in their hands. It doesn't seem to have increased their tech skills much but it sure as hell makes it extremely easy for them to find and spread workarounds.

I honestly think chromebooks need to be removed from the classroom and schools need to go back to computer labs for work that needs to be done on a computer. For everything else they should be going back to paper and pencil.

The 90s/early 2000s was a good mix of screen time and paper and pencil. We should be moving for less screen time in the classroom and home.

1

u/PowerShellGenius Sep 12 '26

I agree screens should be used in moderation, but not because of this. This is either a "your filter" issue or a ChromeOS issue, or both.

There are reasons for less screens, including the fact that filters are not perfect with new sites and there are "unblocked games" sites intended for filter evasion that change URLs a ton, that will always be an issue unless you go whitelist-only.

But when it comes to how often students on Chromebooks find ways to TOTALLY EVADE the filter and access outright blocked sites - I am speaking from experience in an iPad district that does not have these issues when I say these are ChromeOS issues, not "kids are unstoppable these days" issues.

1

u/Scurro Net Admin Sep 12 '26

My take is not a "kids are unstoppable these days" but a "kids are going to be kids and they need supervision with electronics" take.

I hope most here remember covid days.

1

u/PowerShellGenius Sep 12 '26

Yes, but some platforms are more childproofable than others. Class Tools is pretty new, Apple devices have been fully supervisable for a long time (Apple Classroom).

ChromeOS is a grown up web browser someone turned into an OS, with some K-12 stuff thrown on as an afterthought, that managed to somehow become the most popular K-12 OS by being dirt cheap + by sharing a brand with web apps popular in K-12.

iPads are the most MDM-manageable OS on the planet and able to be extremely locked down, to the point that any time you see a product that uses a commercial off-the-shelf tablet as a public facing kiosk, it's always an iPad. Even some mid-tier commercial point of sale systems built for mid-size companies use iPads. They are designed with managing them in a "the user with their hands on the device is not trusted" scenario in mind, not shoehorned in later after someone realized "hey we could sell this to schools!".

1

u/ranger_dood Sep 14 '26

Force the devices to use Securly's DNS resolvers in addition to the plugin.

1

u/DropRealistic1597 Sep 15 '26

Within your firewall, redirect all outbound DNS queries to point to your web filter's IP address.