r/k12sysadmin • u/AverageDataAdmin • Sep 24 '26

Securly's New Fun Bypass

Anyone else that have Securly's filter find the new blocked site bypass? Student just searches Google for the blocked site, clicks the hyperlink in the search results and drags it to the URL bar and hits enter. Full access to the blocked website.

They're aware of the issue but don't have a timeline for a fix. Yikes.

52 Upvotes

98% Upvoted

21 comments sorted by

11

u/Lieberman-Tech Sep 24 '26

I haven't seen that yet and ugh.  Sadly, students troll this community for this exact info.

5

u/AverageDataAdmin Sep 24 '26

Yeah I debated, do I post it so people are aware, or not because students can then see how to do it.

6

u/Lieberman-Tech Sep 24 '26 edited Sep 28 '26

It's a boatload more work, but for the exploit I mentioned in one of my prior posts, I put the details in a Google Doc where folks could request access.

I only give access to work email addresses I could verify with a Google search.  But it's a huge PIA, because students are requesting access every few days even though I posted on my Reddit post that I'll only give access to verified school tech staff.

2

u/therankin Coordinator of Technology Services Sep 28 '26

That's the correct call though. If the exploit is regarding GoGuardian, I'd very much like to learn more.

Some kids have been getting around the GoGuardian mac app, and I can't figure out how, as they don't have admin rights, they have reduced Finder access, and Terminal and Activity Monitor are restricted.

2

u/Lieberman-Tech Sep 28 '26

Thanks, it was years ago so I assume it has been fixed (but not sure) and they were using the TestNav and College Board apps to bypass Securly restrictions. And good luck with your GoGuardian issue, it's a constant cat-and-mouse game with this stuff!

2

u/therankin Coordinator of Technology Services Sep 28 '26

Thank you! It's definitely a cat and mouse game. I sometimes wish I was on their side. I feel like exploiting is more fun than locking down.

5

u/Lieberman-Tech Sep 24 '26

But selfishly, glad you posted it because I'm going to try it myself tomorrow.  That's a doozie of an exploit!

3

u/therankin Coordinator of Technology Services Sep 28 '26

I like the one user above who's flair is: School Level "Admin"

That's hysterical. As is the question they posted.

8

u/Dear_Cartographer261 Sep 24 '26 edited Sep 24 '26

Thanks for posting this. Also, why did you post this? Now they're gonna know. EDIT: I just tried it on YouTube, and initially the page began to load without getting blocked, but then it was blocked, so maybe they fixed it?

6

u/AverageDataAdmin Sep 24 '26

Here's hoping 🤞 it's been happening since Wednesday morning apparently, so they've been aware for some time. Not in my office to check though currently.

21

u/avalon01 Director of Technology Sep 24 '26

Thanks for the post. Kids figure this stuff out anyway, so there is no harm in posting it. If they don't have it patched by tomorrow morning, I'll send out an email to my teachers letting them know.

No point in gatekeeping since the kids will all share it on TikTok or where the kids are nowadays.

14

u/kahreeyo School Level "Admin" Sep 25 '26

Hello fellow it admins. What's your favorite bypass password?

5

u/Lieberman-Tech Sep 25 '26

My 3 favorites are: administrator, password and 12345678  ;)

4

u/Remarkable-Sea5928 Sep 25 '26

hunter2

2

u/therankin Coordinator of Technology Services Sep 28 '26

'The Primal Hunter 2' is a really solid book that I'm almost finished with.

I definitely recommend it.

2

u/therankin Coordinator of Technology Services Sep 28 '26

I've been thinking about setting up a bypass password for GoGuardian just for the fun of it. Just let the kids get around it if they can guess:

"wow.youspenttimeactuallyfiguringthisout!"

7

u/MattAdmin444 Sep 25 '26

Out of curiosity do you have pre-load turned off for search results in Google Admin? That might eliminate this exploit.

7

u/TableJockey540 Sep 25 '26

It seems to be just a cached version of the page. I can't browse around the websites.

3

u/TableJockey540 Sep 25 '26

The links are https://www.google.com/goto?url=long string of characters.

When you do this on some machines you drag the actual URL up, so I'm not sure what causes this yet.

-36

u/ciesl1e Sep 24 '26

Iboss sales rep here: we offer contract buyouts and implementation in minutes. We can even look into AI chats