secular-ly

Today's Securly Bypass Flavor Got a new one, not as sophisticated but interesting: github.com/ading2210/secular-ly/tree/main Essentially, this uses a file on a machine, Java, and potentially Bookmark creations to create a state in which Securly can be overridden. The code is public so you can see how it works. It's pretty straightforward. We have already submitted a ticket to Securly. I would advise others to do the same. To protect/prevent: 1. Users & Browsers Setting: URL Blocking --> for the domains listed in the GIT. Blacklist them where applicable (GAdmin, Firewall, etc). GIT should also just be blocked for students period IMO unless overrides needed for specific items. Note the .dev and .app pages can jump / move, domain names are just that so...this could be a moving target / whack-a-mole 2. Users & Browsers Setting: URL Blocking --> Block file://* inside your URL blocklist for students. Prevents user from accessing local files on the Chromebook with the Chrome browser. This is somewhat of a nuclear option here but it works to prevent local hosted .html files 3. Users & Browsers Setting: Content/Javascript --> Disable Javascript or at least on specific sites (local files, websites, etc). Prevent the user from engaging with Javascript to run functions in a webpage. If Java is enabled this then uses the cookies created with Securly to then break the extension as it runs inside the Chrome browser. Have fun fellow K12 folks. This won't be the last time we discuss this but...this is today's fun one of the day.