Printable View
i'm on a school network and all personal computers are logged in using this AEGIS client software, i dont know if the client makes a difference or not, but how does the "master computer" see what ur doing on ur computer ie downloading off somethin like kazaa?
sorry to use a word like master computer, but i was at a loss of words for whats its really called
There are many way's this can be done. First off, the network admin of your school could see incoming traffic/outgoing traffic coming from KaZaa and can see activity going through that port (not sure off the top of my head what it is). Your schools using that software specifically SO they can see what you are doing and that you aren't doing anything against their rules.
Well,
I presume that you connect through a server (master computer) this logs your connections, traffic etc.
Similarly, your ISP logs your connection from home.
Hope that helps
Yeppers, you have got a bad infection of spying admins. They sit there and check out the logs of traffic and can pin point just which computer is connected to Kazzaz or that warez site down the street. Then they make little notes and call you in to ream you out for breaking your agreement with their network, and for endangering every one on it by being vulnerable to virus, worms, trojans and other malware while you were being a bad boy.
<offtopic>
nihil: You think they (ISPs) log ALL connections? If so... I must be generating huge log files... with all the phish bootleg sites and archive.org shows that I've been mirroring... Not to mention my network (inet connection) is constantly being used 24/7... or everyone else that uses PCs here... I'm just one of 5 that use it ALL the time.
</offtopic>
Well, this year my school increased it's security...
Now every computer has a keylogger and a backdoor on it. So now teachers can use that backdoor software and can check out what's on your desktop. Sheesh!
Hi phish~
I guess it will depend on what country you are in...............some regimes probably require all items to be logged.
I guess the main issue is how long they keep the logs for? I seem to recall that the FBI spent a long time going through logs to prove that David L Smith was vicodinES (Melissa virus).
I am pretty sure that as soon as someone raises suspicions then everything will get logged.
My point is that they certainly have the capability, whether they have the motivation is another issue. Certainly if they don't there would be little point in reporting abuse to them.
Cheers
Moxnix: Just wondering, but why is this a "bad infection"? And "spying admins"? Do you mean admins doing their job? Because that's the way I view it. They are just network admin's doing their job, making sure the rules are being followed. Doesn't seem anything like a "bad case" of anything.Quote:
Yeppers, you have got a bad infection of spying admins.
Spyder, My sarcasm apparently didn't come acrossed as I planned. What I was saying, is that yes every thing you do on a protected network can be traced right back to you, by any admin that is doing his job.
Ahh I see! Sorry my friend, I'm a little off today. And you are right, it can and should be traced and logged. Sorry my friend :)
i use e mule and the servers for are like sexsexsex.com or somethin like that and i can configure it to connect to port 80 do they still know i'm downloading, can they see what i'm downloading, or does it just look like i'm looking at porno
I really think that you should check out your authorised user policy, before you get into deep trouble.
The answer to your question is yes they can tell that you are downloading, as well as the sites that you visit.
I must admit that i am surprised that you can actually connect to sites of that type, usually I would expect there to be filters/blocks to prevent it. Could it be that you are being given enough rope to hang yourself?
Take care
Agianst sniffers, use a proxy that supports encrypted sessions... enought said.
how do they kno that i'm downloading?
is it possible use a proxy if i'm on a school lan? i didnt think i could
I already answered your question so don't bother embarrassing yourself, its obvious and shouldn't have to be explained after everything has already been said, just delete or edit/bind that one and stop double posting things.
They know what your downloading by the requests to and from servers... if that isn't obvious enought... hex values of headers MZ, PE, (ect). This would indicate that you downloaded an executable even if its been renamed to executable.mp3
If they could get a good hex dump from within the logs then they could have this converted back useing debug or something and have the file right on their own hard-drive. Or look back on the things you've connected to and then check it out themselves.
If its keylogers, once agian, just fallow the yellow brick road. :p
They see traffic coming from the ports of the services from which you are downloading from. I'm going to make this next bit simple -- don't do what you are doing, you will be caught.Quote:
how do they kno that i'm downloading?
'Nuff said.
Why don't you just ask what you really want to know? How do you beat the system?
Yes you will get flamed (really suprised you haven't yet). And yes you'll collect some negs, but what the hell you want to do thing just your way anyway....right?
Well, I will tell you how to beat the system. I assume you are living in a dorm at school.
1. have a telephone put in your dorm room
2. get a ISP, or have DSL put on your line.
3. have fun, because then no one is looking over your shoulder and/or protecting you from yourself.
To follow up with what Moxnix said: Or, setup a home network with your computers/systems that you have an do all your business and experiments on that. Pretty simple, eh?
these security messures might seem stupid and extreme when your at school, but you will learn why years down the track. you also think its stupid and that they should get off your case, but the fact is you shouldnt be doing those sorts of things, so really stop complainging about getting caught for breaking rules. :p you know what i mean.
ANYways,
this client you sign into, is possibly one that logs all this stuff, aswell as other resources mentioned above. does each user have a login and password, or do you all use the same one?
in any case, just be careful with what your doing and always watch you back. you could pull of the greatest feat ever done, but none of it matters if you get caught :)
i kno they can see what ports i have open and who i'm connected to, but with out the hex dump, how can they see what i'm downloading, and my queues
Ugh, they have a damn network monitoring program installed... my school uses NetOp, any teacher can see ur screen in plain view and control your desktop and it wouldn't be any suprise that your school has a similar program installed with similar features....
Morale of the story, don't do stupid **** like download stuff on school computers.. you're just eating the school's bandwidth and giving them a better than average shot of getting infected with some skiddie virii.
I remember back in high school with the network running good ol' win98 SE2. They placed a backdoor (subseven to be exact) to monitor each computer as needed. Curious as to why I felt a lag spike in my connection every so often, I ran a netstat and saw that a local IP was connected to my computer via a subseven port. A quick memory of how the computers were layed out in our school brought to my attention that this was in the server room (where the computer teacher also took her break). So, knowing that the lag spike was caused by subseven taking a screenshot of my desktop and sending it to the teacher, I placed on notepad the words:
"I know you are watching me"
And let it set for a 30 second interval, perfectly fitting three screenshots worth (a screenshot was being taken every ten seconds). This of course didn't do anything, but I'm sure it gave the teacher a good laugh. Anyways, a nice tip to anyone in a similar situation would be to work the desktop in timing intervals. Since I knew the lag spikes were screenshots requests, and the timing was in ten seconds intervals, I knew I could work on anything for nine seconds before having to press Windowskey+d and take everything to the task bar so I could only have the desktop showing.
To complicate matters I had the taskbar set to autohide, and had set the wallpaper as a picture of the desktop as it normally is. Nothing loaded in the taskbar, and nothing open. So when everything minimzed at that 9 seconds (thank you stop watch!) all the teacher would see on the screengrab was a normal desktop that was actually a wallpaper lol, which then of course everything could be brought back to the front so I could work another nine seconds on it.
Don't ask me why I've talked on and on, I don't know
i didnt think they could do that here becuase these are our personal computers this isnt high school, its college
It may be your computer, but you are on their network. They won't touch your computer, install backdoors, or the like onto -your- system. But they have every right and reason to monitor their own networks for trouble (packet detecting, port connection detecting), much in the same way you have ever right and reason to monitor your own computer for trouble (spyware searching, firewall packet filtering)
Hi Pooh, Hi all
Fox, I suppose as adminstrator they can make your connection proxy through another server to see what you are downloading. Or use some network sniffer tool to see what you are looking at from the web browser.
Ever come accross a combination of 2 tools that would grep others network traffic and dump it on to yet another PC's web browser. Advantage of this is: no rootkit/ spyware are required.
But there are other ways that this can be done. What we have mentioned is only very few. Unix tty dump is another way that i know (if you are using unix).
Or maybe the admin also using Kazaa and found your name there. Hehehehehe
I ever caught a few person redhanded as they useup too much of my network bandwidth. Because our firewall have feature of "top-10" talker and those happen to be Kazaa user. Just a bit of advice, dont
do that in school. As the internet is limited and shared.
Does your school practice summiting assignment via Internet? Imagine you are one of those that wants to summit your assignment as today is the due date. Just when you keep having problem complete transfering your assignment another person in campus is running Kazaa and bring the internet to crawl.
Interesting reasoning. If your machine cant access internet, who would you complain to?Quote:
i didnt think they could do that here becuase these are our personal computers this isnt high school, its college
What do you expect the administrator to do?
Next thing you can try: Bring a microwave oven and put it next to campus wireless network access point
and slowly roast a chicken. "Hey that is my microwave oven and what does cooking chicken have anything to do with your network outage?" well, i suppose that is alright to do that once you reach age of 900.
The way they used to track us at my old high school was to force us to proxy through an N2H2 server and log all the requests to sites that were not allowed. They also had Centurion cards so we couldn't get virii, etc on the computers.
I've since moved to a new high school with a much more lax security code. First, there are no Centurion cards, and second, all connections are direct(no proxy) with expception to the NAT running at the district center. They also dont have their Novell set up very well(version 3.51, can you say boot up knoppix and have a look at win386.swp after admin logged on). In 5 minutes I managed to get a shortcut to the Control Panel in my personal folder(they disabled it from the start menu), get a command promt, and a list of all student user names. I am not sure wether I want to notify the admin because they might kick me off for general purpose.
Maybe you should try a tracert to google or someplace to see how long you stay in their network and where you go in their network. Sorry if someone else already suggested this.