School Computers and Networks

## School Computers

Most of the computers provided by the school in the school are connected to a network.

The central hub is in the I.T. Preparation Room 2, near the I.T. Preparation Room 1 and room 314, on the third floor.

According to an ICT project in 2016 that interviewed an IT technician, they will not upgrade the computers to Windows 10 due to the instability and bugs, although a large portion of computers on the school network were upgraded to Windows 10 during the and around the time of the first school suspension due to the COVID-19 pandemic.

All student and teacher accounts are managed by Microsoft Active Directory Domain Services on a central server, where teacher accounts are granted administrator privileges, and student accounts are granted standard privileges.

Standard privileges meant that students are able to install programs that do not require elevated privileges, for example, Discord. After the upgrade from Windows 7 to Windows 10, Universal Windows Platform (UWP) applications can be installed via the Microsoft Store, such as the Windows Terminal. However, the features of Windows Terminal is severely limited because Windows Subsystem for Linux (WSL) cannot be enabled via Windows Features, therefore useful Linux commands and utilities cannot be used. Popular alternatives such as Git Bash cannot be used as well.

To prevent misuse, many features have been disabled, such as the physical drive of the computer not being listed in the File Explorer by default. Despite this, it can still be accessed by using Window's Run command dialogue box by typing in C:\. Many core Windows programs, such as Task Manager, Windows Services, Device Manager have been disabled. A supervisor password has also been set for the BIOS to prevent users from maliciously booting from a different operating system.

### Drives

Every student has their own personal drive which they can access by logging into their account on a school network-connected school computer. The name of the drive is the student's student number. Each class and year level also has their own shared drive. The actual physical location of the drives are most likely in the central hub mentioned above. As the drives can be remotely accessed on school network-connected school computers, storage and retrieval of files is convenient. Users can store, retrieve and share files in their drives which is most likely guaranteed to be a safe file storage place, unlike the school computers, whose memories may be wiped periodically due to cleaning-up operations or OS upgrades.

## School Wi-Fi

School Wi-Fi is available to students of Year 9 to Year 12. A form with basic guidelines and rules of using the devices is required to be signed by the student and the student's parent for the network to be accessible by the student. Each student can only register one device. The form is given at the start of every year.

The school purchases a 1GBps plan from HKBN. According to the ICT technician interview mentioned above, it has been estimated that 1246 GB of data passes around the network. The school network is based on two IP layers: the 'Staff' layer (10.30.10.0-10.30.14.255, 10.30.11.0-255) and the 'Others' layer (192.168.0.0-192.168.255.255)

There are several Wi-Fi access points around the school.

Each Wi-Fi Access Point broadcasts around 4-5 ESSIDs, for example, an AP in Classroom 9C broadcasts CKY-Staff, CKY-Stu\_Y09a and CKY-Janitors.

The majority of the access points have WPA2-TKIP Personal Security. SSIDs are also hidden, which means users must know both the SSID and the passwords of it. These APs uses whitelists, or MAC authentication, which requires you to have the correct MAC Address to connect to the network. After entering the APs' local network, authentication is required for further Internet access.

Networks available in the school and their purposes include:

* **Lib-WIN**: a network used for Library dual-boot Mac computers running Windows 7 Professional
* **Lib-MAC**: a network used for Library dual-boot Mac computers running MacOS
* **CKY1**: a network believed to be used for testing purposes on the fourth floor
* **CKY-E**: a network for an unknown purpose
* **CKY-STEM**: a network used by the STEM Room on the fifth floor
* **CKY-Stu\_Y09a**: a primary network used by Year 9 students, with APs scattered all over the school and particularly concentrated in Year 9 classrooms
* **CKY-Stu\_Y09b**: a secondary backup network, broadcasted in 9A, 9C, 9E classroom APs only (it is currently inaccessible)
* **CKY-Std\_Y10**: a network ready on the morning of 2020-10-08 and most likely replaced the older Year 10 networks
* **CKY-Stu\_Y10a**: a deprecated primary network used by Year 10 students – the signal strength of the Year 10 Wi-Fi network is significantly weaker on the fourth floor and the fifth floor
* **CKY-Stu\_Y10b**: a deprecated network to be deleted (initially accessible, later closed and only detected in classrooms 10C and 10D)
* **CKY-Stu\_Y11**: a rarely detected network
* **CKY-Stu\_Y12**: a network with APs scattered all over the school, including the language labs on the second floor
* **CKY-Mobilelab**: a network used for mobile laptops only – signal strength is weak when outside of the Library (-89dB)
* **CKY-PANEL**: a network for classroom smartboards, secured with WPA2.
* **CKY-Janitor**: a network used by janitors, signals are especially strong at the janitor's rooms on each floor
* **CKY-Chromebook**: a network used by Chromebooks – signal strength is moderately bad, issues always arise (the Library has an extremely strong signal (up to -45 dB in places))
* **CKY-Instrument**: a network presumably used by instrument teachers

Other access point(s) have no security (open network(s)), including:

* **CKY-Staff**: a network used by both primary and secondary staff, uses 802.11abg, ac and x on Channel 1 (2412MHz, with least interference)
* **CKY-Guest**

The following access points are broadcasted from newly installed routers that provide much higher speed that its previous generations, averaging at >30Mbps as opposed to <1Mbps. However, due to the limited amount of new routers installed, its range is limited. They are first spotted after the physical school resumption around 2021-01-25.

It has been believed that the new routers will eventually replace the older generations, such as fusing CKY-Stu\_Y09,10,11,12 all into CKY-Student, and migrating CKY-Staff to CKY-Staff-N.

* **CKY-Student:** Students can log in with the username being their student id (s20XXXXXXX) and password being their own password.

* **CKY-Staff-N:** 'N' suggests new, which signifies a possibility of it replacing the old 'CKY-Staff'. This means that students will have no easy way to bypass/gain access to the network with VPNs/proxies.

The WLAN network has high interference, where many SSIDs overlap on Channels 10–13. It is the main reason for many packet losses for students using the Wi-Fi.

The school network has very weak security. IP scanning can discover massive vulnerabilities, for example, the windows-based storage hard drives on 192.168.0.5. Printers connected to the LAN at the "staff" layer could be vulnerable. All servers are also connected to the same network.

However, it is believed that a separate surveillance camera network is set up, which can probably only be accessed by security and IT technicians.

Due to the constant down service on the WLAN network, many students tend to switch on their mobile phones and setup their own APs.

#### Network Login Webpage

The network login webpage is at "https://10.30.11.1/user/user\_login\_auth.jsp" and is powered by Ruckus Wireless. Students can login with their school computer username and password.

### Registration

Students can register one device. Students can only connect to the school Wi-Fi network after registering. Before (most like some time between and including 2019-2020), there was a form with regulations and rules listed (an example of a rule is that students cannot use VPNs or proxies) which the student had to agree to and possibly sign it and/or get their parents to sign it. Afterwards, there was a Google Forms form which students could fill in to register. Students had to provide information such as their device's brand, model and MAC address. Students had to login to their school Google account to respond to the form. Students could only respond to the form once. After this, students could go to the IT Technician Room on the third floor to setup their device. A IT technician has to input the device's MAC address into the Wi-Fi network administrator portal so the device can be connected to the network.

### Trivia

It has been famously known for the gateway of 192.168.255.254 and 192.168.255.255 to block gaming websites and other websites. Therefore, it has been a tradition for students at CKY to use proxies or VPNs, along with MAC address changers, to bypass filtering and avoid detection.

On 15/4/2019, the IT technicians team set up a trap for students. Since the username and password of a teacher were leaked (also known as 'dramatemp'), many students gained access to the internet without registering. However, people who logged on using 'dramatemp' accounts had their own accounts immediately banned, in which almost half of the students of Year 8 and 9 was affected at that time.

When asked about it, IT technicians stated that some ports are not open for use. For example, port 6667 cannot be used to connect to IRC servers, port 21 cannot be used for FTP, and port 22 cannot be used for SSH.

The "one device per student" policy can be bypassed by registering a device that can share/relay the internet connection. For example, the Windows 10 operating system has a feature where you can share your internet connection with other devices (see https://support.microsoft.com/en-us/windows/use-your-pc-as-a-mobile-hotspot-c89b0fad-72d5-41e8-f7ea-406ad9036b85).