(and why it’s so hard to patch)
rainyware launcher is used to get around securly classroom, and other extension-based blocking and monitoring systems.
securly classroom and how it works
securly classroom works as a chrome extension on your chromebook, it has forced read and change permission any every website you visit.
these are all of it’s force-enabled permissions:
- Read and change all your data on all websites
- Detect your physical location
- Display notifications
- Know your email address
- Communicate with cooperating native applications
every 5 seconds, it will take a screenshot of what’s in the browser window, and send it to the teacher software. below is a diagram that makes it easy to understand:
what about:blank does
every browser has a page called about:blank, which is exactly that. if you put it into your browser, you’ll just get a blank white or black screen.
this page functions differently from normal pages. any extension that has permissions, even admin forced, have no permissions, including securly classroom.
so “has access to this site” turns into “wants access to this site”
here’s another diagram:
but what’s the point?
now we have a page that bypasses securly, but there’s nothing on it.
if only there was a way we could put stuff on it
the part where we put stuff on it
most modern browsers allow for content (HTML/CSS/JS) to be injected onto about:blank pages.
so how can we put a website on here? we could inject it’s index.html file, but that would only work for one page, and all the CSS and JS have to be inline. that won’t work.
what about iframes? those are for embedding content- so we tried it with lagoney’s oil, and it worked! lagoney’s oil that can’t be seen by securly, huzzah!
but what if we made the URL of the iframe be set by the user, instead of having a specific hardcoded page?
well that also worked! so i added some styling to make it look nice and the first rainyware launcher was born!
so the final setup ends up looking like this:
we did not discover this trick, we just made it easier to use since implementations are usually locked to a specific game website
the issue
sometimes websites don’t like being embedded, and so they error out. and logins on sites that DO work don’t work right, which is why starlight 1 was designed specifically to be used with rainyware launcher.
why it’s unlikely to be patched
rainyware launcher leverages a built-in browser security feature that stops extensions from accessing chrome:// URLs, chrome web store, and about:blank. that means it can’t be changed by even a user or system policy, and is very unlikely to be removed from chrome.
it is however possible to block local HTML files from opening, but accessing the HTML file from a web URL will still work fine (RWL 1 had a web version).
blocking about:blank won’t work either, you can’t block an internal browser page with a firewall and securly doesn’t work on it either.