Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stunnel and Airline Wi-Fi

potatofrom.space

Post reply on HN
Print view View original

41–50 of 239 posts

Re: Stunnel and Airline Wi-Fi

#41

Post by PaulAJ »

Hitton wrote: post #31
PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

Not a lawyer, but you could argue that he wasn't really accessing the router, he was accessing his own server at home.

He was accessing the router by sending packets through it. Authorisation to do this was only granted in return for payment, and he hadn't paid.

Re: Stunnel and Airline Wi-Fi

#42

Post by shawnz »

PaulAJ wrote: post #41
Hitton wrote: post #31

Earlier quoted context omitted.

Not a lawyer, but you could argue that he wasn't really accessing the router, he was accessing his own server at home.

He was accessing the router by sending packets through it. Authorisation to do this was only granted in return for payment, and he hadn't paid.

From your link:

> the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;

The information they were accessing didn't come from the computer. And this doesn't say anything about using a computer service in an unauthorized way, which is what it sounds like you're describing here

Re: Stunnel and Airline Wi-Fi

#43

Post by pritambaral »

ajross wrote: post #30
pritambaral wrote: post #29

Earlier quoted context omitted.

How is this a crime (in _all_ jurisdictions)? The CFAA is US-only, and few other jurisdictions have as loose terms (or history of abuse) as the CFAA, when it comes to "hacking".

It's straight up unauthorized access to a computer system. They tell you they don't allow it and you have to pay for it, the author clearly knew that, and evaded the protections. Cite me a legal environment where that is not a crime.

Which computer system does this access that the user was unauthorized to access? The user's home server?!

The made-for-DRM CFAA that might classify fooling a flimsy filter as "unauthorized access to a computer system" is very much US-specific. Over here on the other side of the world, I'm thankful I'm not subject to such legislation or judicial system, but to one which still has a sensible definition of "hacking".

Re: Stunnel and Airline Wi-Fi

#44

Post by kemitche »

tomxor wrote: post #34
PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear. That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.

It's not nuts when compared to non-tech laws.

It's illegal to come into my house and take my stuff even if I forget to lock my back door.

If we want to protect security professionals, we should write laws that do so.

Re: Stunnel and Airline Wi-Fi

#45

Post by sfkdjf9j3j »

mightybyte wrote: post #28
behrlich wrote: post #9

Earlier quoted context omitted.

This is almost definitely “hacking” under federal law.

IANAL and all that, but my perception is that "hacking" is usually about breaking into someone else's computer / breaching someone else's privacy / accessing data that isn't yours / etc. If that perception is accurate, then I think it's really a stretch to call this "hacking". You're just moving bits around on network infrastructure designed to move bits around. Maybe I'm just looking for a loophole because wishful t…

Read up on this: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

The CFAA is pretty broad, and definitely controversial because of it. Look up Aaron Swartz's tragic case.

Re: Stunnel and Airline Wi-Fi

#46

Post by kemitche »

myrandomcomment wrote: post #33

The comment about the 24Mbps is pretty impressive. My experience every month on the JAL flights SF to Tokyo and Tokyo to $SomeOtherAsianCity is pretty crappy. I wonder if doing this it also bypasses some QoS filters? For example on a flight I tried to open the XM app on my iPad and could not stream a thing (it's pretty low but rate). Slack connects and disconnects all time. Email works but is slow. Webpages take minu…

I bet that viasat.com "connections" are given priority and not throttled for bandwidth - or perhaps since he never registered with the system, it never applied a throttle, under the assumption that blocking access negated the need for a throttle.

Re: Stunnel and Airline Wi-Fi

#47

Post by ryanmarsh »

Hitton wrote: post #31
PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

Not a lawyer, but you could argue that he wasn't really accessing the router, he was accessing his own server at home.

IMHE Judges don't have much of an appreciation for clever circumvention of the law.

Re: Stunnel and Airline Wi-Fi

#48

Post by wdroz »

supahfly_remix wrote: post #12

Nice write up. I am curious how DNS works, and if that is an alternative protocol for tunneling in this situation.

The latest iodine version is quick and works almost everywhere. Should work fine in the OP scenario. I also use SSH -D, then I use proxychains and it work fine.

Re: Stunnel and Airline Wi-Fi

#50

Post by kristianc »

gravitas wrote: post #7
nawtacawp wrote: post #3

While interesting, I would have an uneasy feeling messing with the WIFI AP on an airplane. Perhaps there is a U.S. law this type of conduct would fall under specific to being on an airplane?

The author does not "mess with the WIFI AP on the plane", they exploit a weakness in the design (failure by viasat to maintain an checksum IP mapping to their domain for the captive service) to simply bypass a trivial TLS header check in order to tunnel their traffic.

This is hacking under federal law, as it should be. Likewise that if I break into your house by merely exploiting a weakness in the design of the lock, I am still committing a crime.
Post reply on HN