Would it be possible to spoof the host and get free internet, that's something I've always thought about when facing such limits.
Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
11–20 of 137 posts
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#12I wonder if anyone has stated a general law along the lines of "if you can send and receive a bit, you can send and receive anything." The only issues ended up being that 1) WhatsApp messages are limited to 1600 characters Concidentally, that's not much bigger than the MTU of standard Ethernet. I don't know how "transparent" the data channel is with respect to non-ASCII (and probably Unicode), but if you use one of t…
I don't think that is necessarily a law. There would be ways to actually restrict access in better ways... you would likely be right if you amended it to the ability to send a bit to an endpoint you control.
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#13Would it be possible to spoof the host and get free internet, that's something I've always thought about when facing such limits.
No, because they aren't basing it on the host header or something.
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#14I wonder if anyone has stated a general law along the lines of "if you can send and receive a bit, you can send and receive anything." The only issues ended up being that 1) WhatsApp messages are limited to 1600 characters Concidentally, that's not much bigger than the MTU of standard Ethernet. I don't know how "transparent" the data channel is with respect to non-ASCII (and probably Unicode), but if you use one of t…
I don't think that is necessarily a law. There would be ways to actually restrict access in better ways... you would likely be right if you amended it to the ability to send a bit to an endpoint you control.
After writing code for locking down tablets used by prison inmates, I definitely agree that it's not much of a law.
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#15Wait, is this filtering based on IP or DNS? How do they make sure their whitelist remains up to date? (I assume it's HTTPS, so those are basically the only two options...) If it's DNS based, there should be simpler workarounds, so I guess it's just IP based?
It is pretty simple... your filter just makes periodic DNS requests to the desired allowed host and updates it's IP restrictions to the returned address. You also need to run the DNS resolver to return that same cached IP to prevent having the upstream DNS server return a different address.
You also need to make sure the DNS server will only resolve the domains you want it to, because if you allow unfiltered dns requests to arbitrary domains, anyone can then tunnel their traffic over DNS, as another comment on this thread pointed out.
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#16Wait, is this filtering based on IP or DNS? How do they make sure their whitelist remains up to date? (I assume it's HTTPS, so those are basically the only two options...) If it's DNS based, there should be simpler workarounds, so I guess it's just IP based?
It is pretty simple... your filter just makes periodic DNS requests to the desired allowed host and updates it's IP restrictions to the returned address. You also need to run the DNS resolver to return that same cached IP to prevent having the upstream DNS server return a different address. You also need to make sure the DNS server will only resolve the domains you want it to, because if you allow unfiltered dns requ…
I don't understand, what's the domain of.. WhatsApp? Not to mention you are just as likely to hit some Round-Robin configuration.
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#17Wait, is this filtering based on IP or DNS? How do they make sure their whitelist remains up to date? (I assume it's HTTPS, so those are basically the only two options...) If it's DNS based, there should be simpler workarounds, so I guess it's just IP based?
It could also be TLS-SNI/HTTP-HOST based.
While this doesn't directly address Delta's captive portal implementation, on many TP-Link Omada wireless APs, there is a feature that allows you to create a captive portal, and when doing this, you can either whitelist a website by its hostname or by its IP address. I was curious as to how it was filtering by hostname, so I ran a few DNS queries, which all resolved normally, indicating that it wasn't a DNS-based whitelist. Seeing as the whitelisting also worked over HTTPS, I assumed it was TLS-SNI. It turns out that anyone can whitelist any IP address by visiting any website while sending the SNI of a whitelisted hostname. This caused the AP's software to create a firewall rule allowing access to the IP address associated with the spoofed SNI. After doing this, it was then possible to connect to any website hosted on that IP address with any SNI hostname.
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#18Many years ago (2012) Delta inflight wifi would allow DNS queries out without paying. Being a very frequent flyer I used to run an ip-over-dns tunnel using Iodine[1]. It was slow but worked. I wonder if they’ve blocked that hole yet. [1] https://code.kryo.se/iodine/
[deleted]
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#19My experience with in-flight message-only WiFi is that they're just really slow and the ping times are long. Some services are actively blocked, e.g. Skype wouldn't work at all even for text messages, but browsing the internet is usually allowed. My VPN wouldn't work, but I suspect it might have if I used an obfuscated connection instead of OpenVPN or whatever the default is (e.g. over SSL). I could load GMail in the browser and Wikipedia probably would have worked. It's strongly website dependent. Hacker News is extraordinarily resilient to lousy connections and generally the index would always load without any trouble. It works even on a 3 second ping over satellite internet. Very few websites are that tolerant.
The flight crew (BA) knew what's up. They specifically warned us to check which package we were getting, because evidently they get a lot of complaints when people buy the message-only bundle and are surprised that nothing works.
Singapore gave out free passes for single devices last time I flew with them. It was possible to rotate MAC addresses by forgetting the connection and then re-joining. The connection was quite good, you could watch YouTube in potato resolution. It's quite fun to chat to people and send them photos out of the window.
Re: Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions
#20I wonder if anyone has stated a general law along the lines of "if you can send and receive a bit, you can send and receive anything." The only issues ended up being that 1) WhatsApp messages are limited to 1600 characters Concidentally, that's not much bigger than the MTU of standard Ethernet. I don't know how "transparent" the data channel is with respect to non-ASCII (and probably Unicode), but if you use one of t…
You can simply split packets into multiple messages and tag them with a unique code and use base64 (or something more efficient), that's how you can do things like do IP over IRC which has even more restricted character counts.
The problem is always going to be bandwidth as doing any kind of communication across systems optimized for human text will throttle you: you'll trigger spam warnings, rate limits, etc - and the modern web is extremely demanding