Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get Gogo in-flight wireless internet for free

outkastz.com

Post reply on HN
Print view View original

31–40 of 49 posts

Re: How to get Gogo in-flight wireless internet for free

#31

Post by gonzo »

bangbang wrote: post #25

The researcher rubs me the wrong way for a few reasons: 1. 15 days for a major company not nearly enough to remedy this issue. 2. The activity log reads like a ransom timeline. This isn't some l33t hacker exploit it's simple session hijack and mac spoof. You're not owed anything for finding this. Anyone that tries this could tread carefully. If you get caught (chances are slim), it wouldn't be hard to convince a jury…

major company? Their market cap is $1.34B, and their EPS is -19.44

not saying what the OP did is ethical, but .. wow.

Re: How to get Gogo in-flight wireless internet for free

#32

Post by gonzo »

oasisbob wrote: post #27
jws wrote: post #5

This looks like it dups a paying customer's IP and MAC addresses. Does that work if both devices are running at the same time? I was under the impression TCP didn't like that.

TCP doesn't care. IP and Ethernet care a lot. Layer2 attacks like this aren't clever, and can be very difficult to prevent because of the nature of communication at that layer. In a corporate/campus/hardline environment, there are plenty of reasonable mitigation strategies. (802.1x &c). For a shared hotspot, this type of behavior is just anti-social.

the "right thing" for hotspots is anonymous 802.1x. That is, any credentials work.

Re: How to get Gogo in-flight wireless internet for free

#33

Post by goostavos »

forgottenpass wrote: post #14
swalsh wrote: post #4

Earlier quoted context omitted.

YOU HAVE INTERNET ON A PLANE IN THE AIR TRAVELLING HUNDREDS OF MILES PER HOUR! What more do you want?

What more do you want? People to stop treating recent progress like the rediscovery of fire. Or that future incremental progress is anything other than an inevitability. Its like telling someone 100 years ago that the very notion of airtravel at all is unreasonable because YOU HAVE THE GERM THEORY OF DISEASE!

Amen!

I tell you, that Louis CK bit was the worst thing to happen to modern technology discussion..

Re: How to get Gogo in-flight wireless internet for free

#34

Post by cac04 »

sambeau wrote: post #21
dale386 wrote: post #15

Earlier quoted context omitted.

This will be exploited by people without a moral compass. What are you trying to get at? The author isn't suggesting this as a life hack for free internet, he's just showing that it can be done.

"The author isn't suggesting this as a life hack for free internet" The HN Title is (I can't see the actual article as the machine is hosed) : "How to get Gogo in-flight wireless internet for free" and the URL is gogo-in-flight-wireless-internet-free Both of which, I would suggest, propose an article about "How to get internet for free", specifically "How to get Gogo in-flight wireless internet for free". Or am I mis…

> Or am I missing something?

Yes, you're missing something. The article is a disclosure of a security vulnerability that has already been reported to the company responsible, including notice that it would be published and a request for confirmation that it has been fixed. (Edit: but your response is reasonable - I can see how the article title is misleading.)

Re: How to get Gogo in-flight wireless internet for free

#35

Post by gonzo »

justinsb wrote: post #26

How can MAC spoofing be stopped? All the counter-measures I can think of seriously degrade the experience. I can think of approaches that work for HTTP, for example, but I can't see how you would allow e.g. SSH while preventing MAC spoofing.

> How can MAC spoofing be stopped?

802.1x

Re: How to get Gogo in-flight wireless internet for free

#36

Post by NoodleIncident »

jrnkntl wrote: post #24
NoodleIncident wrote: post #19

Earlier quoted context omitted.

I haven't gotten TFA to load yet. Is this the same thing? What exactly does this do?

arp: http://www.freebsd.org/cgi/man.cgi?query=arp&sektion=8 arp -a gives you a list of other connected devices on the network with their IP and mac address. For a paid-for hotspot this usually means devices that have paid for access and are active. the ifconfig command changes your mac address into one of the chosen above; the AP thinks you're one of the earlier connected devices and gives you access to the internet.

Thanks for the explanation.

The network I'm on has a bunch of people connected, but `arp -a` only prints one line. Is this the access point isolation the article refers to?

Also, why do they bother replaying the session, if changing the mac address is all that it takes?

Re: How to get Gogo in-flight wireless internet for free

#37

Post by pyre »

rohansingh wrote: post #29
sigil wrote: post #20

Has anyone else noticed that Gogo shows higher prices to mobile phones? That seriously pisses me off. The fact that none of my mobile browsers can change the user agent string pisses me off even more.

In fact I've always had the opposite experience — that the smartphone-only plan costs less.

Maybe it presents a higher cost to iPhone/iPad users?

Re: How to get Gogo in-flight wireless internet for free

#38

Post by mdp »

bangbang wrote: post #25

The researcher rubs me the wrong way for a few reasons: 1. 15 days for a major company not nearly enough to remedy this issue. 2. The activity log reads like a ransom timeline. This isn't some l33t hacker exploit it's simple session hijack and mac spoof. You're not owed anything for finding this. Anyone that tries this could tread carefully. If you get caught (chances are slim), it wouldn't be hard to convince a jury…

Yep, yet another Gogo "exploit" disclosure. This one is actually quite pathetic.

Here's my security disclosure for the day:

You can walk out of most stores without paying for their merchandise if you hide it in your pocket.

Which vendor do I talk to about getting paid for this information?

Re: How to get Gogo in-flight wireless internet for free

#39

Post by kefka »

justinsb wrote: post #26

How can MAC spoofing be stopped? All the counter-measures I can think of seriously degrade the experience. I can think of approaches that work for HTTP, for example, but I can't see how you would allow e.g. SSH while preventing MAC spoofing.

Not pretty, at least. I'd look towards the TCP fingerprinting techniques that FreeBSD has in its packet filter/firewall.

With that, you could make a rudimentary decision how many machines are on the network, regardless if some are bad actors.

However, we will still get this problem regardless how much security we do over wifi, as wireless is inherently an insecure protocol. Ideally, we could make decent security with IPSEC, but that would be so cumbersome, as well as in opposition to "Pay us money for easy access to internet." A few non-payers aren't that big of a deal, considering the profit margins I would assume that make.

Post reply on HN