121–130 of 239 posts
An alternative to this is to scan for active Mac addresses on the WiFi and steal one and hope it’s someone paying for the premium WiFi already :) This works on almost all hotel WiFi too.
In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…
Wow, this was an amusing read. I actually helped architect part of the system that was bypassed at LiveTV (now Thales). We had some serious hackers on the team and discussed how much probing & prodding it would take to find vulnerabilities like this, but made the conclusion anyone doing this should be worried about more serious consequences. I for one, wouldn’t attempt this myself on the aircraft. The hacker side of…
This system was built with certain specifications and down to a certain price.
Earlier quoted context omitted.
How does this not apply to stuff like trackers bypassing anti-fingerprinting browser protections?
His attack is active, privacy plugins are passive, even if they report back false fingerprints. Offense versus defense.
I did this as well using Orbot (Tor software for Android) and an OBFS4 proxy. In Southwest (the airline), you connect to the wifi for watching the movie and where you are in air. But if you want internet, you pay. I have some of my applications always Torified on my phone. I opened my 3d printer app to view its status, expecting a hard fail. And... it loaded!
Genuine question here - isn't Tor traffic reputed for having a certain "footprint"? I would be worried about accessing the Tor network over public WiFi, but maybe that's just me.
But when you start using pluggable transports, like Obfs4, you can defeat pretty much every captive portal or traffic analyzer. I'm sure there might be a way to detect even these. But remember that the real test of detection is the GFoC.
Some piddly airline's offering of pay internet is not going to use nation-state level detection schemes.
If your flight has GoGo, it’s easier to just remember which of your friends has a T-Mobile number, plug that in, and you’re in. They don’t actually verify it’s your number.
Also recently I think they’ve stopped giving T-Mobile numbers access to the higher speeds. Was fun while it lasted. I was able to clock over 50mbps on one of my flights. Kinda nuts.
Earlier quoted context omitted.
His attack is active, privacy plugins are passive, even if they report back false fingerprints. Offense versus defense.
Not sure if the attack is active. He’s not actively talking to the filtering equipment to try and mess up its configuration or disable it. He’s just sending out packets hoping to reach the internet (a perfectly valid thing to do considering the system is designed to let you access the internet). It just so happens that certain packets manage to slip through the poorly designed filter.
Earlier quoted context omitted.
Not sure if the attack is active. He’s not actively talking to the filtering equipment to try and mess up its configuration or disable it. He’s just sending out packets hoping to reach the internet (a perfectly valid thing to do considering the system is designed to let you access the internet). It just so happens that certain packets manage to slip through the poorly designed filter.
How is this different from trying a door handle to see if it's open.
Not saying this is ethical (although selling WiFi for 12$ per hour isn’t either) but I wouldn’t go as far as calling this an attack.
Wow, this was an amusing read. I actually helped architect part of the system that was bypassed at LiveTV (now Thales). We had some serious hackers on the team and discussed how much probing & prodding it would take to find vulnerabilities like this, but made the conclusion anyone doing this should be worried about more serious consequences. I for one, wouldn’t attempt this myself on the aircraft. The hacker side of…
https://lifehacker.com/get-free-unlimited-wi-fi-on-flights-a...
Earlier quoted context omitted.
How does this not apply to stuff like trackers bypassing anti-fingerprinting browser protections?
Because a prosecutor hasn't tried to use it in that way.
So practically yes, let's be aware that the author could indeed be persecuted under the CFAA. But let's not grandstand and pretend that following that law is some sort of moral imperative that benefits everyone. The common individual will be the target of the same attacks with or without that law.