Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A story about bypassing air Canada's in-flight network restrictions

ramsayleung.github.io

Post reply on HN
Print view View original

121–130 of 169 posts

Re: A story about bypassing air Canada's in-flight network restrictions

#121

Post by dylan604 »

jacquesm wrote: post #96
gosub100 wrote: post #84

Earlier quoted context omitted.

Relatively speaking, it wasn't that bad. It took a few weeks of getting trouble tickets with no root cause, and a bit of googling. But management wasn't okay with fixing the root cause, instead they just increased the timeout/retry window.

Wow. That's a classic. We were quite motivated because we were the ones that got the automated alerts. I still see them in my nightmares: "chopper is down". The machine was called chopper, I'll never forget, it's been close to 30 years. My buddy Jasper and me spent multiple nights trying to track it and when we finally found it we still couldn't believe that that was it. But a simple swap was proof.

Did someone yell for you to "Get to the choppa! Do it! Now!!"?? Please say that's not been wasted!

Re: A story about bypassing air Canada's in-flight network restrictions

#122

Post by t1234s »

Planes that use the Panasonic system allow access to the full *.paypal.com domain to allow the paywall to work. If there is a way to somehow proxy all your traffic though something under paypal.com you could get free wifi on certain flight. Or you can pass the time away reading all the paypal API documentation.

Re: A story about bypassing air Canada's in-flight network restrictions

#123

Post by noxvilleza »

MarsIronPI wrote: post #31

My question is: would proxying over SSH running on port 53 have worked? Seems simpler than using Xray.

If they had a ssh server on the remote machine they could have also done something like `ssh -g -ND 53 root@localhost` from the remote machine, which would have exposed a remote-accessible SOCKS proxy on port 53.

Re: A story about bypassing air Canada's in-flight network restrictions

#124

Post by gosub100 »

dylan604 wrote: post #121
jacquesm wrote: post #96

Earlier quoted context omitted.

Wow. That's a classic. We were quite motivated because we were the ones that got the automated alerts. I still see them in my nightmares: "chopper is down". The machine was called chopper, I'll never forget, it's been close to 30 years. My buddy Jasper and me spent multiple nights trying to track it and when we finally found it we still couldn't believe that that was it. But a simple swap was proof.

Did someone yell for you to "Get to the choppa! Do it! Now!!"?? Please say that's not been wasted!

whose chopper is this?

Re: A story about bypassing air Canada's in-flight network restrictions

#125

Post by yardstick »

EvanAnderson wrote: post #92
VladVladikoff wrote: post #11

Earlier quoted context omitted.

Yeah, ICMP tunnelling is also a common bypass method for captive networks, so simply blocking all ICMP seems logical.

Every time I've had to fight with path MTU discovery not working I've cursed the people who block all ICMP, though. If ICMP echo / echo-reply is the problem just block that. At the very least, allow destination unreachable / fragmentation needed thru (type 3, code 4).

I am sure someone will find a way to exfiltrate data using any ICMP type. How good are firewalls at validating the packets are legit?

Re: A story about bypassing air Canada's in-flight network restrictions

#126

Post by yardstick »

EvanAnderson wrote: post #85
_trampeltier wrote: post #81

Earlier quoted context omitted.

In my old company it was the oposite. Ping worked allways, even when you where blocked on to a specific VLAN.

I've worked in gigs that wanted that. They were all about segmentation, but wanted ICMP echo / response available throughout. Edit: I wonder if any "enterprise" firewalls do ICMP echo proxying. Having the firewall replace the payload would remove some of the tunneling capability (thought I assume you could still finagle a side channel by just timing the packets) but would also eliminate some of the utility (since bei…

It’s been years but I’ve likely used NAT to redirect ICMP pings so the local firewall responds rather than whatever boat they were trying to reach.

Systems change - a server that once used to respond to pings may no longer do so, but client software may not be updated to stop doing pings before connecting to the actual service on the server. In an ideal world the client code would be updated, in practice: hello firewall.

Re: A story about bypassing air Canada's in-flight network restrictions

#127

Post by cmehdy »

ceejayoz wrote: post #63
jacquesm wrote: post #55

Earlier quoted context omitted.

And that can be a lot more subtle than you might think. I've had a persistent very hard to debug false alarm triggered on pings sometimes not making it and most of the time they did. But very rarely that would happen three times in a row and that was the threshold for raising an alarm. We spent days on this. Finally, the root cause was tracked down to a BNC 'T' connector at the back of a media adapter that filtered o…

> It is one of the weirdest IT problems I've ever encountered and it makes me wonder how much of what we rely on is actually marginal. Vernor Vinge had a character who was a "Programmer-Archeologist" on a relativistic starship. Feels more and more prescient as time goes on.

I work at a company that invented an internal syntax to compile into C++ code, that still relies on c-shell and conventions taken when OS/2 was in use there, and with a web of Jenkins instances and homemade wrappers and DBs to build that stuff.

I can safely say that title exists already. And I value my current experience as a humbling example of what is to come as software becomes an older industry, and not just a world of startups and their freshest languages/frameworks/tools.

Re: A story about bypassing air Canada's in-flight network restrictions

#128

Post by DaSHacka »

nradov wrote: post #94
ballenf wrote: post #68

Earlier quoted context omitted.

If the user routed all traffic through a WeChat or other messaging service, they would just be using messaging.

Intent matters. In US legal jurisdictions that could potentially be prosecuted as a CFAA violation, although I'm not aware of any cases like that yet. https://www.justice.gov/jm/jm-9-48000-computer-fraud

The U.S. has one of the most overbearing laws in that regard, though. The OP happened on a flight leaving Canada.

Re: A story about bypassing air Canada's in-flight network restrictions

#130

Post by pumanoir »

mcpherrinm wrote: post #115
pumanoir wrote: post #113

Where can i learn to do this kind of things? Any book(s) that'd teach this kind of stuff?

I don't know specifically what skills you're interested in, but this is all pretty much networking fundamentals. I think I learned most of what I'd need to do this in 'TCP/IP Illustrated: Volume 1'. There's plenty of "network penetration testing" type books which might also be of interest, though I don't have a specific recommendation here. There's a wider set of books at https://github.com/jacobian/infosec-engineeri…

Excellent, thanks! Just took a look at "TCP/IP Illustrated: Volume 1" and was exactly what I was looking for. Any book along those lines that is compressed/water down (just to get started over a weekend)?
Post reply on HN