Stunnel and Airline Wi-Fi • Hacker News Board

Re: Stunnel and Airline Wi-Fi

#31

Post by Hitton » Sat, Jul 20, 2019, 2:09 PM UTC

PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

Not a lawyer, but you could argue that he wasn't really accessing the router, he was accessing his own server at home.

Re: Stunnel and Airline Wi-Fi

#32

Post by SahAssar » Sat, Jul 20, 2019, 2:10 PM UTC

ajross wrote: post #11

tl;dr: The Vianet firewall is trying to do filtering of TLS connections based on the arbitrary and client-controlled host name string and not the destination IP address. It has no network-level routing control at all, it will allow a connection to any host on the internet, but will then terminate it after it sees that it's not going to (strictly, "doesn't look like it's going to") a permitted host. So the author set…

It's not the host header, it's the SNI name. This is basically the same as domain fronting, just using another protocol within TLS.

Re: Stunnel and Airline Wi-Fi

#33

Post by myrandomcomment » Sat, Jul 20, 2019, 2:10 PM UTC

The comment about the 24Mbps is pretty impressive. My experience every month on the JAL flights SF to Tokyo and Tokyo to $SomeOtherAsianCity is pretty crappy. I wonder if doing this it also bypasses some QoS filters? For example on a flight I tried to open the XM app on my iPad and could not stream a thing (it's pretty low but rate). Slack connects and disconnects all time. Email works but is slow. Webpages take minutes to load. Every flight for the last few years so...

Re: Stunnel and Airline Wi-Fi

#34

Post by tomxor » Sat, Jul 20, 2019, 2:10 PM UTC

PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear.

That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.

Re: Stunnel and Airline Wi-Fi

#35

Post by AndrewBissell » Sat, Jul 20, 2019, 2:11 PM UTC

themark wrote: post #27

Sweet to see another guy that tests with zombo.com!

The infinite is possible!

Re: Stunnel and Airline Wi-Fi

#36

Post by ajross » Sat, Jul 20, 2019, 2:13 PM UTC

SahAssar wrote: post #32

ajross wrote: post #11

tl;dr: The Vianet firewall is trying to do filtering of TLS connections based on the arbitrary and client-controlled host name string and not the destination IP address. It has no network-level routing control at all, it will allow a connection to any host on the internet, but will then terminate it after it sees that it's not going to (strictly, "doesn't look like it's going to") a permitted host. So the author set…

It's not the host header, it's the SNI name. This is basically the same as domain fronting, just using another protocol within TLS.

Indeed, I was unclear. But the features are tied at the hip. SNI exists because TLS needs a way to discriminate separate certificates for the benefit of requests on the same port using distinct HTTP/1.1 Host headers. In my experience it's absolutely routine to talk about them using the same terminology.

Re: Stunnel and Airline Wi-Fi

#37

Post by Hitton » Sat, Jul 20, 2019, 2:13 PM UTC

Too bad he didn't try other protocols. I wouldn't be surprised if DNS or ICMP tunnel worked too.

Re: Stunnel and Airline Wi-Fi

#38

Post by Pneumaticat » Sat, Jul 20, 2019, 2:15 PM UTC

Hitton wrote: post #37

Too bad he didn't try other protocols. I wouldn't be surprised if DNS or ICMP tunnel worked too.

But iodine [1] is very slow ;) (Also with the satellite roundtrip, it probably would've worked, but super slowly.)

[1]: https://code.kryo.se/iodine/

Re: Stunnel and Airline Wi-Fi

#39

Post by evancox100 » Sat, Jul 20, 2019, 2:15 PM UTC

pritambaral wrote: post #29

ajross wrote: post #11

tl;dr: The Vianet firewall is trying to do filtering of TLS connections based on the arbitrary and client-controlled host name string and not the destination IP address. It has no network-level routing control at all, it will allow a connection to any host on the internet, but will then terminate it after it sees that it's not going to (strictly, "doesn't look like it's going to") a permitted host. So the author set…

How is this a crime (in _all_ jurisdictions)? The CFAA is US-only, and few other jurisdictions have as loose terms (or history of abuse) as the CFAA, when it comes to "hacking".

See the discussion on the CFAA act elsewhere.

At the very least it would be theft of services, although this is typically a state thing, so I'm not sure how jurisdiction would work up in the air.

Re: Stunnel and Airline Wi-Fi

#40

Post by byteCoder » Sat, Jul 20, 2019, 2:17 PM UTC

Illegal and unethical: yes, in this use case.

But, let's give Kevin serious kudos on his clever approach to solving this problem. This is the true hacker spirit that reaches across the decades. Bravo!