Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stunnel and Airline Wi-Fi

potatofrom.space

Post reply on HN
Print view View original

51–60 of 239 posts

Re: Stunnel and Airline Wi-Fi

#51

Post by otterley »

tomxor wrote: post #34
PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear. That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.

Has it, though, in practice? The CFAA has been in effect for over 30 years. If this law actually had the chilling effect you claim it does, we would already have observed a significant security talent exodus from the U.S. My observation from having worked in Silicon Valley throughout the past 20 years suggests there's still plenty of talent to go around and plenty of lawful work being done.

Re: Stunnel and Airline Wi-Fi

#52

Post by judge2020 »

pessimizer wrote: post #23
gravitas wrote: post #14

Earlier quoted context omitted.

The person I'm replying to specifically said "mess with the WIFI AP" in order to present this as harmful or dangerous (FUD), it is not. It's a trivial header check bypass - whether or not that is "hacking" is a question for lawyers and a judge.

I was just bypassing a some trivial key check on the door. To say I was "messing with the door" is FUD, and whether I was breaking and entering is a question for lawyers and a judge.

The owner gave me a key to the lobby so I could pay to get an all-access key. As it turns out, I can just walk past the lobby and that key actually opens all doors in the building. Whether or not it's illegal to use it to access whatever I want is a question for lawyers and a judge.

Re: Stunnel and Airline Wi-Fi

#53

Post by DiabloD3 »

otterley wrote: post #51
tomxor wrote: post #34

Earlier quoted context omitted.

> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear. That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.

Has it, though, in practice? The CFAA has been in effect for over 30 years. If this law actually had the chilling effect you claim it does, we would already have observed a significant security talent exodus from the U.S. My observation from having worked in Silicon Valley throughout the past 20 years suggests there's still plenty of talent to go around and plenty of lawful work being done.

Wasn't killing Aaron Swartz enough?

Re: Stunnel and Airline Wi-Fi

#54

Post by cabaalis »

kemitche wrote: post #44
tomxor wrote: post #34

Earlier quoted context omitted.

> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear. That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.

It's not nuts when compared to non-tech laws. It's illegal to come into my house and take my stuff even if I forget to lock my back door. If we want to protect security professionals, we should write laws that do so.

> It's illegal to come into my house and take my stuff even if I forget to lock my back door.

For some reason, on HN when I've made this argument before, the resulting comments have been that the internet is somehow different, and that real-world analogies don't exist. Using equipment that you don't own in a way the owners don't intend is apparently well-accepted.

Re: Stunnel and Airline Wi-Fi

#55

Post by Dayshine »

kemitche wrote: post #44
tomxor wrote: post #34

Earlier quoted context omitted.

> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear. That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.

It's not nuts when compared to non-tech laws. It's illegal to come into my house and take my stuff even if I forget to lock my back door. If we want to protect security professionals, we should write laws that do so.

It's not illegal to use 500GB of fibre bandwidth in a month when you only pay for 250GB though (say due to a bug in their method of counting usage).

Re: Stunnel and Airline Wi-Fi

#56

Post by crankylinuxuser »

I did this as well using Orbot (Tor software for Android) and an OBFS4 proxy.

In Southwest (the airline), you connect to the wifi for watching the movie and where you are in air. But if you want internet, you pay.

I have some of my applications always Torified on my phone. I opened my 3d printer app to view its status, expecting a hard fail. And... it loaded!

Re: Stunnel and Airline Wi-Fi

#57

Post by [deleted] »

pessimizer wrote: post #13
nawtacawp wrote: post #3

While interesting, I would have an uneasy feeling messing with the WIFI AP on an airplane. Perhaps there is a U.S. law this type of conduct would fall under specific to being on an airplane?

My guess would be that getting caught doing this could get you federal terrorism charges. I don't even think it's a safe assumption that the network is isolated or properly insulated from pilot instrumentation.

[deleted]

Re: Stunnel and Airline Wi-Fi

#58

Post by Dayshine »

kristianc wrote: post #50
gravitas wrote: post #7

Earlier quoted context omitted.

The author does not "mess with the WIFI AP on the plane", they exploit a weakness in the design (failure by viasat to maintain an checksum IP mapping to their domain for the captive service) to simply bypass a trivial TLS header check in order to tunnel their traffic.

This is hacking under federal law, as it should be. Likewise that if I break into your house by merely exploiting a weakness in the design of the lock, I am still committing a crime.

If someone charges for tours of part of their house, has two prices of tour, and you change the colour of your badge to let you access the part you haven't paid for, is that a crime?

Re: Stunnel and Airline Wi-Fi

#59

Post by spydum »

NKosmatos wrote: post #8

Nice post and well written. I’ll have to try something similar with stunner for my office connection (heavily filtered and firewalled), to allow me to reach my raspberry back home.

not sure office == work place, but most workplaces have policies around intentionally bypassing network security/firewall rules. If your workplace has any kind of security operations/threat detection, you could find yourself explaining why exactly your host is reaching out over suspiciously encrypted channels?

Re: Stunnel and Airline Wi-Fi

#60

Post by Dayshine »

evancox100 wrote: post #39
pritambaral wrote: post #29

Earlier quoted context omitted.

How is this a crime (in _all_ jurisdictions)? The CFAA is US-only, and few other jurisdictions have as loose terms (or history of abuse) as the CFAA, when it comes to "hacking".

See the discussion on the CFAA act elsewhere. At the very least it would be theft of services, although this is typically a state thing, so I'm not sure how jurisdiction would work up in the air.

> theft of services

If you have a contract, is this really a crime in the US? That's a civil matter!

Post reply on HN