I told the flight attendant "the WiFi isn't working" • Hacker News Board

Re: I told the flight attendant "the WiFi isn't working"

#91

Post by mdorazio » Mon, Dec 25, 2023, 3:32 PM UTC

sandworm101 wrote: post #70

placatedmayhem wrote: post #47

Earlier quoted context omitted.

Every time I have to interact with a "captive portal", I'm annoyed at the hack implemented through DNS hijacking, rather than implementing and extending 802.1X and/or another layer-2 authentication scheme. The idea seems to have been tossed aside entirely. Instead, every device has to have a web browser. There's not even a way to do surrogate registration for devices that don't have browsers, with Apple TV and Ninten…

I have a work laptop (government) that hates captive portals. It has a security system that won't let it connect using the local DNS. So it doesn't get captured. Those of us with such laptops all have tricks for getting to a hotel's wifi login page using IP addresses. But we have to do it fast, before the security software fully wakes up and blocks the hack. We used to just login on our phones, then tether the work l…

Does the laptop also prevent wireless tethering to your phone? Turning your phone into a hotspot is pretty trivial, at least on iOS. I often have to do it due to similarly arcane security configuration settings on my work laptop.

Re: I told the flight attendant "the WiFi isn't working"

#92

Post by sandworm101 » Mon, Dec 25, 2023, 3:34 PM UTC

throw0101b wrote: post #88

sandworm101 wrote: post #70

Earlier quoted context omitted.

I have a work laptop (government) that hates captive portals. It has a security system that won't let it connect using the local DNS. So it doesn't get captured. Those of us with such laptops all have tricks for getting to a hotel's wifi login page using IP addresses. But we have to do it fast, before the security software fully wakes up and blocks the hack. We used to just login on our phones, then tether the work l…

> I have a work laptop (government) that hates captive portals. It has a security system that won't let it connect using the local DNS. Does the OS not pay attention to DHCP option 114: This document describes a DHCP option (and a Router Advertisement (RA) extension) to inform clients that they are behind some sort of captive-portal device and that they will need to authenticate to get Internet access. It is not a fu…

It is more layered than that. The work machine initiates a VPN automatically at login. Once that VPN is up, all traffic goes through the VPN, including DNS. It will actively ignore/block anything that isn't coming from the VPN. So we do tricks to get to the hotel splash page before the VPN software wakes up. These are corporately-managed windows machines. The boot/login process isn't exactly quick.

Re: I told the flight attendant "the WiFi isn't working"

#93

Post by spr-alex » Mon, Dec 25, 2023, 3:35 PM UTC

godzillabrennus wrote: post #66

nixgeek wrote: post #64

Earlier quoted context omitted.

Great project, a lot of APs themselves support VLAN segregation using RADIUS, has SPR ever considered the scenario where it might be ideal if it were just the router and it controls APs (and even switches) that way?

Client isolation at the access point level does this.

Yes, this is part of the story of how SPR achieves this.

So the hostapd configuration for SPR has the following components: - ap_isolate=1 - per_sta_vif=1 - unique passphrases for devices - firewall rules

ap_isolate stops the AP from doing L2 forwarding between clients using the pairwise keys. the per_sta_vif=1 will also ensure that each client has a unique GTK so they can't use group key encryption to communicate without the AP.

Next, unique passphrases are used. Without this, it's possible for a malicious device to decrypt WPA2 traffic passively or spin up a Rogue AP to capture traffic from peers.

And lastly -- firewall rules with default deny connect devices by policy.

That ap_isolate alone is not enough is kind of interesting, as it's possible to instead push packets to the router that will then forward to the client destination. Most off the shelf routers have forwarding on without a default deny policy, enabling this. The subtlety here is the attacker uses the router as the L2 destination instead of the other wireless client. At the very least attackers can send UDP packets to bypass the intended isolation. This bypass is especially powerful when changing mediums between Wireless and Wired as the Wired victim receiving packets will be responding back to the router, and on many consumer routers a full TCP connection will be possible then.

Re: I told the flight attendant "the WiFi isn't working"

#94

Post by spr-alex » Mon, Dec 25, 2023, 3:36 PM UTC

placatedmayhem wrote: post #47

woodruffw wrote: post #36

This is adjacent to the classic free WiFi hack on airplanes, which is to boot another client off of their DHCP lease by spoofing their MAC. It’s unfortunate that, below HTTPS and a light smattering of WiFi encryption, there’s essentially no authenticity controls on LAN management protocols.

Every time I have to interact with a "captive portal", I'm annoyed at the hack implemented through DNS hijacking, rather than implementing and extending 802.1X and/or another layer-2 authentication scheme. The idea seems to have been tossed aside entirely. Instead, every device has to have a web browser. There's not even a way to do surrogate registration for devices that don't have browsers, with Apple TV and Ninten…

neverssl.com

Re: I told the flight attendant "the WiFi isn't working"

#95

Post by sandworm101 » Mon, Dec 25, 2023, 3:36 PM UTC

mdorazio wrote: post #91

sandworm101 wrote: post #70

Earlier quoted context omitted.

I have a work laptop (government) that hates captive portals. It has a security system that won't let it connect using the local DNS. So it doesn't get captured. Those of us with such laptops all have tricks for getting to a hotel's wifi login page using IP addresses. But we have to do it fast, before the security software fully wakes up and blocks the hack. We used to just login on our phones, then tether the work l…

Does the laptop also prevent wireless tethering to your phone? Turning your phone into a hotspot is pretty trivial, at least on iOS. I often have to do it due to similarly arcane security configuration settings on my work laptop.

Yes, but unless you have a phone with two wifi connections then you will have to use your cellphone's data plan rather than the hotel wifi. When traveling, doing a teleconference or having your work laptop perform a windows update over your cellphone data connection isn't cheap. We used to just tether to our work phones, but they locked that down after seeing the international roaming bills.

Re: I told the flight attendant "the WiFi isn't working"

#96

Post by spr-alex » Mon, Dec 25, 2023, 3:37 PM UTC

amluto wrote: post #77

spr-alex wrote: post #53

Earlier quoted context omitted.

I work on SPR, http://github.com/spr-networks/super , we make it easy to use distinct WiFi 3/ WPA2 passwords to authenticate devices on the network for policy based access

Does this usefully support multiple APs with the same ESSID?

Yes, although it is part of our upsell and not in the core FOSS project. We need to update our documentation to be more clear as we have been getting this question more often.

Re: I told the flight attendant "the WiFi isn't working"

#97

Post by UrineSqueegee » Mon, Dec 25, 2023, 3:37 PM UTC

sys_64738 wrote: post #81

Hacking WiFi on a plane is a sure fire way to get yourself added to the no-fly list.

good thing he didn't do any then lol

Re: I told the flight attendant "the WiFi isn't working"

#98

Post by gugagore » Mon, Dec 25, 2023, 3:47 PM UTC

I had a Internet connectivity problem on a JetBlue flight recently that I couldn't figure out. I could see the captive portal, with a URL like "planSelectionPage". I would check the agreement and hit "Let's go", and some JavaScript would trigger and look like a new page was loading, but would just stay on the same page. It happened on both Firefox and Chrome. My phone connected without a problem.

I wasn't sure how to debug it.

Re: I told the flight attendant "the WiFi isn't working"

#99

Post by joezydeco » Mon, Dec 25, 2023, 3:57 PM UTC

flutas wrote: post #38

umvi wrote: post #24

Earlier quoted context omitted.

Would need to know which vendor. I used to work for a company that provided satellite Internet solutions for airplanes but might not be what OP used

In my mind, probably either Panasonic Avionics or Gogo. If this debugging is true... I'd guess Panasonic from experience working there. Things like an office scavenger hunt usually took priority over actual work.

Gogo was bought out by Intelsat, so that reduces the amount of possible sources.

Re: I told the flight attendant "the WiFi isn't working"

#100

Post by ricardobayes » Mon, Dec 25, 2023, 3:59 PM UTC

nulbyte wrote: post #59

midasuni wrote: post #49

Earlier quoted context omitted.

Almost certainly no. Unlike the assertion made, she didn’t need to escalate it.

Why didn't she need to escalate it? I can imagine the hospitality industry would not want the WiFi sporadically going down for their guests; that's not a very hospitable experience.

Companies should work out a way to incentivise low-level workers to escalate and chase up "difficult to tackle" issues. Ignoring problems rarely work long-term and it's companies best interest to know and solve issues.