15 ms·
When my son was younger - maybe 9 or 10 or so, we were on a plane and he was using his phone and I looked over his shoulder and realized he was on the internet.
by commandlinefan 3y ago
When my son was younger - maybe 9 or 10 or so, we were on a plane and he was using his phone and I looked over his shoulder and realized he was on the internet... but I hadn't paid for an internet plan. I said, "son, how are you using the internet?" He said, "oh, a kid at school showed me - if you go here" (he opened up the wifi settings where the DHCP assigned IP address is) "and start changing the numbers, eventually the internet will work." Apparently, at the time, on American Airlines, when somebody bought and paid for an internet plan, it gave them an IP address and authorized it to use the internet... if somebody else guessed your IP address (which was pretty easy, it was a 192.168 address) and spoofed it, they could take over your internet connection with no further authorization.
I had to tell him not to do that, but I was kind of proud of him for having the temerity to go for it.
- wferrell 3y agoThis is an amazing story. Thanks for posting.
- KMnO4 3y agoI used to do the same thing at hotels. Still often works. nmap -sn 192.168.0.1-255 To find everyone on the network, then start spoofing each of their MACs until you find one that works
- savrajsingh 3y agoI should probably know the answer, but what happens when two devices have the same MAC address?
- queuebert 3y agoOnly one way to find out.
- commandlinefan 3y agoNo way to tell for sure, but I can only assume that he had actually hijacked somebody else's connection and the other person's device stopped working for them. I sure wasn't going to stand up and ask the plane if anybody had had their internet plan hacked...
- _joel 3y agoBuy a plan then clone the mac of that device, white hat it. Might have killed a bit of time (unless you needed sleep) :)
- eru 3y agoThat's fun, but why not just buy a plan for one device, and then start a wifi hotspot on that device to share the connection?
- ahoka 3y agoThat’s not how it works, but probably made someones browsing experience worse.
- Cpoll 3y agoI should probably know this too, but I'll speculate wildly instead. MAC is Layer 2, IP address is Layer 3. One way or another, the packet destined for the person you're spoofing will end up at your computer and work its way through the layers. From there, if it's a TCP/IP packet, I think it'll get filtered out at Layer 4 (transport) because your computer wasn't one of the parties that initiated the TCP connection (the sequence numbers won't line up, etc). Packets being broadcast to multiple machines is common enough in various network setups, it's up to the individual machine to decide whether to process or drop the packet.
- _joel 3y agoARP entered the chat
- rolph 3y agothis seems to be a decent answer written up ready to go. https://serverfault.com/questions/462178/duplicate-mac-address-on-the-same-lan-possible https://serverfault.com/questions/462178/duplicate-mac-addre... what happens depends on your LAN setup, but generally its a fail.
- AdamJacobMuller 3y ago"it depends, nothing good" Network devices forward (switch, more technically) packets to and end device based on an internal MAC table (send packets for DE:AD:BE:EF to interface ge-0/0/0.0) and most devices populate their MAC table simply by looking at input packets and sending the "next" packet for that MAC address out the "last" received interface. If two devices in a network have the same MAC address, they will effectively "fight" for control of the packet flow. You can win that fight by sending a lot of packets. In practice, the other person is going to get annoyed and give up. There are lots of technology which avoid this issue now, but the two primary ones are 802.1x (used in corporate/government environments) and DHCP snooping which can be much more broadly deployed. 802.1x is very complicated and I won't go into it, but, DHCP snooping works by limiting L2 forwarding (MAC table population) to only what the DHCP server says the end device should have and it does this just by inspecting the DHCP replies (no custom protocol) with some vendor specific extensions on the DHCP server side for complex scenarios (you can even do things like put ports in a specific VLAN based on the DHCP reply). This works fine on a physical layer and most hotels are probably using something similar now (less for malicious abusive reasons, though that's a thing) but also just to work around poorly behaving devices and to reduce customer complaints. If you care (and have a modest amount of money) MAC and IP spoofing are dead on the physical layer. For the wifi layer, very similar stuff exists in high-end gear (Rukus/Cisco) and is starting to trickle down to prosumer level gear like unifi. If you care (and have serious cash for Rukus) MAC and IP spoofing are also dead on the wifi layer.
- EvanAnderson 3y ago> "it depends, nothing good" Fun anecdote from the early 2000's re: duplicate MACs: Embedded IP time clock kept intermittently barfing out frames with the source MAC addresses of other devices on the network. The switch would update its MAC table and direct packets to this device. The Customer's AS/400 would kill all remote terminal sessions when the clock ended up w/ the AS/400's MAC. (They were doing a layer 2-based connection to the AS/400-- APPN, I believe it was called... Ugh, it was temperamental and didn't like any layer 2 "hiccups".) MAC addresses flapping between ports is one of those "breaking the laws of physics" kind of problems that teaches you to question your assumptions. Gear with a crazy brain can do anything it wants to and it doesn't care about your assumptions.
- spmurrayzzz 3y agoIt more or less turns into an ARP cache race, only one device is gonna win. You can do some tricks with gratuitous ARPs as well for "dumber" networks, but more sophisticated setups usually have some broadcast ARP filters that are tied to an auth layer (radius, 802.1x. etc) and will drop broadcast frames from un-authed hosts.
- angry_octet 3y agoThat greatly depends on whether the medium is broadcast (like a radio) or broadcast-like (a shared copper wire) and if it has CSMA/CD logic. Many of the replies are losing that detail and thinking of how it would effect a 1000base-T network, which maps MAC addresses to specific ports. For a broadcast network, the answer could be 'nothing' in the sense that both receivers would get the same traffic. The IP stack would then throw away packets destined for the other computer unless they were UDP broadcast or multicast, and even then it would only notice if someone was running Wireshark. Advanced wifi devices/meshes will use beam forming and mesh allocation and might degrade if there were MAC duplicates, but I think they will generally operate in a non-exclusive basis due to end point movement and fading, so both computers will get a good data rate. In summary: it's fine.
- colanderman 3y agoCan't this often result in the two machines RSTing each others' TCP connections, depending on firewall settings?
- angry_octet 3y agoGreat question. It could, but there is a strong chance that the true recipient has already partially or fully ACKd the segment, thereby changing the sequence number and preventing a reset.
- sznio 3y agoSince Wi-Fi is a broadcast medium, shouldn't it not matter? With a switch it would break things because MAC tables, but a Wi-Fi AP is a hub. Each device will receive packets for both devices, sure, but will that break things? I know Windows gets upset when that happens but the network seems to still work.
- time4tea 3y agoISTR SunOS4 panic if it saw duplicate IP address on the network. sync boot
- lupire 3y agoDoes that work if both of you are trying to send/receive packets at the same time?
- fragmede 3y agoYeah, the client OS will reject the "bad" packets destined for the other device as unknown.
- system2 3y agoWiFi signal is received by both. Packages are ignored if they are not requested by either one of the systems. You can also receive anyone else's packages while you are using your internet but ignoring the ones you don't need. (If interested try aircrack-ng.)
- ahoka 3y agoOnly if it’s unencrypted, of course. Rarely the case nowadays.
- ruune 3y agoIf it's important but you got time, you could always save the packets and crack them when quantum computing comes out for consumers. You have to wait a couple of decades probably, but maybe it's worth it
- pests 3y agoNSA is already taking care of that in Utah.
- angry_octet 3y agoYour computer will still receive the packets from the radio layer, it just won't have the right key to decode the other recipient's traffic.
- 3y ago
- louison11 3y agoThis is what I did about 7-8 years ago on flights when I was still a reckless teenager. Would just wait for people to buy the plan, then spoof their Mac address. There was also a specific airline, although I can't remember which one, which let me in for free without MAC spoofing - by using a Google Cloud VPN I had previously set up. The paywall was essentially blocking all IP ranges except for Google servers for Google Analytics.
- ApolloFortyNine 3y agoSimilar is probably possible on cruise ships, I noticed on Carnival you could still get notifications from discord (I assume because most android notifications go through cloud messaging and it's required for their own app to work without internet).
- Scoundreller 3y agoTook an airline that required an app to pay to connect… but also opened up a window of a few minutes of open access to let you download said app from the iStore. I always wondered if there was a way to further exploit that.
- withinboredom 3y agoIIRC (assuming it was the same airline), it didn't close existing connections once the time ran out, so you'd just ssh to a server and proxy through that. When/if the connection dropped, you'd just change your mac address and start over.
- pantalaimon 3y agoI’ve never been at a hotel that charged for WiFi - is that a US thing?
- Spooky23 3y agoConference hotels often soak the companies with booths for internet access. One place I did for my company demanded $1500 for 3 days of internet access for up to 5 devices. In-room, you get free internet access, but in the windowless ballroom with spotty cell-service, there's nothing available for free.
- rootbear 3y agoI’ve also seen the opposite, where in-room Wi-Fi was charged, but in the hotel’s function spaces, it was free. The economics of this are confusing, at best. I have also had the situation where the in-room wi-fi was so slow that using my phone as a hot spot was faster!
- Spooky23 3y agoSometimes that because the operator got hosed in a contract with a network provider. I used to see that a lot in full service hotels.
- reichstein 3y agoIf they give you free internet in your room, you won't pay for their pay-TV. Especially the kind you won't be watching in public areas. "Follow the money"
- louison11 3y agoYes. You often also have to pay for parking in many places. The price you see online is rarely what you pay for. But that's part of the culture, it's the same for restaurants, online purchases etc.
- lukas099 3y ago
- SileNce5k 3y agoThis is what I used to do at home when my dad would turn off my internet access (by whitelisting MAC-addresses. Before that he blacklisted MAC-addresses, but I just used the built in way to change it with each connection on windows until he found out.). My mom rarely used her PC so I would just change my address to hers. It worked until she had to use it and at that point none of us could access the internet.
- politelemon 3y agoHow would you get the MAC address from the IP address?
- logeist 3y agoWhat does your son do now, if you don't mind me asking? That's the kind of stuff I was poking around with then add a year or two.
- commandlinefan 3y agoHa, he's a CS major at UT.
- kxrm 3y agoA few years ago I was on a Southwest flight and had OpenVPN running because I forgot to turn it off. I was able to access the Internet through my tunnel without paying for access. I guess at the time they were only port blocking common ports (80, 443, 53 etc) if you didn't pay. They have since closed that hole.
- Kikawala 3y agoIt also worked on Alaska Airlines and American Airlines.
- chankstein38 3y agoFor this same reason you used to be able to send messages via platforms like whatsapp without internet as well! I don't remember the airline I just remember I hadn't paid for internet but I could message and do a few other things but I couldn't browse the internet.
- thedanbob 3y agoThat was probably deliberate. I flew United recently and they advertised free wifi for certain messaging apps, or you could pay to access more apps or the general internet.
- MostlyStable 3y agoI also flew united recently and, in addition to the free messaging access, they also provided free access to the inflight entertainment, in case you wanted to watch it on your device instead of on the screen. I would have loved to take advantage of this since my wireless earbuds were significantly better than the wired pair I had. Unfortunately, a little pop-up warned me that this was not available on Android 13 devices. I was more than a little annoyed, but also curious as to why this might have been the case.
- xattt 3y agoThere was a report in the early to mid-2000s where someone got iChat AV to work, partly because it was fairly obscure and likely the network engineers didn’t consider blocking it.
- pak9rabid 3y agolol, I used to do this all the time at non-free wifi hotspot locations, only I'd start off with a ping sweep of the entire subnet (nmap -sP) in order to get my ARP cache filled with a bunch of potential usable IP/mac addresses on the network. From there, I'd iterate through each one and set the IP & mac address until I found one that would let me through the firewall. Granted, being a NOC engineer at Wayport (now AT&T WiFi) certainly helped me understand how it all works.
- reb 3y agoI typically just praise with upvotes, but I’m feeling grateful today: anecdotes like this one and gp are why I love hn
- aeternum 3y agoYes the key to doing this more seamlessly is to spoof both the IP and the MAC so your machines are not constantly fighting with the other person over the ARP table entry.
- colanderman 3y agoAren't you then fighting the switch's port learning? Or RSTing each other's TCP connections?
- withinboredom 3y agoIts wifi. You both just pick up the same frame when it is broadcast, then it sees two stations (a level below IP) with the same MAC. Most routers just don't care about that. (it's technically a valid edge case that two stations have the same mac address. It should be vanishingly rare in the wild ... but this is a practical example of why it isn't).
- richardwhiuk 3y agoIf there's multiple hotspots behind the same controller, you may well get switch port fighting.
- lxgr 3y agoThat's an amazing anecdote! The state of "open Wi-Fi" security is actually really sad. I'm not aware of an easy way for the airline to actually do better than this! I suppose they could use Opportunistic Wireless Encryption [1] and bind session authentication to that (i.e. authenticate a given OWE session, not a given MAC address) if the device supports it, as at least modern Apple devices do? But I have no idea how stable an OWE session is; it would be very inconvenient to have to login again every time my device switches between access points. In any case, I'm sad that this isn't a solved problem yet, and paid Wi-Fi (as well as securing free Wi-Fi) still requires custom and clunky solutions like unreliable captive portals that need to pass through selective traffic (e.g. for 3DS, for payments, sometimes emails for password reset codes etc and more). A standardized endpoint and API would also be nice, i.e. something to tell the client whether it's connected, restricted (i.e. able to only access a limited set of hosts such as the in-flight map as described in the article), or needs to pay/authenticate (and if so, at which URL). This could then yield an authentication token, to be provided for seamless reconnections for the same session. There's "Hotspot 2.0" and WPA-EAP (i.e. WPA Enterprise), but these don't really have a good story for "pay via web portal" style usages and are more geared towards wireless carrier operated hotspot networks and corporate scenarios, respectively. [1] https://en.wikipedia.org/wiki/Opportunistic_Wireless_Encryption https://en.wikipedia.org/wiki/Opportunistic_Wireless_Encrypt...
- Nextgrid 3y agoIn cases where the Wi-Fi is provided as a value-add or is bought via another channel than the Wi-Fi network itself, I think you can just generate one-time WPA Enterprise credentials, with a QR code to facilitate data entry? In case of in-flight Wi-Fi, the credentials/QR code can be printed on the boarding pass, or available in the app (the app caches it in advance while it's still on the ground, so when in the air you can use those credentials to connect). This doesn't cover 100% of use-cases but it would at least cover a big one (a significant amount of public Wi-Fi is "value add" to another service - whether restaurants, hotels, flights, etc where there's an existing channel to provide one-off wi-Fi credentials over), it's a shame nobody deploys this.
- labcomputer 3y ago
- josh_carterPDX 3y agoThere used to be an app that would scan the ip and mac addresses on the network that were already connected to the internet. You could then change your settings to one of the mac addresses and when they were done you'd get the connection to yourself. I used to travel a lot for work and just refused to pay for WiFi. This was good in airports and coffeeshops when you still had to pay to connect. Now it's hardly needed, but I could see how it would be helpful where there's still a cost to connect.
- cromka 3y agoIt’s not an app, per se, but a concept of setting your WiFi card into monitor mode and listening to the radio traffic. Kismet is one of the suites that does that.
- josh_carterPDX 3y agoTrue. I just can't recall the name of the platform I used, but it was something similar to an ip address scanner which gave me a list of all devices already connected to the network along with their mac addresses.
- cromka 3y agoIf not Kismet then maybe airmon-ng from aircrack-ng suite
- lukas099 3y agoExpect cops on your doorstep for CFAA violations by the morrow.
- lukas099 3y agoIt was a joke.
- smfjaw 3y agoLove stuff like this, it's how kids get into computers. I used to make minecraft servers for my friends and I to play on when I was 12, which lead to a software engineering career. Sounds like you've got something similar on your hands
- hot_gril 3y agoMinecraft servers and scanning IP addresses also mix in mischievous ways, especially servers with no whitelist...
- afterburner 3y ago> for having the temerity to go for it Well, if he doesn't know there's anything wrong with it, it's not really temerity.
- hunter2_ 3y agoI think kids sense wrongness even when the act is deemed victimless, repercussionless, etc. -- it's pretty clear that a thing was achieved that someone tried to prevent, and undermining someone's effort is typically wrong. Tough to think like a kid, though!
- sprokolopolis 3y agoI used to do this on airplanes and in hotels. I had more success in hotels, because there was less chance the other person was using it at the time and less chance of getting kicked off. There was another little hack that I used as a little kid. Remember when airlines would sell or rent special headphones to watch inflight movies? The port was just two holes beside each other and the plug was two tubes. Before a flight, I would stop by one of the fast food places in the terminal and grab a handful of straws (preferably ones with a bendy joint). When I was on the plane I would connect the straws by fitting them into each other to create a long straw. Put one end into the port on and the other into your ear and you got free movies with audio!
- barrkel 3y agoHow long ago was this? 20 years ago, all I saw were dual mono bayonet jacks you'd need an adapter for to plug in normal headphones, but straws would get you nowhere. I was curious so I searched: https://simpleflying.com/inflight-entertainment-headphones-evolution-history/ https://simpleflying.com/inflight-entertainment-headphones-e... - pneumatic headphones from the 1960s were used on Delta as late as 2003, but electronic headsets debuted on 767 in 1982. Apparently the dual mono jacks are to discourage people taking the headphones, rather than restricting access to audio.
- nottheengineer 3y agoThen why isn't at least one of those jacks a TRS so you can use normal headphones?
- IIsi50MHz 3y agoMy last four flights used only stereo 3.5mm plugs.
- mikaraento 3y agoOn newer planes both of them often are
- lathiat 3y ago
- iancmceachern 3y agoLegend, your kid is a legend
- quickthrower2 3y agoAnd probably 2 more simple steps to the credit card number of that paying customer.
- Eumenes 3y ago9-10 seems young to have a phone, smart kid though
- 1vuio0pswjnm7 3y agoThe LAN here seems relatively small and fixed, i.e., the number of passengers on a flight is known and does not change during flight. The airline could easily assign a unique IP address to each seat (ticket) without using DHCP. This is generally in contrast to other instances of public Wifi.
- groby_b 3y agoGood luck finding out which seat that wireless connection is coming from, though :)
- hunter2_ 3y agoThe user would scan their boarding pass to get connected.
- grishka 3y agoWhat if someone has multiple devices they want to connect? Most people would travel with at least two devices.
- ValentineC 3y agoFor Panasonic's in-flight wifi specifically, a login would only work for one device at a time. Great time to have an Android device with hotspot handy. :)
- hunter2_ 3y agoThe fact that newer phones (Pixel at least) can use WiFi (client mode) as the WAN/uplink side of its hotspot stack (NAT, AP, etc.) is pretty neat. Not long ago, only the cell modem could serve in that capacity, as far as I'm aware. Frankly I'm surprised a single WLAN radio can pull that off. I pay the $8 on my phone and share it to my laptop and whatever devices my travel companion(s) might have. Most laptops can't do this, right?
- 3y ago
- babypuncher 3y agoA slightly more ethical solution, for those wondering, is SSH tunneling. A lot of gated wifi networks allow SSH traffic through without payment. I used to spend a lot of time at JFK back when they still charged for WiFi. I watched a lot of Netflix for free by just logging into my router and opening a tunnel to my VPN server.
- Wowfunhappy 3y agoDo you know why they let SSH through?
- jrockway 3y agoThe rule is probably something like "if !paid: deny tcp 80, deny tcp 443". (Hopefully they got UDP for HTTP/3.) I suppose this has the desired effect of captive portals (break GMail until you pay), without having to field support requests from geeks ("I paid but SSH doesn't work, refund me"). I think their plan is that whatever obscure app you're using negotiates over HTTPS, but then actually transfers the data over some other port. I bet things like Zoom work that way. By not touching the obscure data paths, you avoid support requests. Either that, or they just felt like throwing a fellow nerd a bone. If you ask the PM, "should I block SSH" they'll say yes, but if you just put it in there, who knows ;)
- extraduder_ire 3y agoWhoever set that up probably wanted it for their own use, both for easily managing the system when they need to work on it, and for themselves when they're travelling anywhere. If I'm ever in charge of rigging up a captive portal system like this, I'm certainly going to do something similar if I can get away with it. Maybe even put a hint on how to bypass in the portal's page source. "ssh works on port 46969, don't tell anyone." > rot13 > base64 -> "cache-burst-ID: ZmZ1IGpiZXhmIGJhIGNiZWcgNDY5NjksIHFiYSdnIGdyeXkgbmFsYmFyLgo=" May be too obscure though.
- jrockway 3y ago
- skripp 3y ago> I had to tell him not to do that, but I was kind of proud of him for having the temerity to go for it. You told him off for such a small thing? You were impressed but didn’t give encouragement? You are a horrible parent.
- rhuru 3y agoYour son is in good company.
- Obscurity4340 3y agoKids discover the darndest hacks
- elif 3y agoPlot twist, he used your credit card and you are proud of his social engineering skills.
- colordrops 3y agoBasically IP war-dialing.
- cromka 3y agoThere’s a way to workaround virtually any kind of gated Internet access: DNS tunneling (https://github.com/yarrick/iodine https://github.com/yarrick/iodine) It’s slow, but it works and is a handy “last resort” tool.
- noduerme 3y agoWait, they like, opened up a private local IP on every plane for some guy who paid for a certain dedicated one?!
- glitchcrab 3y agoNo, the IP is just that of a random paying user on that particular flight.
- kabes 3y agoI used dns tunnels a lot in the past. I wonder if techniques like this still work these days
- mistymountains 3y agoYou gave your 9 year old a smartphone?