7 ms·
Hotel WiFi JavaScript Injection (2012)
- jraph 2y agoSurely we are past this bullshit now thanks to https being everywhere? Also this is our reminder that yes, HTTPS is worth it even for "It's just my blog, I have nothing to hide, why should I encrypt?"
- dosinga 2y agoAgreed. It's interesting to see though in the comments that all the links there are http:// http:// even the ones that are to security posts
- olabyne 2y agoThe comments are from 2012.
- vaylian 2y ago> Surely we are past this bullshit now thanks to https being everywhere? Plenty of hotels (and other places) misdirect your DNS queries so that your machine will connect to the hotel's captive portal where you need to accept the terms and conditions for using the wifi. This causes HTTPS connections to fail. Captive portals are a rather inelegant hack, but in most cases they achieve what they are designed to achieve.
- red_admiral 2y agoBut once you're past the portal (even if you need to manually load example.com so you actually see it without hitting cert pinning errors), TLS gives you back the "can't touch this" you want.
- jraph 2y agoYep, and more and more OSes and browsers detect this situation and propose you a button to go to the portal. At least for me, both KDE and firefox have their mechanism for this. It still breaks a lot of stuff (notably, the Nextcloud client) as long as you are not logged on the captive portal, but well…
- extraduder_ire 2y agoAndroid, iOS, and windows also have this functionality. It's a shame there hasn't been a widely implemented standard for captive portal things yet. Even if what we have now works alright if you're doing web things.
- labcomputer 2y ago> Plenty of hotels (and other places) misdirect your DNS queries so that your machine will connect to the hotel's captive portal where you need to accept the terms and conditions for using the wifi. And for all the whining about how "but DNSSEC doesn't do anything!", this is exactly an attack scenario which DNSSEC protects, and which it has protected since the very first RFC describing it. The client can check for itself whether the IP address in the response has been correctly signed by the (sub-)domain owner (and recursively whether the (sub-)domain has been signed by the parent domain, all the way back to the root). As for "but how will I redirect hosts to my captive portal?", that's what DHCP option 114, DHCPv6 option 103 and IPv6 Router Advertisement option 37 are for. https://developer.apple.com/news/?id=q78sq5rv https://developer.apple.com/news/?id=q78sq5rv
- WillowZzzzz 2y agoAdd DoH/DoT to your reply and you're correct.
- tdtd 2y agoIf the network’s owner was the one doing DNS redirects, couldn’t they just instead use the IP address in the DNSSEC-signed record themselves? I don’t think DNSSEC is a robust protection if you don’t trust the network you’re connected to.
- lmz 2y agoThis would break the chain of trust (you wouldn't trust the network's key signing the address for that zone).
- tdtd 2y agoThe attacker doesn’t resign the DNS record with their own key, they just let the legitimately signed record though and use the IP address in that legitimate record themselves. If someone owns the network (or is an active MitM) they can control where IP addresses route to.
- tptacek 2y ago
- stuff4ben 2y agoI remember when this stuff was happening. It was like the world shifted over to HTTPS instantly. Wish we could do the same for IPv6.
- OkayPhysicist 2y agoIt basically did. Cloudflare rolled out a free feature to enable HTTPS support on every site they served via (not unchecking? Don't remember the opt-in/opt-out detail) a checkbox in 2014, and less than a year later Let's Encrypt became available. Only a couple years later in 2018, Chrome and Firefox started marking non-http sites as "unsafe".
- ramon156 2y agoYou'd be surprised how many hotels can't be bothered
- bongodongobob 2y agoI wouldn't be surprised at all. It's not like they've got on-site IT support. Split off a guest network on its own VLAN and done, never to be touched again. The less complicated the better.
- kevincox 2y agoI've long wondered if there was a place for a httpv mode. Where traffic is signed but not encrypted. This would allow local caching or torrent-like distributed fetching but not modification. The obvious downside is that the page contents are not private. Chrome implemented something sort of like this with https://developer.chrome.com/blog/signed-exchanges https://developer.chrome.com/blog/signed-exchanges. However this is very limited. It requires the linking site to cooperate. For example Google Search can link to a signed exchange rather than the original site. But this just moves traffic from the site's CDN to Google's. It also packages full bundles so shared resources need to be duplicated. Also any navigation inside that site will go to the origin and can't be cached. Overall it seems like it probably isn't worth it. But I find it an interesting idea.
- Jerrrry 2y agoThis is awesome. Propose an RFC - seriously. This simplifies, democratizes, and makes transparent the "internal resource sharing/caching" that some browsers can do, like when needing to load the latest jQuery for the 15th time in the last minute, even across domains. Also would be perfect for captive portals, or other static LAN content.
- pkage 2y agoI think the problem comes down to fingerprinting. For example, resources used to be cached in the browser regardless of site exactly as you described, but then ad companies figured out you can track a user's browsing history by timing the cache accesses to see if a user had loaded a bundle from another site. To remove that vector, browsers split up caches per domain.
- Jerrrry 2y agoThat's a vector for literally all assets so adding a random delay to every layer up to the last Paint() is the only real counter. It can be mitigated by adding a property to scripts to allow/default/deny shared domain resource caching, and the ecosystem can benefit from jquery/etc from being hot but still maintain opt-in default/backwards-compat status. that, combined with the already established HTML <script> integrity Attribute and you are gravy
- deleted 2y ago[deleted]
- spacebanana7 2y agoIs it possible for this to happen today with SMTP? Email supports HTML/CSS/JS and is sent over plaintext, so shouldn't the same kind of injection vulnerability exist?
- vaylian 2y ago> and is sent over plaintext No longer true.
- orev 2y agoIt is absolutely true that SMTP can be sent over plaintext. Many mail systems have opportunistic use of TLS, but they can fall back to plaintext if that’s not available. A few mail systems require TLS, at the risk of not being able to receive messages (and the big boss yelling about it). A blanket statement that all email is encrypted is just plain false.
- spacebanana7 2y agoThat's interesting. I wonder whether an ISP could block traffic using TLS SMTP ports to force opportunistic senders to revert to plaintext. I suspect this may be possible because TLS SMTP uses port 587, rather than 443 like other TLS connections. https://www.cloudflare.com/en-gb/learning/email-security/smtp-port-25-587/ https://www.cloudflare.com/en-gb/learning/email-security/smt...
- Repulsion9513 2y agoThe SMTP that we're talking about uses port 25, not port 587 (or 465). But yes, an ISP could block the STARTTLS negotiation. Port 587 is submission - an end-user's client talking to their email provider's SMTP server. Port 25 is smtp - your email provider's SMTP server talking to the recipient's email provider's SMTP server. Port 443 is https - not TLS. TLS can operate over any port you like. The port is determined by the service being used, not by the fact that it's TLS.
- 2y ago
- red_admiral 2y agoIf only there were some kind of way to serve HTTP over a secure connection. Maybe even with some kind of certification authority scheme to prevent the RXG from spoofing the domain.
- rmetzler 2y agoAccording to Wikipedia Let’s Encrypt was started in September 2015. They did some great work! https://en.m.wikipedia.org/wiki/Let%27s_Encrypt https://en.m.wikipedia.org/wiki/Let%27s_Encrypt
- isaacfrond 2y agoProblem is solved with using a VPN, no?
- the_snooze 2y agoWidespread TLS/HTTPS adoption is sufficient.
- tuetuopay 2y agoI can't fathom this addiction for VPN for "security". Nowadays almost every website uses HTTPS and browsers block HTTP downgrades most of the times. Yes VPNs are still useful for the occasional HTTP website, however most people will use some form of free VPN that could totally do the same. But yes, VPNs did solve this issue at the time of writing, and I even used one for quite long as my mobile carrier used to proxy all images through their own servers, as well as intercepting port 21. They stopped doing the former with the advent of HTTPS. To my knowledge they did not use this for nefarious purposes (they served downscaled images for lighter browsing at a time where 3G was frugal and websites not optimized yet for mobile).
- belthesar 2y agoYou can thank the pervasive advertising of services like NordVPN and their owned subsidiaries for that. Loads of people have been advertised to thinking that using a VPN is "more secure", but this new colloquial understanding of a VPN is quite different from the true definition. I've had to have talks with numerous friends and colleagues dissuading them from purchasing these, including saving someone from a multi-hundred dollar NordVPN subscription because they wanted to be more "secure". As an aside, viewing an HTTP website over VPN is indeed useful when the threat actor is the public WiFi provider, but it doesn't if your threat actor is the VPN provider, or in between the VPN provider and the hosting provider. I'll cede that this is beyond the scope of the situation talked about in the article though.
- isaacfrond 2y agoOnly on HN will you be modded down, receive a rant from two people, only to in the end get the admission: yes, you're right.
- theamk 2y agoI am surprised the person was surprised. I was using a lot of coffee shop WiFi in 2010's and earlier, and random injection was fairly common. Sometimes generic ads, sometimes timers ("You get free wifi for 1 hour, you have 42 minutes remaining"), sometimes ads for the coffee shop itself.
- vzaliva 2y agoThe question is: how widespread is it in 2024? P.S. I am always using a VPN on Hotel/Cafe WiFi.
- sargun 2y agoFar less due to TLS being ubiquitous
- bosch_mind 2y agoAnything you can do at the network level that can MITM in 2024 for TLS without the client needing a custom cert? I assume no, but curious anyway
- hunter2_ 2y agoI think if you block port 443 in such a way that a client sees it closed like any other non-HTTPS website, and the user has never been to the requested site before on that browser (to avoid HSTS being in effect), and they omit a scheme when typing the URL into the address bar, then the browser will make an unencrypted request and render the unencrypted response. However, popular browsers these days will add a "not secure" note near the address bar (where historically it would've had no such indication besides lack of padlock) and they'll try https first before falling back to http (but no fallback in the case of cached HSTS info from a prior visit).
- bosch_mind 2y agoAh thats clever
- ivan888 2y agoI think this is still possible with access points that require installing and trusting a custom certificate. The example in my mind is WeWork's WiFi
- rhplus 2y ago
- gwbas1c 2y agoThis is why I make sure my personal blog redirects to https, and why I typically install things like "https everywhere" browser extensions. I know this kind of stuff happens, and I don't want to waste time tracking it down and shaming people for doing it.
- ctm92 2y agoIn 2012 HTTPS was only common on websites that actually processed sensitive information like online shops and banks. Most websites/BBs (even with logins) didn't use HTTPS as it required you to buy a certificate. Lets Encrypt was not around back then
- gwbas1c 2y agoI know, for the longest time my hosting provider "claimed" I needed a static IP in order to have https. It wasn't until there was a bigger push that they "realized" that https doesn't require a static IP.
- GauntletWizard 2y agoIt was required - back in the early aughts, and modern TLS adoption with SNI was far from guaranteed even in 2012.
- kube-system 2y ago> What bugs me about their response is that the device required to do this type of on-the-fly JavaScript injection of HTML is both rare and expensive. It requires specialized hardware (like the RG Nets’ RXG-A8) starting at a cost of $10,000. In other words, this hardware was procured precisely for the purpose of perpetrating this kind of attack. If Courtyard/Marriott/Hotel Internet Services didn’t want that feature, then they probably could have requisitioned cheaper, less specialized, and more robust networking hardware. It looks like the device is a router and gateway for institutional networks, with features like captive portal, registration integration, etc. It isn't a dedicated JS injection device. While you can do that stuff on the cheap, $10k isn't unreasonable for networking gear with more special use-cases. The contractor likely just flipped that option on just to make a few extra bucks.
- paul7986 2y agoAnyone else sick of having your 4G/5G ATT, T-Mobile or Verizon service blocked when inside a hotel, a concert venue to even a small town (National Harbor DC .. a lot of businesses block your service) all so the business and or businesses around you force you to use a their Wi-fi network; collect and make money off your data. How is that even legal?? My examples in The Flamingo Hotel in Vegas you have to connect to their wi-fi while inside the hotel. Forget about trying to work remotely there and use your 5G mobile hotspot. At the Keseya Center in Miami ... at a recent concert there they had gates with ticket takers way out of from the front of the door. You walk up to them and they say get your ticket ready and you try but nope your ATT/TMobile/etc service is blocked you can only access getting your tickets via connecting to their wifi. My 5G worked fine until i got close to those non-ticket takers who prodded me to connected to the venue's wi-fi. National Harbor (just outside of DC) .. inside the gaylord hotel and more so inside Burger Fi and others close by both my friend's Verizon and my ATT with full bars were blocked .. had to connect to their wifi. Total B.S. and this stuff needs to be outlawed!!! I pay for service and if its readily available (full bars) I better have access or your paying me for time you are blocking me from using it.
- bongodongobob 2y agoThey aren't blocking cell data intentionally, that's extremely illegal. That's just how big buildings work dude.
- flurdy 2y agoAnd with a lot of people in one place connecting to the same cell tower that cannot reliably handle that many.
- LeoPanthera 2y ago> service blocked when inside a hotel Can you prove this claim? It's literally illegal, and I don't believe it actually happens. There's a difference between active jamming and "our building is made of metal".
- paul7986 2y agoUmm it was something hotel were actively doing https://www.google.com/search?client=firefox-b-1-e&q=fcc+hotels+blocking+customers+cell+service#ip=1 https://www.google.com/search?client=firefox-b-1-e&q=fcc+hot... ... you don't think some are still doing so using the whole it's a big building issue argument along the way. Also why when walking right up to those gates at the Keseya center outside and still outside getting right up to the gate to speak to the attendant did my service with full bars suddenly not work? It maybe illegal but what are the profits reaped vs the potential fines? Im usually downvoted for things I say (im sure you dont care to read all my thoughts all over the years on HN) but a LOT of them come true ... most recently about how much i hated Cruise cause they were startup bros trying to do the whole fake it before you make it with technology that can kills..fortunately it didnt kill anyone just unfortunately mangled a pedestrian. Let's see in a year if places start getting fined for this B.S.!
- darkhorn 2y agoAdd your web site to https://hstspreload.org https://hstspreload.org . Problem will be solved.