7 ms·
Unlocking free WiFi on British Airways
- qwertytyyuu 1y agoHmmm can you hide vpn traffic this way?
- avidiax 1y agoA TOR dev gave a recent talk at DEFCON [1], and described this as one of the ways that attempts at nationwide blocks to the TOR network are implemented. I'm not sure that it's exactly the same as domain fronting, since that might involve a CDN, but the technique is very close. [1] https://youtu.be/djM70O0SnsY https://youtu.be/djM70O0SnsY
- nonethewiser 1y agoI wonder how generalizable this is to other airlines
- rootsudo 1y agoiodine is just easier in general, but since many airlines use the same vendor - probably the same.
- niij 1y ago> Something along the lines of arbitrary subdomains which represent the request payload, and a custom nameserver that returns responses via the TXT record or something. Anyway…). This is iodine. https://github.com/yarrick/iodine https://github.com/yarrick/iodine
- _kidlike 1y agoI did something similar ~12 years ago, albeit it was just http(a) over UDP tunneling, and not DNS specifically. I had to spend 8 hours in Stansted airport, and I managed to setup the tunnel while in the time limit of the free WiFi (I think it was 30'). It felt good, haha.
- sammy2255 1y agoThat's really cool I never thought about having your own host and then faking the SNI. I find it pathetic that vendors and ISPs are snooping SNI headers to block things, looking at you, UK. Also, I wonder what will happen if those instant messaging apps move to Encrypted SNI (ECH), will they just not work, or is there fallback?
- arch-choot 1y agoThere may not be any "free messaging" or similar offers is my guess. In fact using ECH it is already possible to spoof the SNI but make a real TLS handshake to the underlying domain; you can try it on my test website[0] with wireshark open on the side (if your browser supports ECH) [0] https://rfc5746.mywaifu.best:4443/ https://rfc5746.mywaifu.best:4443/
- heavyset_go 1y agoIf you use Lyrebird not only can you obfuscate your traffic behind various transports, it does domain fronting by default. Don't have to jump through this many hoops. Also, allegedly, MAC spoofing of already authenticated clients can bypass many of these paywall-gated hotspots :)
- gorgoiler 1y agohttps://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird https://gitlab.torproject.org/tpo/anti-censorship/pluggable-... …in case anyone else needed a link.
- heavyset_go 1y agoThanks. That README is a bit out of date from when the project just implemented a single transport, this is more accurate[1]. It's what's used in the latest Tor Browser. [1] https://support.torproject.org/tbb/lyrebird/ https://support.torproject.org/tbb/lyrebird/
- fiatpandas 1y agoEventually airlines will just whitelist IP ranges for free messaging-only access.
- unixfox 1y agoAlmost impossible task. The public IPs change every time. Usually they are on CDN that have a very large IP range. And if they allow large IP ranges, one could try to spin up a virtual machine on the same cloud provider as the messaging platform.
- Nextgrid 1y ago> Almost impossible task Except if the messengers happily collude with you, which Facebook does - they have a website (can't remember the link) where network providers can get IP ranges and other information to enable "zero rating" for Facebook's properties.
- lokar 1y agoOr even provide proxies to run on the airline network
- toast0 1y agoFWIW, if my information isn't outdated, FB requires users of the mobile partner portal to be actual mobile networks; airlines are not invited. I worked on this for WhatsApp before I left in 2019, and the airline text only free messaging did not fit with the WhatsApp special pricing/zero rating offering. Afaik, FB doesn't work with airlines on these offerings; the offerings started before I left and were a surprise to me when I was still informed about all the partners (because I had to add them to mailing lists and do other integration work)
- SomaticPirate 1y agoWonder how long it is before it’s taken down. A previous post about a cruise was threatened with legal action
- Nextgrid 1y agoDo you have a link to the story?
- doublef 1y agoI used HN Algolia to search for "internet cruise" and the top result was promising. Interestingly, the HN post no longer linked to an article! I used Wayback Machine on the HN post and found the link to the original article, which in turn returns a 404! Though, you can find that too in Wayback Machine.
- sandblast 1y agohttps://archive.is/LXFyR https://archive.is/LXFyR https://news.ycombinator.com/item?id=44291630 https://news.ycombinator.com/item?id=44291630
- markasoftware 1y agoI have a friend who did similar tunneling a while ago. It also works on cruise ships. He discovered that on some airlines (I think American?), they use an advanced fortinet firewall that doesn't just look at the SNI -- it also checks that the certificate presented by the server has the correct hostname and is issued by a legit certificate authority. My friend got around that restriction by making the tunnel give the aa.com SNI, and then forward a real server hello and certificate from aa.com (in fact I think he forwards the entire TLS 1.2 handshake to/from aa.com). But then as soon as the protocol typically would turn into encrypted application data, he ignores whatever he sent in the handshake and just uses it as an encrypted tunnel. (The modern solution is just to use TLS 1.3, which encrypts the server certificate and hence prevents the firewall from inspecting the cert, reducing the problem back to just spoofing the SNI).
- amritananda 1y agoThis is basically what Xray [1] does. For any connection request matching a particular SNI and not presenting a secret key, it proxies the entire SSL handshake and data to a camouflage website. Otherwise it can be used as a regular proxy disguised as SSL traffic to that website (with the camouflage website being set as the SNI host, so for all purposes legit traffic to that host for an external observer). It's meant to get around the great firewall in China, so it has to avoid the GFW's active probers that check to make sure the external website is a (legit) host. However a friend was able to get it to work American's in-flight firewall if the proxy SNI is set to Google Analytics. [1] https://github.com/XTLS/Xray-core https://github.com/XTLS/Xray-core
- filleokus 1y agoSomeone was using Xray, proxying to my employer, and it was detected in our attack surface management tool (Censys). I had some quite stressful few minutes before I realised what was going on, "how the hell have our TLS cert leaked to some random VPS hoster in Vietnam!?". Thankfully for my blood pressure, whoever had set it up had left some kind of management portal accessible on a random high port number and it contained some strings which led me back to the Xray project.
- 1y ago
- tgtweak 1y agoThe amount of public WiFi's (including in-flight ones) I've bypassed by running a vpn server on udp port 53 is honestly insane. Sadly, this is becoming less commonplace many captive portals don't allow any egress at all aside from the captive portal's IP - but alas - still impressive how many are susceptible. It also bypasses traffic shaping (speed limiting) on most networks that are publicly accessible even if they do require some kind of authorization to enable external accessibility. Highly recommend softether as they give you juicy Azure relay capability for free which is allowed in more "whitelist only" networks than your own vps server. Haven't gone so far as to enable iodine for actual two-way dns communication through a third party DNS resolver, but that would probably work in more cases than this, albeit slower.
- dheera 1y agoThere are also airline wifi these days that allow "free messaging" i.e. WhatsApp and Facebook Messenger traffic only. If one could create a TCP-over-WhatsApp VPN that would be fantastic.
- arch-choot 1y agoI think that's essentially what my HTTPS proxy does; except rather than actually being over WhatsApp (i.e. using WA messages or w/ever), the SNI tricks their authorization into thinking I'm using WA, while I am connecting to my proxy.
- tgma 1y agoNo, yours would immediately break if they whitelist IPs. This one is pretty much officially sanctioned WhatsApp traffic.
- arch-choot 1y agoAh right, if they also impose IP restrictions this would not work
- Nextgrid 1y ago
- yegle 1y agoFWIW this is called https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting
- felipelalli 1y agoWait a minute: the guy did all this during a flight?
- exitb 1y agoHalf of it. He also describes some preparations he did while in the destination and a final test on a flight back.
- arch-choot 1y agoYep; on my way to LHR I was intrigued by their "free messaging" and wanted to poke around, with the SNI hypothesis I did the actual HTTPS proxy setup on a VPS while in the UK, so I could actually try and proxy arbitrary browser traffic on the way back
- walthamstow 1y agoI am insanely productive on airplanes, I'm sure others are the same.
- a5c11 1y agoHe wrote at the end he hoped his idea and all preparations will work, because he wouldn't be able to repeat the steps while in-flight.
- ggm-at-algebras 1y agoAt some point the cost of the meter exceeds the value of the product being metered. This happened very soon after hotels really jacked up telephone bills. Somehow they decided not to stop being silly, simply to bill the ignorant or lazy and airlines look to be cut from the same DNA: we're maybe going to wind up with viable cellular comms inside aircraft that bypasses the airline. "Stealing" ip flows over Port 53 isn't the way out, the path out is having RF which doesn't flow through the airline's base station.
- telesilla 1y agoAs someone who thoroughly enjoys being forced to be offline when flying, as an escape from the world for a few hours, I hope your efforts do not lead to free wifi for all!
- jama211 1y agoJust don’t do all this work to get free wifi then lol
- globular-toast 1y agoI think it's more about other passengers on tiktok etc.
- esskay 1y agoYou've got free will right? Nobody forces you to be online, be it on a plane or on your sofa. Even if those around you are using the internet on a plane it's of zero consequence to you.
- hitarpetar 1y agogoing up to heroin addicts and reminding them they have free will
- cheema33 1y agoNot all of us are heroin/wifi addicts. But when I am on a 16-hour flight with nothing to do, I can use the wifi do some work. I actually enjoy my work.
- lormayna 1y agoI was in a intercontinental flight few weeks ago and when everyone was sleeping my wife was able to open Instagram and scroll the feed, while other websites were not accessible. I did not have a PC with me, but I immediately guessed about they are doing filtering based on SNI. Appliances like Allot or Sandvine are in this market since more than a decade.
- antonok 1y agoFunnily enough, I'm on a British Airways flight right this moment. I'm only using a basic Wireguard tunnel after enabling the free messaging plan. I get the sense they didn't design the firewall to block everything comprehensively.
- arch-choot 1y agoJust bare wireguard on 51820? I think I had tried that but no luck; but I don't remember for sure.
- antonok 1y agoI'm using a non-standard port (above 10000). Otherwise, nothing special about my configuration. Perhaps 51820 is blocked? It is admittedly quite slow/intermittent though; I wouldn't be surprised if that's the reason it didn't look like it was working for you.
- zkmon 1y agoWhat's up with the dates? The HN page shown in the screenshot is from 18-05-2025 around 1pm GMT, while the curl commands show a date of 09-05-2025. The story sounded like it was a single journey from EDI to HKG via LHR.
- arch-choot 1y agoSorry if its a bit unclear; the first part was HKG -> LHR when I kinda discovered it (9th May), and then the HTTPS proxy test was my flight back LHR -> HKG (18th May)
- zkmon 1y agoGot it. Nice work and great write-up! Teaches a few things.
- Philip-J-Fry 1y agoI also recently flew on BA and bypassed the free WiFi restrictions just by using a VPN. Not sure why that worked, but with Mullvad I was able to browse Hacker News in the air. Didn't need anything more advanced than that!
- mherrmann 1y ago[flagged]
- Ellipsis753 1y agoLooks like you were rate limited at the end. They don't rate-limit britishairways.com which is a SNI that you can always access. Lolz.
- cs02rm0 1y agoI interviewed for a cybersecurity position with BA a little while back, it was a bit odd in general. I mentioned a few issues I thought were serious holes on their website, equivalent to the breach they ended up being fined for. They said a pentest would find them if they were important. I think we parted with both parties unimpressed with the other.
- Nextgrid 1y agoBA was the one who got pwned with a card skimmer script on their checkout page, so this tracks. On the other hand, in-flight Wi-Fi "security" and actual company property security don't have anything to do with it. The in-flight Wi-Fi isn't protecting anything, it's just there as an annoyance to get a few extra bucks similarly to catering (and just like the latter, typically outsourced to a third-party which just allows them to white-label it).
- wouldbecouldbe 1y agoIt’s also keeping it working. If they allow open access for everyone it would quickly be unworkable
- Nextgrid 1y agoStarlink-based ones have enough bandwidth for the whole plane to have workable bandwidth (just rate-limit based on client so no single heavy user hogs the entire bandwidth). There's also an European one whose name currently escapes me which uses a custom flavor of LTE and special ground stations that also happily provides hundreds of mbps. Capacity is primarily an issue on the legacy BGAN-based ones where you have a handful of mbps for the entire plane.
- latentpot 1y agoThat's EAN, also used by BA as the backhaul.
- 1y ago
- haiji2025 1y agoCool
- generalzod 1y agoNice! I created tuningfork [1] a couple of months ago that proxies traffic through another node for the configured upstream. I wanted to understand networks, so rolled my own thing. And I wanted to bypass age verification laws in UK :) [1] - https://github.com/mutn3ja/tuningfork https://github.com/mutn3ja/tuningfork
- rr808 1y agoI totally believe pirating is not stealing, but this really is. Tech people are probably the highest paid profession now, you still dont want to pay for your wifi?
- alluro2 1y agoThis person just shared (for free) tons of experience, knowledge and insight into thinking/problem-solving process, for others to enjoy and learn from - and your only comment is attack on them for "stealing" somehow, by not sending e.g. 300 WA messages, but instead kilobytes of HN content? How much would you calculate was stolen this way? Based on which factors? As a side note, those pesky "tech people" are most certainly not THE most paid profession, now or ever.
- Barbing 1y agoI wouldn’t be upset to see a disclaimer that this was done as a proof of a technical concept and not to save a buck. For readers, I totally understand trying at once but it would be odd if e.g. someone I know who makes six figures told me they exploited this on every leg of their journey. We wouldn’t want to fill our water cups with soda even if it only costs the restaurant a penny.
- sandblast 1y agoSo this, in your opinion, causes more damage than violating someone's copyrights? This is quite literally just using a resource than would otherwise be wasted. Of course, the electricity use is lower if less people use this network, but this is negligible.
- Barbing 1y ago>just using a resource than would otherwise be wasted I take care with this line of reasoning. It could be extended to a college class with an extra seat at the back, a chairlift at a ski resort on a slow day, that kind of thing. Using either can lead to theft of services charges.
- powercf 1y agoI didn't know of the existence of SNI and thought that all traffic through TLS was encrypted. SNI sounds like a terrible idea: it should be obvious that leaking domain names will be abused and makes a mockery of any little cute icon in the browser (your government, police, ISP, airline knows what sites you visit). It would have been better to have a secure (ignoring DNS) inconvenient technology stack than a convenient somewhat-secure stack.
- ptman 1y agoBefore SNI every https site needed a dedicated IP address. As https got more popular SNI was introduced
- brown9-2 1y agoTLS might encrypt the contents but it doesn’t encrypt the destination or source IP (how could it?)
- grishka 1y agoSNI is used extensively by the Russian government for censorship. All DPI circumvention tools are based on mangling the ClientHello enough to confuse the DPI box but not enough for the destination server to notice anything.
- ram_rattle 1y agoNice one,I just learnt about this website today dig @ch.at "your question" TXT
- lokar 1y agoWere images broken by a rate limit and timed out? Packet size? I wonder if lowering the MTU on the interface would have made them work.
- aftbit 1y agoI remember using Streisand to solve this years ago. Apparently it's abandoned now though. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- tedggh 1y agoJust a heads up before you attempt something like this. When on a plane, you may be subject to laws you don’t know or understand. In the US this could be considered tampering with the aircraft electronic systems and potentially send you to jail for many years. So if you don’t want to find out perhaps pay the $30 or whatever it is for Internet access.
- drdaeman 1y ago> tampering with the aircraft electronic systems How? Unless I'm misunderstanding the word, "tampering" implies "making alterations to", and no aircraft systems are altered in any way - they are exactly as they were, doing exactly as they're programmed. (Ab)using the difference between implied programming and de-facto programming could be unauthorized access, but I don't see how that could possibly constitute tampering. Not that I disagree with your overall point, just the tampering bit strikes me as particularly odd.
- tedggh 1y agoYou may be right but it’s not up to you to determine if you are in violation of a federal law. If there’s a non-zero chance you can compromise the safety of the flight that’s all a prosecutor would need to charge you. Yes the possibilities of that happening are remote but also non-zero. So all I’m saying is make sure you calculate the risk and decide if saving $30 it’s worth a tiny possibility of a legal mess or even being banned from ever flying in that airline again. I’m risk averse for this kind of stuff so I would pay for internet access.
- drdaeman 1y agoOne surely can be charged with anything. What I'm trying to say is that tampering or compromising safety of the flight are IMHO highly improbable charges that are very unlikely to appear, and even less likely to stick. Hell, I strongly suspect airline is going to defend the hacker in this scenario, because they absolutely wouldn't want anyone (especially FAA) to ever think their firewall bug can affect flight safety. I think it's well-known that entertainment systems have to be isolated from main systems of the aircraft. I'm not an expert, but I know that it was the case that IFEs weren't safe, plane(s) went down because of that, so we no longer do that. All this said, I totally agree with you that there is a non-negligible chance that abusing the network policies could lead to some charges, possibly even criminal charges. Or, at the very least, lead to some unpleasantness that surely isn't worth 30 bucks. Just not the charges you're mentioning.
- nedt 1y agoI'm not bashing, but just want to remind about the alt attribute on images. The BA messaging wifi is an example of a use cases where images might not work as pointed out in the article and an alternative description would be needed. But the article itself is using images with alt text.
- adrianlzt 1y ago[dead]