14 ms·

Bypassing Gogo’s Inflight Internet Authentication

115 points by superchink 14y ago

maxjus 14y ago
You could also change your user agent to that of a mobile device and pay $5. Dishonesty is always an (unethical) option. The technical complexity of getting a seamless Wifi connection 30,000 feet above ground warrants its $12.00 in my opinion.
- Firehed 14y ago
  On my last flight, the price had been raised to $20 or so. I'm not sure if it was holiday price-gouging or they've simply raised their prices, but in either case I was not pleased - especially as the service quality seems to have gone down recently.
  - eclipxe 14y ago
    I'm sure service quality being reduced has absolutely nothing to do with people bypassing the pay wall or changing their desktop user agents to be mobile for cheaper prices. Nah.
    - Firehed 14y ago
      You think MAC spoofing and editing your hosts file to get around a paywall has gone mainstream? I'd be astonished if there were two HN readers on most flights.
  - cdr 14y ago
    I've found the price jumps around a bit - I don't know if there's some metric to it or what.
  - encoderer 14y ago
    Yeah, uber engages in "price gouging" on NYE and other high volume days. It's called surge pricing, and it....... Works. It works really well. It preserves a scarce resource during periods of high demand for the users who get the most value out of it. You're the second person to make this comment. It sounds so petulant, like Gogo has suddenly been subjected to common carrier status. The service suffering is a sign that they should charge even more next time. But it was certainly better than it otherwise would have been. A lower price point means more users getting a smaller piece of pie. I've been on several flights with free wifi. It's horrible.
davidtgoldblatt 14y ago
I've yet to find one of these types of services that you can't access by spoofing the MAC address of a real customer. A while back, Intel removed MAC address spoofing from some of its wireless cards through a driver update, citing vague "security" concerns. I felt very up in arms about it for a while (why on Earth would you hobble your customer's products so you can make sure they can't violate your moral code!), but eventually decided I couldn't really complain, since the only reason I could think of that I might want such an ability would be to steal internet access.
- mindslight 14y ago
  When you say they 'removed MAC address spoofing', do you mean that they removed features that allow the card to work having duplicated an active address, or do you mean that they removed the ability for you to set the address at all? The latter has many uses, including simply not being tracked across every network session. To add this kind of antifeature truly is hobbling their customers' devices in pursuit of someone else's security.
  - paulgb 14y ago
    In fact, a story about MAC spoofing for privacy is on front page of HN today: http://erratasec.blogspot.com/2013/01/i-conceal-my-identity-same-way-aaron.html http://erratasec.blogspot.com/2013/01/i-conceal-my-identity-...
cstone 14y ago
don't blow up the spot
- mindslight 14y ago
  Sheesh, kids these days. 'Responsible disclosure' used to be about not screwing over the numerous people running a piece of software. Then it became about helping websites implementing software to regress us back to centralized computing. And now it's apparently about helping preserve clunky business models by helpfully suggesting exploiting weaknesses in TLS. What's up next, volunteer implementations of using nmap for client OS fingerprinting so they're even better able to extra money from more-capable device owners? Or helping to conceal the latest government trojan? Sigh.
  - vtail 14y ago
    I'm wondering (honest question) why do you believe that Gogo business model is clunky?
    - rayiner 14y ago
      Because he wants free shit dammit.
    - mindslight 14y ago
      It's a bunch of little niggling aspects that add up into just feeling the whole thing is yet another gimmicky disposable income scoop for out of touch spendthrifts. 1. Fifteen different prices depending on what alleged type of device you're using, and gasp whether you have more than one. 2. Internet access is only required for most tasks due to people's laziness of using webapps. 3. Alternatively, "yay, I can refresh reddit on a plane" 4. Partial Internet access given before payment, to make it as disruption-free as possible, even though it will necessarily end up admitting things like the original article. 5. These whole "enter your credit card" wifi networks in general. Network access is infrastructure. Yeah, it takes a bit of work to backhaul a plane. But it also took quite a bit of work to build the plane. Just make the infrastructure universal so we can rely on it instead of clouding the thing with massive transaction overhead. 6. Why give the spineless airlines any more money than you have to? This attitude is subject to change when they start sticking up for their customers by giving the TSA the boot. But honestly I'm doubt I'm going to win any points for these views on HN. I should probably just turn my commenting threshold back down.
vtail 14y ago
I'm amazed by some of the comments like "Wow great article. I knew there must be a way to avoid paying." and by author's apparent believe that contacting the support several times via twitter and not getting a response morally justifies sharing his recipe with other people and wishing them "Happy “free” surfing, for now anyway". Stealing is stealing, no matter what "justification" one may have about high prices. edit: grammar
- vtail 14y ago
  "This bakery's bread is OKish, but $10 is too much to pay for a loaf. But I found a cool trick: when you're offered to take a free sampler, you can actually take the whole lot while the owner is not watching. I sent him couple of postcards telling about this but he never responded, so enjoy this free bread while you can!"
  - kleiba 14y ago
    And when you're done sampling, the whole bread is gone, just like in the case of internet access, right?
    - rayiner 14y ago
      Given that GoGo is like 3.1 megabits shared between dozens of people on a plane, yeah. Also, the "marginal cost of information/bandwidth/etc is zero" is specious. You are not entitled to get things for their marginal cost. I can't take a Prada handbag out of store and leave the $50 marginal cost of the bag + $10 for restocking.
    - vtail 14y ago
      Internet access on board of a flying plane is non trivial and certainly doesn't come free: you need to install and maintain equipment on board, maintain a network of ground stations, write and debug some software, pay money to other internet providers etc. With relatively small number of paying customers (yet), you have to keep prices high to maintain the profitability of your business. Think about this: if nobody pays, they will close this service. Just like the bakery will close if nobody pays for the bread.
aseidl 14y ago
I've made it a habit to ping and dig my servers before signing in to a new wireless network. Of the hundreds of coffee shops, trains, planes, airports, etc that I've done this at, there has only been one network that blocked/rerouted both ICMP and DNS requests: a university that shared its network security team with a nearby national lab. However, exploiting these holes on a wireless network is incredibly easy to detect and block for an admin worth their salt. It's quite likely that at least a few of the networks I've been on would start blocking traffic from an unregistered device making tons of DNS requests. That being said, just pay the few dollars they charge for access. If your time is money, this small fee won't be noticed. If you just want to be able to refresh Reddit/lurk on HN, maybe you should take this opportunity to get away from technology for a few hours (while sitting in an aluminum tube hurdling through the skies).
hyperbovine 14y ago
More internet! That's just what's missing from my life.
vinhboy 14y ago
I really appreciate these types of articles. I learn a lot from them. I actually also discovered the google thing on Gogo the last time I was on their network. But I never made the connection that the author did. I found that insight to be very educational. Not to mention, now I have some reading to do about TCP over DNS, IMCP, etc...
foohbarbaz 14y ago
DNS tunneling is only good in theory. Ah, good old days. There was time (2003?) when I had a T-Mobile phone with GPRS and an IR port. I connected it to my laptop and discovered DNS lookups worked. Downloaded DNS tunnel sources, compiled and tried. It was not usable, way way too slow. The latency of the DNS server was the main issue. Besides, the tool was very crash prone. More of a proof of concept than real thing. I spent a few hours reading code and fixing bugs just to get it to the point where it somewhat worked. The DNS traffic used by the tunnel is quite easy to identify and probably filter out (the names looked up follow a specific pattern). So, there was no need for ISP to get worried. Given how slow access would be and the skill level required to get it to work, it is thousand times cheaper to ignore the "security hole". The Google app engine proxy looks more "useful".
michaelfeathers 14y ago
Ballsy article in light the Swartz case. How many felonies is that?

115 points by superchink 14y ago

You could also change your user agent to that of a mobile device and pay $5. Dishonesty is always an (unethical) option. The technical complexity of getting a seamless Wifi connection 30,000 feet above ground warrants its $12.00 in my opinion.

Firehed 14y ago
On my last flight, the price had been raised to $20 or so. I'm not sure if it was holiday price-gouging or they've simply raised their prices, but in either case I was not pleased - especially as the service quality seems to have gone down recently.
- eclipxe 14y ago
  I'm sure service quality being reduced has absolutely nothing to do with people bypassing the pay wall or changing their desktop user agents to be mobile for cheaper prices. Nah.
  - Firehed 14y ago
    You think MAC spoofing and editing your hosts file to get around a paywall has gone mainstream? I'd be astonished if there were two HN readers on most flights.
- cdr 14y ago
  I've found the price jumps around a bit - I don't know if there's some metric to it or what.
- encoderer 14y ago
  Yeah, uber engages in "price gouging" on NYE and other high volume days. It's called surge pricing, and it....... Works. It works really well. It preserves a scarce resource during periods of high demand for the users who get the most value out of it. You're the second person to make this comment. It sounds so petulant, like Gogo has suddenly been subjected to common carrier status. The service suffering is a sign that they should charge even more next time. But it was certainly better than it otherwise would have been. A lower price point means more users getting a smaller piece of pie. I've been on several flights with free wifi. It's horrible.

davidtgoldblatt 14y ago

I've yet to find one of these types of services that you can't access by spoofing the MAC address of a real customer. A while back, Intel removed MAC address spoofing from some of its wireless cards through a driver update, citing vague "security" concerns. I felt very up in arms about it for a while (why on Earth would you hobble your customer's products so you can make sure they can't violate your moral code!), but eventually decided I couldn't really complain, since the only reason I could think of that I might want such an ability would be to steal internet access.

mindslight 14y ago
When you say they 'removed MAC address spoofing', do you mean that they removed features that allow the card to work having duplicated an active address, or do you mean that they removed the ability for you to set the address at all? The latter has many uses, including simply not being tracked across every network session. To add this kind of antifeature truly is hobbling their customers' devices in pursuit of someone else's security.
- paulgb 14y ago
  In fact, a story about MAC spoofing for privacy is on front page of HN today: http://erratasec.blogspot.com/2013/01/i-conceal-my-identity-same-way-aaron.html http://erratasec.blogspot.com/2013/01/i-conceal-my-identity-...

cstone 14y ago

don't blow up the spot

mindslight 14y ago
Sheesh, kids these days. 'Responsible disclosure' used to be about not screwing over the numerous people running a piece of software. Then it became about helping websites implementing software to regress us back to centralized computing. And now it's apparently about helping preserve clunky business models by helpfully suggesting exploiting weaknesses in TLS. What's up next, volunteer implementations of using nmap for client OS fingerprinting so they're even better able to extra money from more-capable device owners? Or helping to conceal the latest government trojan? Sigh.
- vtail 14y ago
  I'm wondering (honest question) why do you believe that Gogo business model is clunky?
  - rayiner 14y ago
    Because he wants free shit dammit.
  - mindslight 14y ago
    It's a bunch of little niggling aspects that add up into just feeling the whole thing is yet another gimmicky disposable income scoop for out of touch spendthrifts. 1. Fifteen different prices depending on what alleged type of device you're using, and gasp whether you have more than one. 2. Internet access is only required for most tasks due to people's laziness of using webapps. 3. Alternatively, "yay, I can refresh reddit on a plane" 4. Partial Internet access given before payment, to make it as disruption-free as possible, even though it will necessarily end up admitting things like the original article. 5. These whole "enter your credit card" wifi networks in general. Network access is infrastructure. Yeah, it takes a bit of work to backhaul a plane. But it also took quite a bit of work to build the plane. Just make the infrastructure universal so we can rely on it instead of clouding the thing with massive transaction overhead. 6. Why give the spineless airlines any more money than you have to? This attitude is subject to change when they start sticking up for their customers by giving the TSA the boot. But honestly I'm doubt I'm going to win any points for these views on HN. I should probably just turn my commenting threshold back down.

vtail 14y ago

I'm amazed by some of the comments like "Wow great article. I knew there must be a way to avoid paying." and by author's apparent believe that contacting the support several times via twitter and not getting a response morally justifies sharing his recipe with other people and wishing them "Happy “free” surfing, for now anyway". Stealing is stealing, no matter what "justification" one may have about high prices. edit: grammar

vtail 14y ago
"This bakery's bread is OKish, but $10 is too much to pay for a loaf. But I found a cool trick: when you're offered to take a free sampler, you can actually take the whole lot while the owner is not watching. I sent him couple of postcards telling about this but he never responded, so enjoy this free bread while you can!"
- kleiba 14y ago
  And when you're done sampling, the whole bread is gone, just like in the case of internet access, right?
  - rayiner 14y ago
    Given that GoGo is like 3.1 megabits shared between dozens of people on a plane, yeah. Also, the "marginal cost of information/bandwidth/etc is zero" is specious. You are not entitled to get things for their marginal cost. I can't take a Prada handbag out of store and leave the $50 marginal cost of the bag + $10 for restocking.
  - vtail 14y ago
    Internet access on board of a flying plane is non trivial and certainly doesn't come free: you need to install and maintain equipment on board, maintain a network of ground stations, write and debug some software, pay money to other internet providers etc. With relatively small number of paying customers (yet), you have to keep prices high to maintain the profitability of your business. Think about this: if nobody pays, they will close this service. Just like the bakery will close if nobody pays for the bread.

aseidl 14y ago

I've made it a habit to ping and dig my servers before signing in to a new wireless network. Of the hundreds of coffee shops, trains, planes, airports, etc that I've done this at, there has only been one network that blocked/rerouted both ICMP and DNS requests: a university that shared its network security team with a nearby national lab. However, exploiting these holes on a wireless network is incredibly easy to detect and block for an admin worth their salt. It's quite likely that at least a few of the networks I've been on would start blocking traffic from an unregistered device making tons of DNS requests. That being said, just pay the few dollars they charge for access. If your time is money, this small fee won't be noticed. If you just want to be able to refresh Reddit/lurk on HN, maybe you should take this opportunity to get away from technology for a few hours (while sitting in an aluminum tube hurdling through the skies).

hyperbovine 14y ago

More internet! That's just what's missing from my life.

vinhboy 14y ago

I really appreciate these types of articles. I learn a lot from them. I actually also discovered the google thing on Gogo the last time I was on their network. But I never made the connection that the author did. I found that insight to be very educational. Not to mention, now I have some reading to do about TCP over DNS, IMCP, etc...

foohbarbaz 14y ago

DNS tunneling is only good in theory. Ah, good old days. There was time (2003?) when I had a T-Mobile phone with GPRS and an IR port. I connected it to my laptop and discovered DNS lookups worked. Downloaded DNS tunnel sources, compiled and tried. It was not usable, way way too slow. The latency of the DNS server was the main issue. Besides, the tool was very crash prone. More of a proof of concept than real thing. I spent a few hours reading code and fixing bugs just to get it to the point where it somewhat worked. The DNS traffic used by the tunnel is quite easy to identify and probably filter out (the names looked up follow a specific pattern). So, there was no need for ISP to get worried. Given how slow access would be and the skill level required to get it to work, it is thousand times cheaper to ignore the "security hole". The Google app engine proxy looks more "useful".

michaelfeathers 14y ago

Ballsy article in light the Swartz case. How many felonies is that?