3 ms·

This looks like it dups a paying customer's IP and MAC addresses. Does that work if both devices are running at the same time? I was under the impression TCP di

by jws 13y ago

This looks like it dups a paying customer's IP and MAC addresses. Does that work if both devices are running at the same time? I was under the impression TCP didn't like that.

biondim 13y ago
Agreed, you're basically someone else's session who did the right thing and paid up. I fail to understand why anyone with a decent moral compass would want to do this.
- dale386 13y ago
  This will be exploited by people without a moral compass. What are you trying to get at? The author isn't suggesting this as a life hack for free internet, he's just showing that it can be done.
  - sambeau 13y ago
    "The author isn't suggesting this as a life hack for free internet" The HN Title is (I can't see the actual article as the machine is hosed): "How to get Gogo in-flight wireless internet for free" and the URL is gogo-in-flight-wireless-internet-free Both of which, I would suggest, propose an article about "How to get internet for free", specifically "How to get Gogo in-flight wireless internet for free". Or am I missing something?
    - cac04 13y ago
      > Or am I missing something? Yes, you're missing something. The article is a disclosure of a security vulnerability that has already been reported to the company responsible, including notice that it would be published and a request for confirmation that it has been fixed. (Edit: but your response is reasonable - I can see how the article title is misleading.)
oasisbob 13y ago
TCP doesn't care. IP and Ethernet care a lot. Layer2 attacks like this aren't clever, and can be very difficult to prevent because of the nature of communication at that layer. In a corporate/campus/hardline environment, there are plenty of reasonable mitigation strategies. (802.1x &c). For a shared hotspot, this type of behavior is just anti-social.
- gonzo 13y ago
  the "right thing" for hotspots is anonymous 802.1x. That is, any credentials work.
jackowayed 13y ago
I think it would still work. I think you'll end up both getting all of the network packets, in which case the higher-level protocols will ignore the ones meant for the other device. TCP and UDP both have source ports as well as destination ports, but the source ports are usually picked arbitrarily, so the different devices will have connections on different ports and will discard any packets bound for ports they don't have open. And TCP also has sequence numbers (which should be chosen randomly), so even if you ended up on the same port for a TCP connection, your packets are very likely to have different enough seqnos that you ignore each other's packets.

by jws 13y ago

This looks like it dups a paying customer's IP and MAC addresses. Does that work if both devices are running at the same time? I was under the impression TCP didn't like that.

biondim 13y ago

Agreed, you're basically someone else's session who did the right thing and paid up. I fail to understand why anyone with a decent moral compass would want to do this.

dale386 13y ago
This will be exploited by people without a moral compass. What are you trying to get at? The author isn't suggesting this as a life hack for free internet, he's just showing that it can be done.
- sambeau 13y ago
  "The author isn't suggesting this as a life hack for free internet" The HN Title is (I can't see the actual article as the machine is hosed): "How to get Gogo in-flight wireless internet for free" and the URL is gogo-in-flight-wireless-internet-free Both of which, I would suggest, propose an article about "How to get internet for free", specifically "How to get Gogo in-flight wireless internet for free". Or am I missing something?
  - cac04 13y ago
    > Or am I missing something? Yes, you're missing something. The article is a disclosure of a security vulnerability that has already been reported to the company responsible, including notice that it would be published and a request for confirmation that it has been fixed. (Edit: but your response is reasonable - I can see how the article title is misleading.)

oasisbob 13y ago

TCP doesn't care. IP and Ethernet care a lot. Layer2 attacks like this aren't clever, and can be very difficult to prevent because of the nature of communication at that layer. In a corporate/campus/hardline environment, there are plenty of reasonable mitigation strategies. (802.1x &c). For a shared hotspot, this type of behavior is just anti-social.

gonzo 13y ago
the "right thing" for hotspots is anonymous 802.1x. That is, any credentials work.

jackowayed 13y ago

I think it would still work. I think you'll end up both getting all of the network packets, in which case the higher-level protocols will ignore the ones meant for the other device. TCP and UDP both have source ports as well as destination ports, but the source ports are usually picked arbitrarily, so the different devices will have connections on different ports and will discard any packets bound for ports they don't have open. And TCP also has sequence numbers (which should be chosen randomly), so even if you ended up on the same port for a TCP connection, your packets are very likely to have different enough seqnos that you ignore each other's packets.