If a ping to a specific IP times out, I wouldn't say the IP is blocked. It could be that ICMP specifically is blocked, following some network rules on the firewall. This is pretty common in entreprise networks to not allow endpoint discovery. I could be missing something and happy to be corrected here, but I was surprised to read that.
I find it's important to remember, too, that a failed PING tells you nothing other than your echo request did not receive a response. If the remote host received your request, and if it responded, are both things a failed PING can't tell you, because both of those things could be true but you still end up with a failed PING.
I've seen technicians get tripped up in troubleshooting thinking that a failed PING tells them more than it does. When the possibility of asymmetric return paths is involved it's always important to remember how little a failed PING actually tells you.
And that can be a lot more subtle than you might think. I've had a persistent very hard to debug false alarm triggered on pings sometimes not making it and most of the time they did. But very rarely that would happen three times in a row and that was the threshold for raising an alarm. We spent days on this. Finally, the root cause was tracked down to a BNC 'T' connector at the back of a media adapter that filtered out the header of some percentage of ICMP packets. It is one of the weirdest IT problems I've ever encountered and it makes me wonder how much of what we rely on is actually marginal.
I work at a company that invented an internal syntax to compile into C++ code, that still relies on c-shell and conventions taken when OS/2 was in use there, and with a web of Jenkins instances and homemade wrappers and DBs to build that stuff.
I can safely say that title exists already. And I value my current experience as a humbling example of what is to come as software becomes an older industry, and not just a world of startups and their freshest languages/frameworks/tools.
I thought that too up until this GenAI moment, and now I wonder if needing to be an archaeologist will be so valuable if one can get your needs met by a quickly GenAI-written script/program.
> I thought that too up until this GenAI moment, and now I wonder if needing to be an archaeologist will be so valuable if one can get your needs met by a quickly GenAI-written script/program.
I never have actually read those books (though I read some summaries about them, interesting concepts). My understanding is the "programmer-archeologists" basically had an archive of massive quantities of very high-quality software that did pretty much anything you'd want software to do. So it made more sense to find the software you need and glue it together than write from scratch.
And given GenAI doesn't write high quality software (at least not yet, and hopefully never), I don't think that "GenAI-written script/program" would be a good replacement (though an AI archeologist might make more sense, with such an archive).
I've yet to have my needs met by a GenAI-written script/program. Archaeologists tend to be a lot more precise in their statements, especially about what is speculation and what is not.
I mean, if you're willing to accept AI slop, that's fine. But if you're willing to accept AI slop, you'd probably be willing to accept human slop (at least if it claims to be AI) too, and then the job gets a lot easier.
I'm a SRE and encountered this recently. To prevent DDoS, there is a buffer setting on the kernel that will limit the number of pings (a few settings actually). So if you have a group of machines that all ping a single destination at once, it's very possible to have some that fail to get a reply.
Relatively speaking, it wasn't that bad. It took a few weeks of getting trouble tickets with no root cause, and a bit of googling. But management wasn't okay with fixing the root cause, instead they just increased the timeout/retry window.
Wow. That's a classic. We were quite motivated because we were the ones that got the automated alerts. I still see them in my nightmares: "chopper is down". The machine was called chopper, I'll never forget, it's been close to 30 years. My buddy Jasper and me spent multiple nights trying to track it and when we finally found it we still couldn't believe that that was it. But a simple swap was proof.
if it wasn't an Arnie reference, could it have been a Stand By Me reference, "Chopper, sick balls"? or Eric Bana's Chopper: "if you keep stabbing me, I'm gonna die"?
clearly, i'm the type where everything is a movie reference, or it's a missed opportunity
I've always assumed that in situations like this, a traceroute is better. You can get more information simply by reaching the next stage in the trace, even if you're given zero information beyond "I'm now at the next server".
Nothing says the Time Exceeded packets elicited by your traceroute have to follow the same path back to you that you initiating packets followed out. It's a convenient fiction to think about IP networks acting like circuit-switched networks and in most LAN and small WAN applications they do. Mostly you can get away with thinking that way in more complex networks, too. When you end up in a situation where path asymmetry is causing you grief, thought, it's nice to have the understanding that each datagram can have a unique routing destiny.
I had an experience recently setting up a third-party VPN where the echo responses were being delivered to the correct (host,interface) but with the wrong destination address (not the same as made the request)
I’ve had to explain this over and over throughout my career. The only way to know if something is accessible is to try the exact endpoint and protocol. Even application-aware firewalls will mess with things at times.
Yes, you need to test the exact protocol you want to use. This means tcping/curl, TLS with proper certificates and SNI domains, etc.
However, just as you make sure that the power supply actually supplies power before dismantling something that refuses to work down to the last washer, repairing network problems should start with the basics. Simple test that does not work, or shows something nonsensical, is a great hint that you forgot something, or should start digging elsewhere.
Every time I've had to fight with path MTU discovery not working I've cursed the people who block all ICMP, though. If ICMP echo / echo-reply is the problem just block that. At the very least, allow destination unreachable / fragmentation needed thru (type 3, code 4).
I've worked in gigs that wanted that. They were all about segmentation, but wanted ICMP echo / response available throughout.
Edit: I wonder if any "enterprise" firewalls do ICMP echo proxying. Having the firewall replace the payload would remove some of the tunneling capability (thought I assume you could still finagle a side channel by just timing the packets) but would also eliminate some of the utility (since being able to craft the payload provides a way to test for specific bit patterns in packets causing problems).
It’s been years but I’ve likely used NAT to redirect ICMP pings so the local firewall responds rather than whatever boat they were trying to reach.
Systems change - a server that once used to respond to pings may no longer do so, but client software may not be updated to stop doing pings before connecting to the actual service on the server. In an ideal world the client code would be updated, in practice: hello firewall.
> We affirm our strict adherence to all relevant regulations and service terms throughout this project.
Except if you bypassed payment and used the service in a manner that was not intended, most likely you were by definition not undertaking "strict adherance" to service terms ?
Yeah I am a bit confused about posts like this. It’s bragging about breaking the law. There was a particularly bad one a few months ago where a kid had hacked Monster’s employee training site, and was sharing all this internal media in the post. I don’t understand how they don’t end up getting in some seriously annoying trouble with law enforcement.
Well I looked it up just now and the post was deleted, I guess maybe he did get in trouble. https://news.ycombinator.com/item?id=44997145
I wouldn't go as far as 'breaking the law', and I agree with the author that the contractual terms ($31 for wifi) are a shitty offer to a captive audience. But I'm also tired of pseudolegalism being employed as figleaf for bragging about the ability to bypass access controls and presumably making everything run a bit slower for all the other passengers (the author mentions that they gave up using it after a while because the bandwidth was so limited).
Yes, long flights are miserable and air travel is a bit of a ripoff. I choose to cope by treating it as an internet break and enjoying a dense book.
Laws penalizing theft of services usually work even if they haven't accounted for the exact manner in which someone might steal the service in question.
The author knew there was a fee for the service; the author devised a way to obtain the service without paying the fee; the author knew this action was not authorized by the service provider.
Most countries will have laws covering cases of unauthorized access, theft of services, and computer misuse.
The user agreement helps define the service as a paid service with defined access cases. Going around those would put the user in violation of some laws.
An analogy would be showing up to a paid event venue and noticing a back door was left open. Going into the building without paying is not okay, even though you never engaged with the ticket office to agree to anything.
I would have had far more positive feelings towards the hack if they had done that - e.g. had their roommate configure a bot to monitor a wechat room and respond to url requests by sending back a webpage. tunneling over DNS feels icky because the reason DNS traffic goes into a separate accounting pool is so that the basic infrastructure of the internet can be kept working smoothly, so this is getting firmly into tragedy of the commons territory.
> Not law per se. More like contractual obligations taken upon by connecting to the flight's WiFi.
Well, being pedantic, you could be said to be breaking Civil Law. :)
Jest aside, IANAL but most western countries have some sort of Criminal Law relating to mis-use of computers.
A brief search for Canada reveals Criminal Code (R.S.C., 1985, c. C-46)[1].
Again IANAL, but from my reading in this scenario it would be (c) -> (a), "uses or causes to be used ... a computer system" to "obtains, directly or indirectly, any computer service".
If you never clicked "I agree" in the captive portal prompt, and still got free internet via port 53 proxying, could you argue you never broke the contract because you never agreed to the terms? Genuinely curious
I would bet a little bit of money that this is still illegal because you cheated yourself access to a service that is clearly meant to be paid and usually requires agreement (as indicated by the captive portal). Sounds like fraud to me.
As far as I know courts in most jurisdictions are allowed to look at a case in its entirety and that won't look good for you.
A defense like "I thought it was just an config error and couldn't possible imagine that someone would want payment" doesn't sound very plausible to me in particular if it comes from an IT expert who just used sophisticated means to surgically circumvent the block.
In this particular cases of course they confessed the "crime" while bragging about it in their post.
Now what if a random person downloaded an app called "Internet anywhere" from their store and it justed worked? Much muddier because they wouldn't even know it was circumventing anything. For all they know it could be a deal between Air Canada and the app vendor.
This is theft. Stealing is illegal. Giving a blueprint for how you stole is the icing on the prosecutorial cake because you can’t claim lack of knowledge if you create a conspiracy to enable the theft.
This may be the dumbest write up I have ever read.
Theft comes with the connotation of taking someone away from someone and depriving them of their possession.
Using their internet connection without paying is unlicensed usage/illicit access, but nobody is being deprived of it. Mega corps tried, and failed, to get people to think watching a free movie on YouTube was theft. Same logic, very few people agree with the claim.
The nature of the non-transaction was such that they were given access to a service that was constrained in certain ways. They used the service, and the constraints that AC technically applied still applied. They used what was available to them under the constraints and weren't required to pay for any other service but the removal of the constraints. I don't see how any theft occurred.
Likewise illegality is just a boring and simple way to dismiss someone on moral grounds, but laws are only as effective as the level of agreement people have with them. Drinking in the park is technically illegal, but I don't care, the police don't care, nobody cares, unless someone needs to care, and I'm going to do it anyway, because the law does not make drinking in the park inherently wrong, it just provides a framework for telling you to stop if you're interfering with others in a way that relates to alcohol consumption.
Courts don't tend to be impressed by arguments like this. It was made very clear what was being offered and what wasn't, and technical barriers were even put in place. The fact that the barriers weren't foolproof doesn't give carte blanche to bypass them.
I agree more with your second argument, though that tends to be strained when the exploit is published.
> Courts don't tend to be impressed by arguments like this.
This is a court of casual opinions, but incidentally when all Air Canada employees recently went on strike—grounding and/or rescheduling all flights, including my own, and causing plenty of inconvenience—and were quickly ordered back to work by the federal government, basically everyone supported them continuing to refuse to work even though technically it was illegal because the government just decided it was. The government's move ended up backfiring and turned into a negative mark on their record after the employees basically won and everything went back to normal with more equitable pay. The CEO outright said they hadn't planned for the situation in which the employees just said no to the order.
IMO a certain amount of youthful indiscretion that takes the form of challenging systems and structures feels like it's both tolerable and important. Agitation prevents calcification.
Could also just be lack of knowledge. Weren't we all a bit more risky and playful with other people's websites when we were kids and the internet was still accessed via modems? Remember talking about that with both other kids and adults without getting in trouble, but it was also decades ago. Once I saw others getting in real big trouble (like prison), then I kind of tried to find more beneficial ways of learning programming and computers.
> Remember talking about that with both other kids and adults without getting in trouble.
A few kids doesnt matter. A few adults is only a problem if it's their stuff (If they are teachers, they will care more about unautorized changes of the wallpaper in the computer of the school that anything in a remote computer.) And yuo can even later claim they misunderstood or you were exagerating.
But here is an in written report in front of thousands of persons and about planes that is a sensitive topic.
DNS tunneling is not exaclty something you do "by accident".
And if the person doing it on the flight "did not know" (which, given the text of the blog, I doubt) , then you can bet your botom dollar that the "roommate" that was summoned for remote assistance knew very well what was going on.
Didn't claim so either, but a lack of knowledge about that it is in fact illegal, hence the parallel to at least my previous experience where I've most surely have committed crimes in the past, because I didn't know it was illegal in the first place.
I don't know the age of the author, but it almost doesn't matter, sometimes people don't know (lack of knowledge).
Say you're on a plane from Canada to Hong Kong (random example), which country's laws would be applicable here? The country where the airplane is registered?
> which country's laws would be applicable here? The country where the airplane is registered?
For all intents and purposes it is the country of registration of the aircraft.
There are one or two exceptions to the rule, but they would not be applicable in this scenario. Mostly stuff relating to air safety. For example, if the aircraft did something against the aviaition laws of the country being overflown. Or hijackings etc.
> if you stab your seat neighbor for taking too much space
IIRC the way it works is that when you land (destination or forced landing elsewhere) the offender is delivered to the local competent authorities.
They then undertake an initial investigation and decide either to exercise their own jurisdiction or undertake extradition proceedings to send the offender to the country of registration of the aircraft.
In a scenario of (attempted)murder, I suspect that it is highly likely it would be dealt with in the local courts unless there was a specific external push for extradition.
The point of the convention is to ensure there is never no jurisdiction, i.e. the country of registration to the aircraft is always there as the ultimate fallback. The wording doesn't seek to strictly define the jurisdiction, which is why in most cases the delivery country has the option to take jurisdiction.
It depends on which jurisdiction region wants to enforce the law. If someone wants to enforce a law, and it succeed, then the law of that jurisdiction region applies.
> The only downside was that although we broke through the network restrictions and could access any website, the plane’s bandwidth was extremely limited, making web browsing quite painful.
Unfortunately this is also the downside of paying. Many times I have paid for internet, only to find it unusably bad. To be fair, I just flew a transcontinental flight on Air Canada the other day and the wifi was fine.
This is likely another layer of security that they didn't break through:
To prevent chat apps from consuming lots of bandwidth typically your connection is severely bandwidth restricted until you pay. If they didn't then someone could simply stream movies from their chat apps.
I don't think so, compared to transcontinental, which lately (before Starlink) has been using the cell towers on the ground + satellite backhaul -- even paying would probably still result in a garbage experience.
I’ve been the unfortunate one who paid and endured the slow-barely-usable/mostly unusable speeds. However, that was before the Starlink era. So if you’re gonna pay for WiFi, it’s worth checking if the flight is equipped with Starlink.
Yeah, I just flew WestJet from Canada to Honolulu and was amazed; full 1080p YouTube with no hiccups and I was able to play some (non-latency sensitive) online games, all over the Pacific. This was fully intentional; there wasn't any back-of-the-seat iPad for watching movies or anything, they straight up tell you to use your own device and watch Netflix. I did some research after and found a lot of airlines in NA are going to be rolling out satellite internet in the next year or two.
For some reason, being fully connected at 50mbps+ on a plane seems more futuristic sci-fi to me than everything AI.
> This was fully intentional; there wasn't any back-of-the-seat iPad for watching movies or anything, they straight up tell you to use your own device and watch Netflix.
Westjet has required you to use your own device for a long time now (10 years?), but they offer an app/website and streaming library that works for anyone who connects to the in-plane wifi, unrelated to actual access to the internet.
Interesting that they're telling you to use your own streaming app/account now. Did you still have to pay extra for internet access? Was the Westjet streaming app still available?
Nope, wifi was free. Well, have to sign up for WestJet rewards, so the price is your personal data and such. No WestJet streaming option, the information card in the backseat tells you to use your own Netflix account; yes, literally mentioning Netflix by name.
Dan Kaminski popularized this in 2007-8 or so. Not that it didn't exist here and there, but he made the perhaps first public version of a dns tunnel (ozyman). he inspired iodine and others and was a fairly well known guy.
Dan passed away in 2021, rip.
if you search for it its hard to find. his blog is down (hea dead...), and many companies and people talked about it on his behalf to drive traffic (hi duo sec..), so you can see the internet forget, rediscover, and rewrite some history even in a few years.
I haven't used iodine, but this seems simpler. Iodine wraps requests with actual DNS requests. In this case that wasn't needed, because port 53 wasn't filtered at all. So all they needed was a simple proxy on port 53.
iodine automatically checks several modes a "simple" proxy on port 53 being one of them. If you're trying to sneak traffic through this kind of block, it is really the first tool to try.
> Since acwifi.com is accessible but github.com is not, is it possible that the network has imposed restrictions on the DNS server, only resolving domain names within a whitelist (such as instant messaging domains)?
> If this is the case, can I modify /etc/hosts to disguise my server as acwifi.com, so that all request traffic passes through my server before reaching the target website (github.com)?
But by putting the host in /etc/hosts, you're skipping asking the planes DNS server, so how are you "disguising" an external server? And why go through the effort of proxying through acwifi.com instead of going straight to the example of github.com
It could be that they allow any HTTP/HTTPS request that has
Host: acwifi.com
regardless of whether the IP address destination of the request is valid for acwifi.com.
You see these sorts of shenanigans being used to get around country-wide firewalls. Plenty of deep packet inspection is unable to handle edge cases like the "Host:" header being misleading, having it fragmented into two TCP packets, etc. See "domain fronting".
it's extremely unlikely that the plane wifi would be configured that way. trying to use a host file to make github.com respond on acwifi.com was definitely a red herring. It led to figuring out 53 was open, but was definitely not how the filtering was working
Also, this doesn't resolved the non sequitur in the OP. It claims there might be DNS blocking, not deep packet inspection. Also cloudflare has encrypted client hello turned on by default and the only domain that shows up for https connections in this case is cloudflare-ech.com, so if any Cloudflare website is whitelisted it would have to allow this domain, and consequently any other Cloudflare website.
I refuse to believe that anything important for flying the plane is actually hooked up to the system providing Netflix to passengers.
People do get nervous, and in theory you could probably break some kind of informational system utility if you kernel panic the box that booms up to the satellite receiver, but unless you're trying to get root on the plane's routers I don't believe there's a need to feel brave.
The braver part is publishing the results of this stuff online under your own name.
yeah, you're not interfering with anything flying the plane through the IFE system, and it won't be the same bandwidth they use for comms either (there might be some semi-sensitive passenger information stored on the in-flight server, but entirely different techniques would be needed to bypass whatever security that's wrapped in).
But "hacking" on an aircraft isn't going to be looked on particularly sympathetically by courts
I wouldn’t expect that either given the little that I know about the rigorous software requirements for aviation.
But I assume that neither of us has anywhere near enough expertise to “refuse” to believe that any computer/software system could be used in dangerously absurd ways even accidentally.
If you move to an empty seat to prevent WiFi signal strength triangulation, and assuming the cabin has no cameras, you didn't auth to the network with identifiable information, actually encrypt your Xray proxy connection (which OP didn't), and you have MAC randomization on, there's next to no way the airliner would be able (or even care) to identify that you did what was described in the article. Sure, they could use DPI and behavioral analysis to detect you were misusing the network, but if they're doing that, they would just block this sort of "backdoor" from the get-go.
I'll echo the article's disclaimer:
This reply is intended solely for educational and research purposes. I affirm the strict adherence to all relevant regulations and service terms.
I highly doubt any airline staff are on your flight (or even remotely) counter-hacking one in a billion passengers messing around with the in-flight WiFi. That $30.75 they're not getting doesn't justify anyone looking into it.
Plus, the free tier is usually set to a very low QoS such that chat is pretty much the only thing you'd bother doing. Short videos will download in a reasonable amount of time but on average, the actual data rate is small. There's only so much bandwidth available and they want to make the $30 somewhat of a value for those needing full Internet access. One person absolutely saturating the limited bandwidth allowed for the free tier is not going to make much of a difference for everyone else but it could be an issue if everyone was doing it (like if a VPN was all that was required to bypass the restrictions).
I once merely mentioned the words “Heart Attack” on a plane and was kicked off by the flight attendants. No context, they just heard the words and forced me off.
There are things that trigger them because of laws and regulations like mentioning “bomb” (even if you’re describing something fantastic).
So messing with the gogo flight entertainment is up there with flirting with terrorism charges.
I'm pretty "curious" when it comes to public networks. I'll scan coffee shops, stadiums, hotels, bus hotspots, anything I can connect to. Some networks are set up well, others not so much.
I would never in a thousand years run a sweep on an airplane network. That's massively risky, to the point you might never be allowed on a jet again. Anything to do with aviation I am on my absolute best behaviour.
The router is 100% separated from the rest of the plane, and has a fuse on the power. You can't really mess anything up and the only chance of you getting caught is if you somehow manage to ddos the network.
The fun thing to do on the plane is clone the wifi and add an option to log in with google or meta or apple credentials....
Without commenting on the appropriateness of what they did, the author doesn't say they did anything like a sweep. It looks like they were manually poking a few things with dig and ping, not firing up nmap.
Circumventing security on a network, on a plane, is definitely up there regardless if you sweeped or not. IANAL but that could put you in DHS crosshairs.
The exaltation displayed in this discussion thread is something everyone should ponder about. Some stupidity specific to certain era and place on Earth, just another tumour of uncontrolled bureaucracy which always grows, is discussed as some eternal property of God-given Universe.
Hijacked plane is a popular media spectacle with lots of ties to other images and scenes. Millions are ready to discuss it, or listen to the thrilling stories. “This is important for security!” is a shazam in that context. At the same time, much closer and routine dangers directly affecting many people (power plants, refineries, railroads and so on) are kept in check by underpaid workers who can't even make companies fix sensors or replace something until it is rusted through. Effectively, “this is not important for anything”, nor public is interested in TV shows about working pipeline that is not getting blown up. Those who want money and power naturally stick to impressions that work for the crowd they are given.
Propaganda is most successful when people do the required thing on their own, agree that it's absolutely impossible to evade, and even encourage each other. Something in this day and age makes people themselves adore certain forms of propaganda, and even demand to be told specific lies. Among other things, images of stupid social machines crushing someone (“they'll put you on the list”, etc.) seem to weirdly stimulate the crowd.
Even in so-called globalised world there are examples that crack the habituation. In country A, any big gathering of people needs to be formally approved, supplied with hordes of policemen (thankfully, not tanks), fences (thankfully, not barbed wire), entrance searches (thankfully, without stripping). When you ask anyone about that, they promptly respond with “What if terrorists/enemies decide to attack the crowd?” or “What if they start to riot?” (notice that “they”), etc. Even most obvious security theatre acts are automatically accepted with promotion to “psychological stuff that helps to detect those people in the crowd”. In country B, no less “civilised”, the same event is handled by some private company that is mostly worried about portable toilets or electric generators, and people come freely to the venue if they like it (just buy the ticket).
The odds of something wrong happening are roughly the same, but people reason about themselves and those around them very differently. That mental picture of the world shapes the thing that happens, not the alleged expert opinions or calculations.
i appreciated this comment, even though it downplays real pragmatic concerns. from a security perspective, should getting on an airplane (especially for domestic flights) really be all that different from getting on a bus? are the potential outcomes different enough to justify the differences in security measures?
I agree, this sounds a bit too stretched. Or maybe they were looking for any excuse under the sun to get someone off what could have been an overbooked flight. But just saying the two words "heart attack" would not be enough
I had ran to my connecting flight, got on as the doors were about to close up (there were a few people still coming, also running).
I sat down, huffing from the run, I asked the flight attendant for a quick sip of water. I said this:
“Excuse me, sorry to bother you but I just had to run to catch the flight, can I get a sip of water? I’m gonna have a heart attack and die of thirst.” Jokingly but still huffing from the run. The captain heard it. Said a few words to another flight attendant, and off the flight I went.
Hindsight, I shouldn’t have made the comment and should have just gone to the restroom but… lesson learned. Southwest got me on a flight 45 minutes later to get home.
Imagine if anything essential/of value/useful was exposed on the passengers WiFi, this story could have been a huge scoop. But alas, everything is heavily separated.
"All new is something already known, but well forgotten."
Escaping locked down networks by tunneling things over DNS is one of these things. We've used it back in 00's to get out of restrictive hotel networks. Not even WiFi, but the actual wired Ethernet ones.
I have done similar things on several long flights.
Very often, there is at least one large cloud provider or CDN (e.g. Microsoft/Azure or Amazon/AWS or Google/GCP) that is whitelisted by the in-flight Internet gateway so that it can serve static pages, and I
can get access to all the sites hosted by that provider simply by using domain fronting (which the author of this post describes as "disguise domain":
https://ramsayleung.github.io/en/post/2025/a_story_about_byp...)
They may have been throttled/deprioritized but often the plane just has a really high latency connection. Some in-flight internet is provided via geo-stationary satellites, which has a minimum of 250ms latency. Even when a low-earth orbit satellite is used, I expect they are being back-hauled to the WiFi vendors datacenter before going out to the internet.
When your latency gets in the hundreds of ms, no amount of bandwidth is going to make your internet connection feel snappy. And buffer bloat means even a workload that could theoretically saturate a high latency connection may actually get trashed.
On some networks, yes: I used to use a prepay mobile network (= buy a fixed quantity of GBs in advance, use them, once you run out, you get a restricted captive portal where you can buy more, just like on this flight). But all traffic on port 53 was allowed, it didn't need to be actual DNS traffic.
There's even some commercial VPN providers which offer openVPN on port 53.
If they had a ssh server on the remote machine they could have also done something like `ssh -g -ND 53 root@localhost` from the remote machine, which would have exposed a remote-accessible SOCKS proxy on port 53.
Many years ago, some dial-up providers in my city offered free public logins to use their websites (for scratch card activation, account renewal, user guides, and so on). Some companies also paid ISPs to have their sites and services accessible in similar fashion for promotional reasons.
At a certain provider, all those free logins used the same firewall configuration to only allow traffic to those free services and ISP site, probably for simplicity, so all of them were accessible with any promotional login. Most of them were not useful (to me), but different agreements with ISP resulted in different call time limit until hang-up, 10-15 minutes instead of 3-5.
However, the main treasure was the addition of external page translation service as a feature on some big site. Back then, it was strictly static and server-side, URL in request gave you its HTML source with translated text strings and absolute paths to external resources, so in order for translation to work, users needed to be able to access that third party server, too. Obviously, if you gave it any other URL, the server would also grab it to translate (and choosing least similar language in parameters would leave most of the page text intact).
You can imagine that having a browser supporting tabs and switching media off was very handy for loading as many free web pages in text only form as those dial-up sessions allowed.
Obviously, WWW-to-email services for people who only paid for mail server access had existed even before that.
I don't think there are any net neutrality laws that don't exempt things like in-flight Wi-Fi, where the upstream is so heavily restricted that providing balanced services to everyone is basically impossible or leaves the entire connection useless.
With Starlink things may be looking a bit better, but I think demanding net neutrality on in-flight satellite internet and plane-to-cell-tower internet is excessive.
Excellent, thanks! Just took a look at "TCP/IP Illustrated: Volume 1" and was exactly what I was looking for. Any book along those lines that is compressed/water down (just to get started over a weekend)?
>Especially on 12hr flight where it should be provided for free imo.
"Should" in the sense that "everyone should get free food, housing, and healthcare" or that other airlines actually provide it for free? I don't know of any airline that provides it for free, the most is some Asian/Gulf airlines providing "free for 1 hour" or similar. Compared to that, "free texting, unlimited" doesn't seem too bad, considering there are also trans-continental flights with no internet access at all.
On a recent 12h Air New Zealand flight I went on they offered free wifi for everyone. They say you can:
- Browse the web.
- Send and receive emails and messages.
- Check and post to social media
In practice I think they just whitelist a few messenger apps. Everything else was unusable - I couldn't even load this site. Only had my phone so couldn't check if I was actually receiving any bytes from other sites, but it at least wasn't immediately blocked.
> In practice I think they just whitelist a few messenger apps. Everything else was unusable
That was probably intentional, because to the vast majority of the users of these services, 'the web' is just a handful of the same social sites. As long as they can post a few things about their trip, that's the extent of the web access that they need or care to want. Sucks when you're expecting the whole kit and kaboodle, but the airlines seem to know their customers.
"Should" in the sense that they need to provide basic dignity to people on board. Same as toilet and basic necessities like glass of water or very basic meal.
Although "dignity" and modern planes can't be used in the same sentence, unless you pay 5x for business class, passengers are humiliated less there at least.
Following your logic, it will be ok for you if airlines start charging for washrooms, reclining seats, windows or anything on board except just being alive. Why wouldn't you pay for washroom $15/minute + water and toilet paper?
If you had a window seat you could make bank with a starlink mini and undercut the Air Canada by a small amount, like $40 Canadian. Just use pfSense Captive Portal and make sure you forward any port 53 or 853 to the external interface to the local DNS.
> Especially on 12hr flight where it should be provided for free imo
That's junkie talk /s
No but seriously if you think Internet access is so vital that it has to be provided for free on a long-ish flight, you may have a problem. Watch an in-flight movie, read a book, take a nap, look out the window. There are many ways to pass 12 hours.
Lesson for implementers: block all DNS requests from customers unless they are addressed to a onboard DNS cache (whose IP address is supplied by the DHCP response).
Could y'all point at instructions for how to imitate this limited internet situation ?
I ask because, two years ago, I was able to circumvent the Windows-11-requires-internet-and-a-microsoft-account part of the set up for a new laptop computer by doing this on a flight. Apparently, connecting to the airplane wifi (without yet logging in) was enough to satisfy the OS set-up, but limited enough that my laptop didn't require a microsoft account. With windows 10 now end of life, I will probably get a new desktop computer and would like to repeat the feat at home. Thanks
Boot up a router without any ethernet cables hooked up to it. Or turn on tethering on your phone but disable mobile data.
I believe this trick doesn't work on Windows 11 anymore, though. Microsoft will happily wait for you to move some place with internet access to finish the OOBE, especially with upcoming changes where they disable various internal mechanisms to bypass the account restrictions.
For about 30 bucks (or a crack) you get more life out of Windows 10 if switching to Linux isn't an option for you. You'll need to log in to an MS account once every three months to keep that going, but you can log out in between. If you live in the EU, you'll get the first year for free if you just sign in to an MS account, which I believe will also work as long as you sign in once every three months to keep the computer registered for updates.
>Apparently, connecting to the airplane wifi (without yet logging in) was enough to satisfy the OS set-up, but limited enough that it didn't require a microsoft account.
Set up a wifi network with no internet? If you have a separate router/modem, just unplug your modem from your router. If your mode/router is combined unplug the coax/fiber/phone line.
tl;dr: The firewall on the plane allows any traffic to pass on port 53 (to allow for DNS queries) but doesn't do any state inspection or rate limiting so you can do whatever you want on it.
> My roommate spent about an hour setting up a proxy server exposing port 53 using xray 1, and sent me the configuration via WeChat:
An hour!? As opposed to just spinning up an sshd on that port and coming in using ssh -D to establish a local socks proxy?
> Here we exploited a simple cognitive bias: not all services using port 53 are DNS query requests.
Eh, I don’t think this is a result of cognitive bias. I’m sure the people involved in creating whatever hardware or software is running the network know that you can run other stuff on ports. More likely the extra effort involved in inspecting packets was not deemed worth the risk, a decision either made by the manufacturer of the hardware/software, or someone on Air Canada‘s IT team.
> This is likely another layer of security that they didn't break through:
> To prevent chat apps from consuming lots of bandwidth typically your connection is severely bandwidth restricted until you pay. If they didn't then someone could simply stream movies from their chat apps.
Limiting availability of third party services based on local service provider fee can only be done 100% reliably on a service side through an agreement with that provider, i.e. WhatsApp needs to disable certain functions to users coming from certain dedicated links or IP ranges, or even based on live user status metadata. There's an obvious size mismatch, and lack of incentive to implement compartmentalisation only needed for some other company. It also creates enormous shared responsibility and potential circular finger pointing clown shows, all for relatively tiny number of affected paying users.
Therefore, it is either done with least amount of work that is “good enough”, and can be done on a cheapest router (rate limit to the absolute minimum, ban connections to ports 80 and 443, maybe cut the traffic to most stable IP ranges of biggest services, and regular person is going to state that “nothing else works”), or trough very extensive commercial DPI with lots of guessing and ad-hoc rules (if this feature is important for the income, and many will try to game the system). So it's either going to be as simple as in this example, or you'll compete with the global army of detection rule authors.
Though I do like the wink-wink, nudge-nudge choice of proxy software.
FWIW, WhatsApp does (or did) support special price networking. I used to be the engineering side of that. But the supported offerrings were for special priced everything (text+mms+voip) or just text+mms if real time voice and video was not to be special priced. Text only was not a supported offering while I was there. And you needed to be a mobile carrier to get the information about IP ranges (the IP ranges were public but not directly linked early on, but got limited later).
That said, many networks did these sorts of things without communicating with WhatsApp. Even without knowing IP ranges. WA traffic is easy to spot. Chat has a destinctive protocol that's neither http, nor https; mms is https with obvious hostnames in SNI; voip looks like voip.
You might be able to trick in-air wifi by looking like WA chat, but I've never been interested enough to check while on a plane. I'd rather use the time to watch awful movies on a tiny screen with terrible audio conditions.
Planes that use the Panasonic system allow access to the full *.paypal.com domain to allow the paywall to work. If there is a way to somehow proxy all your traffic though something under paypal.com you could get free wifi on certain flight. Or you can pass the time away reading all the paypal API documentation.
Another option would be to setup a wireguard server listening on 53. Wireguard traffic is UDP so it would work even if TCP DNS requests are blocked. And it would also make the client configuration much easier, ie just connect to the wireguard server.
Can someone please explain what project X/Xray is? Judging from the context I imagine it's some sort of proxying software but I can't seem to find out more. The website and github seem to be littered with vague jargon or is in Chinese and Googling brings up something called XTLS?
I remember doing this about twenty years ago when many hotels blocked the internet behind a paywall but were naive in their approaches. I also remember trying this at a hotel in Tokyo about ten years ago and instantly finding my MAC address blacklisted. Their networking folks were clearly more sophisticated.
If a ping to a specific IP times out, I wouldn't say the IP is blocked. It could be that ICMP specifically is blocked, following some network rules on the firewall. This is pretty common in entreprise networks to not allow endpoint discovery. I could be missing something and happy to be corrected here, but I was surprised to read that.
I find it's important to remember, too, that a failed PING tells you nothing other than your echo request did not receive a response. If the remote host received your request, and if it responded, are both things a failed PING can't tell you, because both of those things could be true but you still end up with a failed PING.
I've seen technicians get tripped up in troubleshooting thinking that a failed PING tells them more than it does. When the possibility of asymmetric return paths is involved it's always important to remember how little a failed PING actually tells you.
And that can be a lot more subtle than you might think. I've had a persistent very hard to debug false alarm triggered on pings sometimes not making it and most of the time they did. But very rarely that would happen three times in a row and that was the threshold for raising an alarm. We spent days on this. Finally, the root cause was tracked down to a BNC 'T' connector at the back of a media adapter that filtered out the header of some percentage of ICMP packets. It is one of the weirdest IT problems I've ever encountered and it makes me wonder how much of what we rely on is actually marginal.
> It is one of the weirdest IT problems I've ever encountered and it makes me wonder how much of what we rely on is actually marginal.
Vernor Vinge had a character who was a "Programmer-Archeologist" on a relativistic starship. Feels more and more prescient as time goes on.
I work at a company that invented an internal syntax to compile into C++ code, that still relies on c-shell and conventions taken when OS/2 was in use there, and with a web of Jenkins instances and homemade wrappers and DBs to build that stuff.
I can safely say that title exists already. And I value my current experience as a humbling example of what is to come as software becomes an older industry, and not just a world of startups and their freshest languages/frameworks/tools.
The way you describe this system is exactly how I'd describe a system I worked on in the early 90s at PW (before it was PWC).
jenkins did not exist though
I thought that too up until this GenAI moment, and now I wonder if needing to be an archaeologist will be so valuable if one can get your needs met by a quickly GenAI-written script/program.
> I thought that too up until this GenAI moment, and now I wonder if needing to be an archaeologist will be so valuable if one can get your needs met by a quickly GenAI-written script/program.
I never have actually read those books (though I read some summaries about them, interesting concepts). My understanding is the "programmer-archeologists" basically had an archive of massive quantities of very high-quality software that did pretty much anything you'd want software to do. So it made more sense to find the software you need and glue it together than write from scratch.
And given GenAI doesn't write high quality software (at least not yet, and hopefully never), I don't think that "GenAI-written script/program" would be a good replacement (though an AI archeologist might make more sense, with such an archive).
I've yet to have my needs met by a GenAI-written script/program. Archaeologists tend to be a lot more precise in their statements, especially about what is speculation and what is not.
I mean, if you're willing to accept AI slop, that's fine. But if you're willing to accept AI slop, you'd probably be willing to accept human slop (at least if it claims to be AI) too, and then the job gets a lot easier.
I work on regular web stuff and people already call themselves archeologists when doing routine tasks on our 15 year old codebase.
I feel like an archaeologist working on code I wrote myself 20+ years ago. I can imagine the feeling is stronger when it's somebody else's code.
I'm a SRE and encountered this recently. To prevent DDoS, there is a buffer setting on the kernel that will limit the number of pings (a few settings actually). So if you have a group of machines that all ping a single destination at once, it's very possible to have some that fail to get a reply.
It's for reasons like this that ping is one of the worst protocols to use for aliveness.
Even worse is I've had completely dead Linux boxes that will gladly respond to ping and nothing else.
Oh, that's nasty. How long did it take you to troubleshoot that?
Relatively speaking, it wasn't that bad. It took a few weeks of getting trouble tickets with no root cause, and a bit of googling. But management wasn't okay with fixing the root cause, instead they just increased the timeout/retry window.
Wow. That's a classic. We were quite motivated because we were the ones that got the automated alerts. I still see them in my nightmares: "chopper is down". The machine was called chopper, I'll never forget, it's been close to 30 years. My buddy Jasper and me spent multiple nights trying to track it and when we finally found it we still couldn't believe that that was it. But a simple swap was proof.
Did someone yell for you to "Get to the choppa! Do it! Now!!"?? Please say that's not been wasted!
I think we were past the point of humor during that particular episode but there was a reason it was named like it was.
if it wasn't an Arnie reference, could it have been a Stand By Me reference, "Chopper, sick balls"? or Eric Bana's Chopper: "if you keep stabbing me, I'm gonna die"?
clearly, i'm the type where everything is a movie reference, or it's a missed opportunity
whose chopper is this?
It's Zed's
I've always assumed that in situations like this, a traceroute is better. You can get more information simply by reaching the next stage in the trace, even if you're given zero information beyond "I'm now at the next server".
Nothing says the Time Exceeded packets elicited by your traceroute have to follow the same path back to you that you initiating packets followed out. It's a convenient fiction to think about IP networks acting like circuit-switched networks and in most LAN and small WAN applications they do. Mostly you can get away with thinking that way in more complex networks, too. When you end up in a situation where path asymmetry is causing you grief, thought, it's nice to have the understanding that each datagram can have a unique routing destiny.
Traceroute uses ICMP and can encounter the same problem ping does.
This has come in handy instead -- https://linux.die.net/man/1/tcptraceroute
Disclaimer: not a network engineer but dependent on packets going from A to B.
I had an experience recently setting up a third-party VPN where the echo responses were being delivered to the correct (host,interface) but with the wrong destination address (not the same as made the request)
I’ve had to explain this over and over throughout my career. The only way to know if something is accessible is to try the exact endpoint and protocol. Even application-aware firewalls will mess with things at times.
Yes, you need to test the exact protocol you want to use. This means tcping/curl, TLS with proper certificates and SNI domains, etc.
However, just as you make sure that the power supply actually supplies power before dismantling something that refuses to work down to the last washer, repairing network problems should start with the basics. Simple test that does not work, or shows something nonsensical, is a great hint that you forgot something, or should start digging elsewhere.
Yeah, ICMP tunnelling is also a common bypass method for captive networks, so simply blocking all ICMP seems logical.
Every time I've had to fight with path MTU discovery not working I've cursed the people who block all ICMP, though. If ICMP echo / echo-reply is the problem just block that. At the very least, allow destination unreachable / fragmentation needed thru (type 3, code 4).
I am sure someone will find a way to exfiltrate data using any ICMP type. How good are firewalls at validating the packets are legit?
Most of the people blocking ICMP have no clue that ICMP codes/types even exist.
In my old company it was the oposite. Ping worked allways, even when you where blocked on to a specific VLAN.
I've worked in gigs that wanted that. They were all about segmentation, but wanted ICMP echo / response available throughout.
Edit: I wonder if any "enterprise" firewalls do ICMP echo proxying. Having the firewall replace the payload would remove some of the tunneling capability (thought I assume you could still finagle a side channel by just timing the packets) but would also eliminate some of the utility (since being able to craft the payload provides a way to test for specific bit patterns in packets causing problems).
It’s been years but I’ve likely used NAT to redirect ICMP pings so the local firewall responds rather than whatever boat they were trying to reach.
Systems change - a server that once used to respond to pings may no longer do so, but client software may not be updated to stop doing pings before connecting to the actual service on the server. In an ideal world the client code would be updated, in practice: hello firewall.
> We affirm our strict adherence to all relevant regulations and service terms throughout this project.
Except if you bypassed payment and used the service in a manner that was not intended, most likely you were by definition not undertaking "strict adherance" to service terms ?
Yeah I am a bit confused about posts like this. It’s bragging about breaking the law. There was a particularly bad one a few months ago where a kid had hacked Monster’s employee training site, and was sharing all this internal media in the post. I don’t understand how they don’t end up getting in some seriously annoying trouble with law enforcement. Well I looked it up just now and the post was deleted, I guess maybe he did get in trouble. https://news.ycombinator.com/item?id=44997145
I wouldn't go as far as 'breaking the law', and I agree with the author that the contractual terms ($31 for wifi) are a shitty offer to a captive audience. But I'm also tired of pseudolegalism being employed as figleaf for bragging about the ability to bypass access controls and presumably making everything run a bit slower for all the other passengers (the author mentions that they gave up using it after a while because the bandwidth was so limited).
Yes, long flights are miserable and air travel is a bit of a ripoff. I choose to cope by treating it as an internet break and enjoying a dense book.
Laws penalizing theft of services usually work even if they haven't accounted for the exact manner in which someone might steal the service in question.
The author knew there was a fee for the service; the author devised a way to obtain the service without paying the fee; the author knew this action was not authorized by the service provider.
> breaking the law
Not law per se. More like contractual obligations taken upon by connecting to the flight's WiFi.
Most countries will have laws covering cases of unauthorized access, theft of services, and computer misuse.
The user agreement helps define the service as a paid service with defined access cases. Going around those would put the user in violation of some laws.
An analogy would be showing up to a paid event venue and noticing a back door was left open. Going into the building without paying is not okay, even though you never engaged with the ticket office to agree to anything.
If the user routed all traffic through a WeChat or other messaging service, they would just be using messaging.
I would have had far more positive feelings towards the hack if they had done that - e.g. had their roommate configure a bot to monitor a wechat room and respond to url requests by sending back a webpage. tunneling over DNS feels icky because the reason DNS traffic goes into a separate accounting pool is so that the basic infrastructure of the internet can be kept working smoothly, so this is getting firmly into tragedy of the commons territory.
Intent matters. In US legal jurisdictions that could potentially be prosecuted as a CFAA violation, although I'm not aware of any cases like that yet.
https://www.justice.gov/jm/jm-9-48000-computer-fraud
The U.S. has one of the most overbearing laws in that regard, though. The OP happened on a flight leaving Canada.
> Not law per se. More like contractual obligations taken upon by connecting to the flight's WiFi.
Well, being pedantic, you could be said to be breaking Civil Law. :)
Jest aside, IANAL but most western countries have some sort of Criminal Law relating to mis-use of computers.
A brief search for Canada reveals Criminal Code (R.S.C., 1985, c. C-46)[1].
Again IANAL, but from my reading in this scenario it would be (c) -> (a), "uses or causes to be used ... a computer system" to "obtains, directly or indirectly, any computer service".
[1]https://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1....
Isn't this pretty straightforwardly "theft of service", like "stealing" cable TV service?
If you never clicked "I agree" in the captive portal prompt, and still got free internet via port 53 proxying, could you argue you never broke the contract because you never agreed to the terms? Genuinely curious
I would bet a little bit of money that this is still illegal because you cheated yourself access to a service that is clearly meant to be paid and usually requires agreement (as indicated by the captive portal). Sounds like fraud to me.
As far as I know courts in most jurisdictions are allowed to look at a case in its entirety and that won't look good for you.
A defense like "I thought it was just an config error and couldn't possible imagine that someone would want payment" doesn't sound very plausible to me in particular if it comes from an IT expert who just used sophisticated means to surgically circumvent the block.
In this particular cases of course they confessed the "crime" while bragging about it in their post.
Now what if a random person downloaded an app called "Internet anywhere" from their store and it justed worked? Much muddier because they wouldn't even know it was circumventing anything. For all they know it could be a deal between Air Canada and the app vendor.
This is theft. Stealing is illegal. Giving a blueprint for how you stole is the icing on the prosecutorial cake because you can’t claim lack of knowledge if you create a conspiracy to enable the theft.
This may be the dumbest write up I have ever read.
Theft comes with the connotation of taking someone away from someone and depriving them of their possession.
Using their internet connection without paying is unlicensed usage/illicit access, but nobody is being deprived of it. Mega corps tried, and failed, to get people to think watching a free movie on YouTube was theft. Same logic, very few people agree with the claim.
The nature of the non-transaction was such that they were given access to a service that was constrained in certain ways. They used the service, and the constraints that AC technically applied still applied. They used what was available to them under the constraints and weren't required to pay for any other service but the removal of the constraints. I don't see how any theft occurred.
Likewise illegality is just a boring and simple way to dismiss someone on moral grounds, but laws are only as effective as the level of agreement people have with them. Drinking in the park is technically illegal, but I don't care, the police don't care, nobody cares, unless someone needs to care, and I'm going to do it anyway, because the law does not make drinking in the park inherently wrong, it just provides a framework for telling you to stop if you're interfering with others in a way that relates to alcohol consumption.
Courts don't tend to be impressed by arguments like this. It was made very clear what was being offered and what wasn't, and technical barriers were even put in place. The fact that the barriers weren't foolproof doesn't give carte blanche to bypass them.
I agree more with your second argument, though that tends to be strained when the exploit is published.
> Courts don't tend to be impressed by arguments like this.
This is a court of casual opinions, but incidentally when all Air Canada employees recently went on strike—grounding and/or rescheduling all flights, including my own, and causing plenty of inconvenience—and were quickly ordered back to work by the federal government, basically everyone supported them continuing to refuse to work even though technically it was illegal because the government just decided it was. The government's move ended up backfiring and turned into a negative mark on their record after the employees basically won and everything went back to normal with more equitable pay. The CEO outright said they hadn't planned for the situation in which the employees just said no to the order.
IMO a certain amount of youthful indiscretion that takes the form of challenging systems and structures feels like it's both tolerable and important. Agitation prevents calcification.
Wait till that guy figures out what the hacker in hacker news means
I didn’t see this, but the monster hacker blog post is up on archive. Honestly the person sounds like a kid:
https://web.archive.org/web/20250823174801/https://bobdahack...
I was about to correct you and say that bobdahacker hacked McDonald's, but I guess he did both, and bragged about both.
Could also just be lack of knowledge. Weren't we all a bit more risky and playful with other people's websites when we were kids and the internet was still accessed via modems? Remember talking about that with both other kids and adults without getting in trouble, but it was also decades ago. Once I saw others getting in real big trouble (like prison), then I kind of tried to find more beneficial ways of learning programming and computers.
> Remember talking about that with both other kids and adults without getting in trouble.
A few kids doesnt matter. A few adults is only a problem if it's their stuff (If they are teachers, they will care more about unautorized changes of the wallpaper in the computer of the school that anything in a remote computer.) And yuo can even later claim they misunderstood or you were exagerating.
But here is an in written report in front of thousands of persons and about planes that is a sensitive topic.
> Could also just be lack of knowledge.
Huh ?
DNS tunneling is not exaclty something you do "by accident".
And if the person doing it on the flight "did not know" (which, given the text of the blog, I doubt) , then you can bet your botom dollar that the "roommate" that was summoned for remote assistance knew very well what was going on.
Didn't claim so either, but a lack of knowledge about that it is in fact illegal, hence the parallel to at least my previous experience where I've most surely have committed crimes in the past, because I didn't know it was illegal in the first place.
I don't know the age of the author, but it almost doesn't matter, sometimes people don't know (lack of knowledge).
Come on now. $31 for inflight wifi is a ripoff, but even a 6 year old understands that if there's a price tag it's not an invitation to help yourself.
Say you're on a plane from Canada to Hong Kong (random example), which country's laws would be applicable here? The country where the airplane is registered?
> which country's laws would be applicable here? The country where the airplane is registered?
For all intents and purposes it is the country of registration of the aircraft.
There are one or two exceptions to the rule, but they would not be applicable in this scenario. Mostly stuff relating to air safety. For example, if the aircraft did something against the aviaition laws of the country being overflown. Or hijackings etc.
Same country that would be responsible if you stab your seat neighbor for taking too much space I‘d guess.
> if you stab your seat neighbor for taking too much space
IIRC the way it works is that when you land (destination or forced landing elsewhere) the offender is delivered to the local competent authorities.
They then undertake an initial investigation and decide either to exercise their own jurisdiction or undertake extradition proceedings to send the offender to the country of registration of the aircraft.
In a scenario of (attempted)murder, I suspect that it is highly likely it would be dealt with in the local courts unless there was a specific external push for extradition.
The point of the convention is to ensure there is never no jurisdiction, i.e. the country of registration to the aircraft is always there as the ultimate fallback. The wording doesn't seek to strictly define the jurisdiction, which is why in most cases the delivery country has the option to take jurisdiction.
It depends on which jurisdiction region wants to enforce the law. If someone wants to enforce a law, and it succeed, then the law of that jurisdiction region applies.
Counterpoint: who cares?
Wake me up the first time someone gets into legitimate trouble over a little harmless computer fun like this. Until then..who cares?
> The only downside was that although we broke through the network restrictions and could access any website, the plane’s bandwidth was extremely limited, making web browsing quite painful.
Unfortunately this is also the downside of paying. Many times I have paid for internet, only to find it unusably bad. To be fair, I just flew a transcontinental flight on Air Canada the other day and the wifi was fine.
This is likely another layer of security that they didn't break through:
To prevent chat apps from consuming lots of bandwidth typically your connection is severely bandwidth restricted until you pay. If they didn't then someone could simply stream movies from their chat apps.
I don't think so, compared to transcontinental, which lately (before Starlink) has been using the cell towers on the ground + satellite backhaul -- even paying would probably still result in a garbage experience.
The point is that if the connection does have more bandwidth available they wouldn't get that extra bandwidth without paying.
I’ve been the unfortunate one who paid and endured the slow-barely-usable/mostly unusable speeds. However, that was before the Starlink era. So if you’re gonna pay for WiFi, it’s worth checking if the flight is equipped with Starlink.
Yeah, I just flew WestJet from Canada to Honolulu and was amazed; full 1080p YouTube with no hiccups and I was able to play some (non-latency sensitive) online games, all over the Pacific. This was fully intentional; there wasn't any back-of-the-seat iPad for watching movies or anything, they straight up tell you to use your own device and watch Netflix. I did some research after and found a lot of airlines in NA are going to be rolling out satellite internet in the next year or two.
For some reason, being fully connected at 50mbps+ on a plane seems more futuristic sci-fi to me than everything AI.
> This was fully intentional; there wasn't any back-of-the-seat iPad for watching movies or anything, they straight up tell you to use your own device and watch Netflix.
Westjet has required you to use your own device for a long time now (10 years?), but they offer an app/website and streaming library that works for anyone who connects to the in-plane wifi, unrelated to actual access to the internet.
Interesting that they're telling you to use your own streaming app/account now. Did you still have to pay extra for internet access? Was the Westjet streaming app still available?
Nope, wifi was free. Well, have to sign up for WestJet rewards, so the price is your personal data and such. No WestJet streaming option, the information card in the backseat tells you to use your own Netflix account; yes, literally mentioning Netflix by name.
Do consumer rights exist in the skies? Genuine question!
Cruise ships wait until they get to international waters before allowing gambling.
Maybe planes can offer gambling while over the ocean?
For the exec who pitches this at a board meeting: you're welcome (cries)
Iodine has done this for many years. https://github.com/yarrick/iodine
Dan Kaminski popularized this in 2007-8 or so. Not that it didn't exist here and there, but he made the perhaps first public version of a dns tunnel (ozyman). he inspired iodine and others and was a fairly well known guy.
Dan passed away in 2021, rip.
if you search for it its hard to find. his blog is down (hea dead...), and many companies and people talked about it on his behalf to drive traffic (hi duo sec..), so you can see the internet forget, rediscover, and rewrite some history even in a few years.
I haven't used iodine, but this seems simpler. Iodine wraps requests with actual DNS requests. In this case that wasn't needed, because port 53 wasn't filtered at all. So all they needed was a simple proxy on port 53.
iodine automatically checks several modes a "simple" proxy on port 53 being one of them. If you're trying to sneak traffic through this kind of block, it is really the first tool to try.
Yeah, I was gonna say I've used Iodine to get free Wi-Fi on Delta flights for years at this point.
Does it work well? I've never actually got it to work consistently. Either it works for a very brief period or just not at all.
It worked pretty consistently, but was extremely slow, bordering on unusable.
I didn't really end up using it and just read a book instead, but in theory it does work.
I'm not following the reasoning here:
> Since acwifi.com is accessible but github.com is not, is it possible that the network has imposed restrictions on the DNS server, only resolving domain names within a whitelist (such as instant messaging domains)?
> If this is the case, can I modify /etc/hosts to disguise my server as acwifi.com, so that all request traffic passes through my server before reaching the target website (github.com)?
But by putting the host in /etc/hosts, you're skipping asking the planes DNS server, so how are you "disguising" an external server? And why go through the effort of proxying through acwifi.com instead of going straight to the example of github.com
It could be that they allow any HTTP/HTTPS request that has
regardless of whether the IP address destination of the request is valid for acwifi.com.You see these sorts of shenanigans being used to get around country-wide firewalls. Plenty of deep packet inspection is unable to handle edge cases like the "Host:" header being misleading, having it fragmented into two TCP packets, etc. See "domain fronting".
it's extremely unlikely that the plane wifi would be configured that way. trying to use a host file to make github.com respond on acwifi.com was definitely a red herring. It led to figuring out 53 was open, but was definitely not how the filtering was working
Also, this doesn't resolved the non sequitur in the OP. It claims there might be DNS blocking, not deep packet inspection. Also cloudflare has encrypted client hello turned on by default and the only domain that shows up for https connections in this case is cloudflare-ech.com, so if any Cloudflare website is whitelisted it would have to allow this domain, and consequently any other Cloudflare website.
I feel like you have to be brave messing with a plane's network. People tend to get really touchy when airplanes are involved.
I refuse to believe that anything important for flying the plane is actually hooked up to the system providing Netflix to passengers.
People do get nervous, and in theory you could probably break some kind of informational system utility if you kernel panic the box that booms up to the satellite receiver, but unless you're trying to get root on the plane's routers I don't believe there's a need to feel brave.
The braver part is publishing the results of this stuff online under your own name.
yeah, you're not interfering with anything flying the plane through the IFE system, and it won't be the same bandwidth they use for comms either (there might be some semi-sensitive passenger information stored on the in-flight server, but entirely different techniques would be needed to bypass whatever security that's wrapped in).
But "hacking" on an aircraft isn't going to be looked on particularly sympathetically by courts
I wouldn’t expect that either given the little that I know about the rigorous software requirements for aviation.
But I assume that neither of us has anywhere near enough expertise to “refuse” to believe that any computer/software system could be used in dangerously absurd ways even accidentally.
If you move to an empty seat to prevent WiFi signal strength triangulation, and assuming the cabin has no cameras, you didn't auth to the network with identifiable information, actually encrypt your Xray proxy connection (which OP didn't), and you have MAC randomization on, there's next to no way the airliner would be able (or even care) to identify that you did what was described in the article. Sure, they could use DPI and behavioral analysis to detect you were misusing the network, but if they're doing that, they would just block this sort of "backdoor" from the get-go.
I'll echo the article's disclaimer: This reply is intended solely for educational and research purposes. I affirm the strict adherence to all relevant regulations and service terms.
I highly doubt any airline staff are on your flight (or even remotely) counter-hacking one in a billion passengers messing around with the in-flight WiFi. That $30.75 they're not getting doesn't justify anyone looking into it.
Plus, the free tier is usually set to a very low QoS such that chat is pretty much the only thing you'd bother doing. Short videos will download in a reasonable amount of time but on average, the actual data rate is small. There's only so much bandwidth available and they want to make the $30 somewhat of a value for those needing full Internet access. One person absolutely saturating the limited bandwidth allowed for the free tier is not going to make much of a difference for everyone else but it could be an issue if everyone was doing it (like if a VPN was all that was required to bypass the restrictions).
I was going to say this too.
I once merely mentioned the words “Heart Attack” on a plane and was kicked off by the flight attendants. No context, they just heard the words and forced me off.
There are things that trigger them because of laws and regulations like mentioning “bomb” (even if you’re describing something fantastic).
So messing with the gogo flight entertainment is up there with flirting with terrorism charges.
I'm pretty "curious" when it comes to public networks. I'll scan coffee shops, stadiums, hotels, bus hotspots, anything I can connect to. Some networks are set up well, others not so much.
I would never in a thousand years run a sweep on an airplane network. That's massively risky, to the point you might never be allowed on a jet again. Anything to do with aviation I am on my absolute best behaviour.
The router is 100% separated from the rest of the plane, and has a fuse on the power. You can't really mess anything up and the only chance of you getting caught is if you somehow manage to ddos the network.
The fun thing to do on the plane is clone the wifi and add an option to log in with google or meta or apple credentials....
Without commenting on the appropriateness of what they did, the author doesn't say they did anything like a sweep. It looks like they were manually poking a few things with dig and ping, not firing up nmap.
Circumventing security on a network, on a plane, is definitely up there regardless if you sweeped or not. IANAL but that could put you in DHS crosshairs.
The exaltation displayed in this discussion thread is something everyone should ponder about. Some stupidity specific to certain era and place on Earth, just another tumour of uncontrolled bureaucracy which always grows, is discussed as some eternal property of God-given Universe.
Hijacked plane is a popular media spectacle with lots of ties to other images and scenes. Millions are ready to discuss it, or listen to the thrilling stories. “This is important for security!” is a shazam in that context. At the same time, much closer and routine dangers directly affecting many people (power plants, refineries, railroads and so on) are kept in check by underpaid workers who can't even make companies fix sensors or replace something until it is rusted through. Effectively, “this is not important for anything”, nor public is interested in TV shows about working pipeline that is not getting blown up. Those who want money and power naturally stick to impressions that work for the crowd they are given.
Propaganda is most successful when people do the required thing on their own, agree that it's absolutely impossible to evade, and even encourage each other. Something in this day and age makes people themselves adore certain forms of propaganda, and even demand to be told specific lies. Among other things, images of stupid social machines crushing someone (“they'll put you on the list”, etc.) seem to weirdly stimulate the crowd.
Even in so-called globalised world there are examples that crack the habituation. In country A, any big gathering of people needs to be formally approved, supplied with hordes of policemen (thankfully, not tanks), fences (thankfully, not barbed wire), entrance searches (thankfully, without stripping). When you ask anyone about that, they promptly respond with “What if terrorists/enemies decide to attack the crowd?” or “What if they start to riot?” (notice that “they”), etc. Even most obvious security theatre acts are automatically accepted with promotion to “psychological stuff that helps to detect those people in the crowd”. In country B, no less “civilised”, the same event is handled by some private company that is mostly worried about portable toilets or electric generators, and people come freely to the venue if they like it (just buy the ticket).
The odds of something wrong happening are roughly the same, but people reason about themselves and those around them very differently. That mental picture of the world shapes the thing that happens, not the alleged expert opinions or calculations.
i appreciated this comment, even though it downplays real pragmatic concerns. from a security perspective, should getting on an airplane (especially for domestic flights) really be all that different from getting on a bus? are the potential outcomes different enough to justify the differences in security measures?
I do not buy this.
I was on airplane with large aggressive dog, that was harassing other passengers. I was worried it would ampute my limb mid flight.
I voluntary left before take off, dog stayed!
I agree, this sounds a bit too stretched. Or maybe they were looking for any excuse under the sun to get someone off what could have been an overbooked flight. But just saying the two words "heart attack" would not be enough
> I once merely mentioned the words “Heart Attack” on a plane and was kicked off by the flight attendants.
Well now you have a chance to tell your side - were you merely sitting and just uttered the words "heart attack" for no externally apparent reason?
I had ran to my connecting flight, got on as the doors were about to close up (there were a few people still coming, also running).
I sat down, huffing from the run, I asked the flight attendant for a quick sip of water. I said this:
“Excuse me, sorry to bother you but I just had to run to catch the flight, can I get a sip of water? I’m gonna have a heart attack and die of thirst.” Jokingly but still huffing from the run. The captain heard it. Said a few words to another flight attendant, and off the flight I went.
Hindsight, I shouldn’t have made the comment and should have just gone to the restroom but… lesson learned. Southwest got me on a flight 45 minutes later to get home.
Imagine if anything essential/of value/useful was exposed on the passengers WiFi, this story could have been a huge scoop. But alas, everything is heavily separated.
Brave or stupid.
"All new is something already known, but well forgotten."
Escaping locked down networks by tunneling things over DNS is one of these things. We've used it back in 00's to get out of restrictive hotel networks. Not even WiFi, but the actual wired Ethernet ones.
This isn't even tunneling over DNS. It's literally just a proxy on port 53 which is wide open.
Great writeup.
I have done similar things on several long flights.
Very often, there is at least one large cloud provider or CDN (e.g. Microsoft/Azure or Amazon/AWS or Google/GCP) that is whitelisted by the in-flight Internet gateway so that it can serve static pages, and I can get access to all the sites hosted by that provider simply by using domain fronting (which the author of this post describes as "disguise domain": https://ramsayleung.github.io/en/post/2025/a_story_about_byp...)
I’m guessing the speeds were slow because QOS was limiting the slowed for what was speed to be a chat only connection.
What not just spoof the MAC address of “machine” that has paid.
I had written a utility that monitors MAC address on the network and tries them each until it finds on that is allowed.
Looks like someone released an app to do just that.
https://github.com/t-mullen/wififox
They may have been throttled/deprioritized but often the plane just has a really high latency connection. Some in-flight internet is provided via geo-stationary satellites, which has a minimum of 250ms latency. Even when a low-earth orbit satellite is used, I expect they are being back-hauled to the WiFi vendors datacenter before going out to the internet.
When your latency gets in the hundreds of ms, no amount of bandwidth is going to make your internet connection feel snappy. And buffer bloat means even a workload that could theoretically saturate a high latency connection may actually get trashed.
My question is: would proxying over SSH running on port 53 have worked? Seems simpler than using Xray.
On some networks, yes: I used to use a prepay mobile network (= buy a fixed quantity of GBs in advance, use them, once you run out, you get a restricted captive portal where you can buy more, just like on this flight). But all traffic on port 53 was allowed, it didn't need to be actual DNS traffic.
There's even some commercial VPN providers which offer openVPN on port 53.
If they had a ssh server on the remote machine they could have also done something like `ssh -g -ND 53 root@localhost` from the remote machine, which would have exposed a remote-accessible SOCKS proxy on port 53.
AC offers free WhatsApp, iMessage, messenger in most flights. You can ask meta through WhatsApp to effectively browse the net :)
Many years ago, some dial-up providers in my city offered free public logins to use their websites (for scratch card activation, account renewal, user guides, and so on). Some companies also paid ISPs to have their sites and services accessible in similar fashion for promotional reasons.
At a certain provider, all those free logins used the same firewall configuration to only allow traffic to those free services and ISP site, probably for simplicity, so all of them were accessible with any promotional login. Most of them were not useful (to me), but different agreements with ISP resulted in different call time limit until hang-up, 10-15 minutes instead of 3-5.
However, the main treasure was the addition of external page translation service as a feature on some big site. Back then, it was strictly static and server-side, URL in request gave you its HTML source with translated text strings and absolute paths to external resources, so in order for translation to work, users needed to be able to access that third party server, too. Obviously, if you gave it any other URL, the server would also grab it to translate (and choosing least similar language in parameters would leave most of the page text intact).
You can imagine that having a browser supporting tabs and switching media off was very handy for loading as many free web pages in text only form as those dial-up sessions allowed.
Obviously, WWW-to-email services for people who only paid for mail server access had existed even before that.
Ah "network neutrality", how you won initially yet lost over time...
I don't think there are any net neutrality laws that don't exempt things like in-flight Wi-Fi, where the upstream is so heavily restricted that providing balanced services to everyone is basically impossible or leaves the entire connection useless.
With Starlink things may be looking a bit better, but I think demanding net neutrality on in-flight satellite internet and plane-to-cell-tower internet is excessive.
You can still have a very slow free tier, a normal tier, and a quality video tier. Limited bandwidth is not a good reason to abandon net neutrality.
Now imagine the same restrictions on your home Internet
I mean, if everyone was watching 4k YouTube videos they probably couldn’t support it, right?
Where can i learn to do this kind of things? Any book(s) that'd teach this kind of stuff?
I don't know specifically what skills you're interested in, but this is all pretty much networking fundamentals.
I think I learned most of what I'd need to do this in 'TCP/IP Illustrated: Volume 1'.
There's plenty of "network penetration testing" type books which might also be of interest, though I don't have a specific recommendation here.
There's a wider set of books at https://github.com/jacobian/infosec-engineering that's pretty good too, though it's a wider set of things than this.
Excellent, thanks! Just took a look at "TCP/IP Illustrated: Volume 1" and was exactly what I was looking for. Any book along those lines that is compressed/water down (just to get started over a weekend)?
Why does Air Canada charges $30 for internet, that's brutal. Especially on 12hr flight where it should be provided for free imo.
That's Air Canada. They are already making you a favor by allowing on board.
>Especially on 12hr flight where it should be provided for free imo.
"Should" in the sense that "everyone should get free food, housing, and healthcare" or that other airlines actually provide it for free? I don't know of any airline that provides it for free, the most is some Asian/Gulf airlines providing "free for 1 hour" or similar. Compared to that, "free texting, unlimited" doesn't seem too bad, considering there are also trans-continental flights with no internet access at all.
On a recent 12h Air New Zealand flight I went on they offered free wifi for everyone. They say you can:
- Browse the web.
- Send and receive emails and messages.
- Check and post to social media
In practice I think they just whitelist a few messenger apps. Everything else was unusable - I couldn't even load this site. Only had my phone so couldn't check if I was actually receiving any bytes from other sites, but it at least wasn't immediately blocked.
> - Browse the web.
> - Check and post to social media
> In practice I think they just whitelist a few messenger apps. Everything else was unusable
That was probably intentional, because to the vast majority of the users of these services, 'the web' is just a handful of the same social sites. As long as they can post a few things about their trip, that's the extent of the web access that they need or care to want. Sucks when you're expecting the whole kit and kaboodle, but the airlines seem to know their customers.
"Should" in the sense that they need to provide basic dignity to people on board. Same as toilet and basic necessities like glass of water or very basic meal.
Although "dignity" and modern planes can't be used in the same sentence, unless you pay 5x for business class, passengers are humiliated less there at least.
You feel a loss of dignity if you can’t connect to the internet for a few hours for free? But are too cheap to negate that loss for $31?
Following your logic, it will be ok for you if airlines start charging for washrooms, reclining seats, windows or anything on board except just being alive. Why wouldn't you pay for washroom $15/minute + water and toilet paper?
i’ll take that as a yes.
What do you take? I probably need to take it too, to tolerate abysmal service from airlines and airports.
If you had a window seat you could make bank with a starlink mini and undercut the Air Canada by a small amount, like $40 Canadian. Just use pfSense Captive Portal and make sure you forward any port 53 or 853 to the external interface to the local DNS.
> Especially on 12hr flight where it should be provided for free imo
That's junkie talk /s
No but seriously if you think Internet access is so vital that it has to be provided for free on a long-ish flight, you may have a problem. Watch an in-flight movie, read a book, take a nap, look out the window. There are many ways to pass 12 hours.
> look out the window
They took even this basic pleasure. On B787 flights crew forcibly dim windows for the whole flight. I guess it will be paid feature soon.
This was a thing back in the days too. You’d use a tool like iodine to tunnel ip through dns queries. Fun!
Lesson for implementers: block all DNS requests from customers unless they are addressed to a onboard DNS cache (whose IP address is supplied by the DHCP response).
I wonder if they heavily throttle traffic on port 53, so DNS works, but this kind of exploit isn't particularly useful.
Could y'all point at instructions for how to imitate this limited internet situation ?
I ask because, two years ago, I was able to circumvent the Windows-11-requires-internet-and-a-microsoft-account part of the set up for a new laptop computer by doing this on a flight. Apparently, connecting to the airplane wifi (without yet logging in) was enough to satisfy the OS set-up, but limited enough that my laptop didn't require a microsoft account. With windows 10 now end of life, I will probably get a new desktop computer and would like to repeat the feat at home. Thanks
Boot up a router without any ethernet cables hooked up to it. Or turn on tethering on your phone but disable mobile data.
I believe this trick doesn't work on Windows 11 anymore, though. Microsoft will happily wait for you to move some place with internet access to finish the OOBE, especially with upcoming changes where they disable various internal mechanisms to bypass the account restrictions.
For about 30 bucks (or a crack) you get more life out of Windows 10 if switching to Linux isn't an option for you. You'll need to log in to an MS account once every three months to keep that going, but you can log out in between. If you live in the EU, you'll get the first year for free if you just sign in to an MS account, which I believe will also work as long as you sign in once every three months to keep the computer registered for updates.
>Apparently, connecting to the airplane wifi (without yet logging in) was enough to satisfy the OS set-up, but limited enough that it didn't require a microsoft account.
Set up a wifi network with no internet? If you have a separate router/modem, just unplug your modem from your router. If your mode/router is combined unplug the coax/fiber/phone line.
Why is there an in-flight internet bypass blog post every year, but they never mention Iodine?
tl;dr: The firewall on the plane allows any traffic to pass on port 53 (to allow for DNS queries) but doesn't do any state inspection or rate limiting so you can do whatever you want on it.
> My roommate spent about an hour setting up a proxy server exposing port 53 using xray 1, and sent me the configuration via WeChat:
An hour!? As opposed to just spinning up an sshd on that port and coming in using ssh -D to establish a local socks proxy?
> Here we exploited a simple cognitive bias: not all services using port 53 are DNS query requests.
Eh, I don’t think this is a result of cognitive bias. I’m sure the people involved in creating whatever hardware or software is running the network know that you can run other stuff on ports. More likely the extra effort involved in inspecting packets was not deemed worth the risk, a decision either made by the manufacturer of the hardware/software, or someone on Air Canada‘s IT team.
To quote https://news.ycombinator.com/item?id=45537828
> This is likely another layer of security that they didn't break through:
> To prevent chat apps from consuming lots of bandwidth typically your connection is severely bandwidth restricted until you pay. If they didn't then someone could simply stream movies from their chat apps.
Limiting availability of third party services based on local service provider fee can only be done 100% reliably on a service side through an agreement with that provider, i.e. WhatsApp needs to disable certain functions to users coming from certain dedicated links or IP ranges, or even based on live user status metadata. There's an obvious size mismatch, and lack of incentive to implement compartmentalisation only needed for some other company. It also creates enormous shared responsibility and potential circular finger pointing clown shows, all for relatively tiny number of affected paying users.
Therefore, it is either done with least amount of work that is “good enough”, and can be done on a cheapest router (rate limit to the absolute minimum, ban connections to ports 80 and 443, maybe cut the traffic to most stable IP ranges of biggest services, and regular person is going to state that “nothing else works”), or trough very extensive commercial DPI with lots of guessing and ad-hoc rules (if this feature is important for the income, and many will try to game the system). So it's either going to be as simple as in this example, or you'll compete with the global army of detection rule authors.
Though I do like the wink-wink, nudge-nudge choice of proxy software.
FWIW, WhatsApp does (or did) support special price networking. I used to be the engineering side of that. But the supported offerrings were for special priced everything (text+mms+voip) or just text+mms if real time voice and video was not to be special priced. Text only was not a supported offering while I was there. And you needed to be a mobile carrier to get the information about IP ranges (the IP ranges were public but not directly linked early on, but got limited later).
That said, many networks did these sorts of things without communicating with WhatsApp. Even without knowing IP ranges. WA traffic is easy to spot. Chat has a destinctive protocol that's neither http, nor https; mms is https with obvious hostnames in SNI; voip looks like voip.
You might be able to trick in-air wifi by looking like WA chat, but I've never been interested enough to check while on a plane. I'd rather use the time to watch awful movies on a tiny screen with terrible audio conditions.
Planes that use the Panasonic system allow access to the full *.paypal.com domain to allow the paywall to work. If there is a way to somehow proxy all your traffic though something under paypal.com you could get free wifi on certain flight. Or you can pass the time away reading all the paypal API documentation.
Another option would be to setup a wireguard server listening on 53. Wireguard traffic is UDP so it would work even if TCP DNS requests are blocked. And it would also make the client configuration much easier, ie just connect to the wireguard server.
Can someone please explain what project X/Xray is? Judging from the context I imagine it's some sort of proxying software but I can't seem to find out more. The website and github seem to be littered with vague jargon or is in Chinese and Googling brings up something called XTLS?
It's a system for steganographic traffic proxying plugins that evade advanced detection systems. https://github.com/XTLS/Xray-examples
Chinese, Russian and Persian links could've given you a hint. Though after recent developments in Britain, I'm sure English docs will also appear.
[dead]
[dead]
tldr; the wifi's access restrictions still allowed DNS so they set up a vpn on the dns port
I remember doing this about twenty years ago when many hotels blocked the internet behind a paywall but were naive in their approaches. I also remember trying this at a hotel in Tokyo about ten years ago and instantly finding my MAC address blacklisted. Their networking folks were clearly more sophisticated.
I never understood the need to post about this. Just pay the $30 or just keep quiet so others can continue to browse for free.