Hotel WiFi JavaScript Injection (2012)

https://justinsomnia.org/2012/04/hotel-wifi-javascript-injection/

by redbell • 2 years ago

89 71 2 years ago

jraph2• 2 years ago

Surely we are past this bullshit now thanks to https being everywhere?

Also this is our reminder that yes, HTTPS is worth it even for "It's just my blog, I have nothing to hide, why should I encrypt?"

dosinga• 2 years ago

Agreed. It's interesting to see though in the comments that all the links there are http:// even the ones that are to security posts

olabyne• 2 years ago

The comments are from 2012.

vaylian2• 2 years ago

Surely we are past this bullshit now thanks to https being everywhere?

Plenty of hotels (and other places) misdirect your DNS queries so that your machine will connect to the hotel's captive portal where you need to accept the terms and conditions for using the wifi. This causes HTTPS connections to fail. Captive portals are a rather inelegant hack, but in most cases they achieve what they are designed to achieve.

red_admiral4• 2 years ago

But once you're past the portal (even if you need to manually load example.com so you actually see it without hitting cert pinning errors), TLS gives you back the "can't touch this" you want.

labcomputer2• 2 years ago

Plenty of hotels (and other places) misdirect your DNS queries so that your machine will connect to the hotel's captive portal where you need to accept the terms and conditions for using the wifi.

And for all the whining about how "but DNSSEC doesn't do anything!", this is exactly an attack scenario which DNSSEC protects, and which it has protected since the very first RFC describing it. The client can check for itself whether the IP address in the response has been correctly signed by the (sub-)domain owner (and recursively whether the (sub-)domain has been signed by the parent domain, all the way back to the root).

As for "but how will I redirect hosts to my captive portal?", that's what DHCP option 114, DHCPv6 option 103 and IPv6 Router Advertisement option 37 are for. https://developer.apple.com/news/?id=q78sq5rv

stuff4ben• 2 years ago

I remember when this stuff was happening. It was like the world shifted over to HTTPS instantly. Wish we could do the same for IPv6.

OkayPhysicist• 2 years ago

It basically did. Cloudflare rolled out a free feature to enable HTTPS support on every site they served via (not unchecking? Don't remember the opt-in/opt-out detail) a checkbox in 2014, and less than a year later Let's Encrypt became available. Only a couple years later in 2018, Chrome and Firefox started marking non-http sites as "unsafe".

ramon156• 2 years ago

You'd be surprised how many hotels can't be bothered

bongodongobob2• 2 years ago

I wouldn't be surprised at all. It's not like they've got on-site IT support. Split off a guest network on its own VLAN and done, never to be touched again. The less complicated the better.

kevincox• 2 years ago

I've long wondered if there was a place for a httpv mode. Where traffic is signed but not encrypted. This would allow local caching or torrent-like distributed fetching but not modification.

The obvious downside is that the page contents are not private.

Chrome implemented something sort of like this with https://developer.chrome.com/blog/signed-exchanges. However this is very limited. It requires the linking site to cooperate. For example Google Search can link to a signed exchange rather than the original site. But this just moves traffic from the site's CDN to Google's. It also packages full bundles so shared resources need to be duplicated. Also any navigation inside that site will go to the origin and can't be cached.

Overall it seems like it probably isn't worth it. But I find it an interesting idea.

Jerrrry2• 2 years ago

This is awesome.

Propose an RFC - seriously.

This simplifies, democratizes, and makes transparent the "internal resource sharing/caching" that some browsers can do, like when needing to load the latest jQuery for the 15th time in the last minute, even across domains.

Also would be perfect for captive portals, or other static LAN content.

bcye• 2 years ago

What's the downside of HTTPS that you'd want to remove the encryption feature?

kevin_thibedeau• 2 years ago

You could do it today with TLS_RSA_WITH_NULL_SHA if null ciphers were still supported.

spacebanana73• 2 years ago

Is it possible for this to happen today with SMTP?

Email supports HTML/CSS/JS and is sent over plaintext, so shouldn't the same kind of injection vulnerability exist?

vaylian2• 2 years ago

and is sent over plaintext

No longer true.

orev• 2 years ago

It is absolutely true that SMTP can be sent over plaintext. Many mail systems have opportunistic use of TLS, but they can fall back to plaintext if that’s not available. A few mail systems require TLS, at the risk of not being able to receive messages (and the big boss yelling about it).

A blanket statement that all email is encrypted is just plain false.

red_admiral4• 2 years ago

Not over TLS, which you really should be using in this day and age.

wiml• 2 years ago

Some Cisco routers have/had a feature where they'd mitm every smtp connection and snip out the STARTTLS advertisement to prevent negotiation of an encrypted connection. Of course this doesn't affect port 465 use, but port 25/587 can get silently downgraded.

labcomputer2• 2 years ago

Yes, but:

1. On today's internet, the sender's mail server almost always talks directly to the receiver's mail server anyway, both so that random intermediate servers don't see the message and (mostly) as a spam mitigation measure.

2. That MX-to-MX connection will usually happen over TLS, which is encrypted.

3. Almost always, the clients will connect to their respective mail servers over an encrypted connection.

So in practice that kind of injection isn't really feasible.

red_admiral4• 2 years ago

If only there were some kind of way to serve HTTP over a secure connection.

Maybe even with some kind of certification authority scheme to prevent the RXG from spoofing the domain.

rmetzler• 2 years ago

According to Wikipedia Let’s Encrypt was started in September 2015.

They did some great work!

https://en.m.wikipedia.org/wiki/Let%27s_Encrypt

isaacfrond2• 2 years ago

Problem is solved with using a VPN, no?

the_snooze• 2 years ago

Widespread TLS/HTTPS adoption is sufficient.

tuetuopay• 2 years ago

I can't fathom this addiction for VPN for "security". Nowadays almost every website uses HTTPS and browsers block HTTP downgrades most of the times. Yes VPNs are still useful for the occasional HTTP website, however most people will use some form of free VPN that could totally do the same.

But yes, VPNs did solve this issue at the time of writing, and I even used one for quite long as my mobile carrier used to proxy all images through their own servers, as well as intercepting port 21. They stopped doing the former with the advent of HTTPS. To my knowledge they did not use this for nefarious purposes (they served downscaled images for lighter browsing at a time where 3G was frugal and websites not optimized yet for mobile).

belthesar• 2 years ago

You can thank the pervasive advertising of services like NordVPN and their owned subsidiaries for that. Loads of people have been advertised to thinking that using a VPN is "more secure", but this new colloquial understanding of a VPN is quite different from the true definition. I've had to have talks with numerous friends and colleagues dissuading them from purchasing these, including saving someone from a multi-hundred dollar NordVPN subscription because they wanted to be more "secure".

As an aside, viewing an HTTP website over VPN is indeed useful when the threat actor is the public WiFi provider, but it doesn't if your threat actor is the VPN provider, or in between the VPN provider and the hosting provider. I'll cede that this is beyond the scope of the situation talked about in the article though.

cortesoft• 2 years ago

Or just TLS

theamk• 2 years ago

I am surprised the person was surprised. I was using a lot of coffee shop WiFi in 2010's and earlier, and random injection was fairly common. Sometimes generic ads, sometimes timers ("You get free wifi for 1 hour, you have 42 minutes remaining"), sometimes ads for the coffee shop itself.

vzaliva• 2 years ago

The question is: how widespread is it in 2024?

P.S. I am always using a VPN on Hotel/Cafe WiFi.

sargun• 2 years ago

Far less due to TLS being ubiquitous

bosch_mind2• 2 years ago

Anything you can do at the network level that can MITM in 2024 for TLS without the client needing a custom cert? I assume no, but curious anyway

ivan888• 2 years ago

I think this is still possible with access points that require installing and trusting a custom certificate. The example in my mind is WeWork's WiFi

gwbas1c2• 2 years ago

This is why I make sure my personal blog redirects to https, and why I typically install things like "https everywhere" browser extensions.

I know this kind of stuff happens, and I don't want to waste time tracking it down and shaming people for doing it.

ctm92• 2 years ago

In 2012 HTTPS was only common on websites that actually processed sensitive information like online shops and banks. Most websites/BBs (even with logins) didn't use HTTPS as it required you to buy a certificate. Lets Encrypt was not around back then

gwbas1c2• 2 years ago

I know, for the longest time my hosting provider "claimed" I needed a static IP in order to have https.

It wasn't until there was a bigger push that they "realized" that https doesn't require a static IP.

kube-system• 2 years ago

What bugs me about their response is that the device required to do this type of on-the-fly JavaScript injection of HTML is both rare and expensive. It requires specialized hardware (like the RG Nets’ RXG-A8) starting at a cost of $10,000. In other words, this hardware was procured precisely for the purpose of perpetrating this kind of attack. If Courtyard/Marriott/Hotel Internet Services didn’t want that feature, then they probably could have requisitioned cheaper, less specialized, and more robust networking hardware.

It looks like the device is a router and gateway for institutional networks, with features like captive portal, registration integration, etc. It isn't a dedicated JS injection device. While you can do that stuff on the cheap, $10k isn't unreasonable for networking gear with more special use-cases. The contractor likely just flipped that option on just to make a few extra bucks.

paul79862• 2 years ago

Anyone else sick of having your 4G/5G ATT, T-Mobile or Verizon service blocked when inside a hotel, a concert venue to even a small town (National Harbor DC .. a lot of businesses block your service) all so the business and or businesses around you force you to use a their Wi-fi network; collect and make money off your data. How is that even legal??

My examples in The Flamingo Hotel in Vegas you have to connect to their wi-fi while inside the hotel. Forget about trying to work remotely there and use your 5G mobile hotspot.

At the Keseya Center in Miami ... at a recent concert there they had gates with ticket takers way out of from the front of the door. You walk up to them and they say get your ticket ready and you try but nope your ATT/TMobile/etc service is blocked you can only access getting your tickets via connecting to their wifi. My 5G worked fine until i got close to those non-ticket takers who prodded me to connected to the venue's wi-fi.

National Harbor (just outside of DC) .. inside the gaylord hotel and more so inside Burger Fi and others close by both my friend's Verizon and my ATT with full bars were blocked .. had to connect to their wifi.

Total B.S. and this stuff needs to be outlawed!!! I pay for service and if its readily available (full bars) I better have access or your paying me for time you are blocking me from using it.

bongodongobob2• 2 years ago

They aren't blocking cell data intentionally, that's extremely illegal. That's just how big buildings work dude.

flurdy• 2 years ago

And with a lot of people in one place connecting to the same cell tower that cannot reliably handle that many.

LeoPanthera2• 2 years ago

service blocked when inside a hotel

Can you prove this claim? It's literally illegal, and I don't believe it actually happens. There's a difference between active jamming and "our building is made of metal".

paul79862• 2 years ago

Umm it was something hotel were actively doing https://www.google.com/search?client=firefox-b-1-e&q=fcc+hot... ... you don't think some are still doing so using the whole it's a big building issue argument along the way.

Also why when walking right up to those gates at the Keseya center outside and still outside getting right up to the gate to speak to the attendant did my service with full bars suddenly not work?

It maybe illegal but what are the profits reaped vs the potential fines?

Im usually downvoted for things I say (im sure you dont care to read all my thoughts all over the years on HN) but a LOT of them come true ... most recently about how much i hated Cruise cause they were startup bros trying to do the whole fake it before you make it with technology that can kills..fortunately it didnt kill anyone just unfortunately mangled a pedestrian. Let's see in a year if places start getting fined for this B.S.!

LeoPanthera2• 2 years ago

Virtually all those search results are about wifi blockers, not cellular blockers, apart from one random unproven claim on Reddit.

Blocking wifi is also illegal, and you will see from your own link that the FCC did fine hotels that were doing it.

awad• 2 years ago

On top of all the illegality involved in signal jamming....in fairness, AT&T signal in Miami is pretty awful no matter where you go IME

darkhorn• 2 years ago

Add your web site to https://hstspreload.org . Problem will be solved.

Hotel WiFi JavaScript Injection (2012)

Related Stories