How I hacked Gogo inflight wireless Internet with Chrome

http://blog.andrewboni.com/how-i-hacked-gogo-inflight-wireless-internet-with-chrome/

by jetcom • 14 years ago

32 86 14 years ago

blog.andrewboni.com

On a flight to a conference we once set up our own wifi hotspot using two laptops.

We had one company gogo subscription. They connected and shared their internet through ethernet to another laptop. That laptop shared it out through wi-fi. We had 4 people using the Internet. It was awesome but fairly impractical. At least I could tweet from the clouds.

alttab• 14 years ago

Really clever. Also really stupid to post it on the internet. I hope nothing bad comes your way because of it.

patio113• 14 years ago

Issue spotter: I think we've got him on trespass to a protected computer system used in interstate commerce, common law fraud, and theft of services. What other crimes did he just admit to that I missed? (We'll ignore that he hacked a computer while on an airplane, a detail which I would not expect the government to be neutral about.)

Seriously, kids: this is an astoundingly bad idea.

ihavebeenseen• 14 years ago

I am guessing Google will be upset with him too when they get wind of this.

fiatmoney3• 14 years ago

I'm not seeing how this is at all legally problematic. AFAICT there's no TOS violation, and if there were, TOS violations don't make it a crime. The user agent is totally discretionary on the part of the browser and price-discriminating based on one is in no way an access control mechanism.

It seems equivalent to saying "red computers get charged half price", and then objecting when someone snaps a red shell on their laptop.

patio113• 14 years ago

Do you want me to start quoting Title 18 U.S.C Section 1030 (the Computer Fraud and Abuse Act) or can you Google it yourself? There is no possible reading of these facts that does not run afoul of that law, among others.

There is no affirmative defense "But it was really easy for me to exceed my authorized privileges because their security sucked" provided for in the law.

jahewson7• 14 years ago

While it is not mentioned in the ToS, the pricing varies based on what device you have (this is stated elsewhere). This guy has a laptop and is claiming that it's a phone - a deception made for personal gain - a.k.a fraud.

alexmunroe• 14 years ago

As far as I can see he's done absolutely nothing illegal, immoral maybe depending on your view on the matter. It's rather like totally trusting client side javascript for authentication, unless you check that the data being received is accurate then you'll never be able to stop this. It's a simple case of trusting the client. I would imagine that should the submitted have been running an Android Development Image on his system and access via a browser on that the effect would be the same.

sp332• 14 years ago

Intentionally misrepresenting the situation to get a better deal is called fraud.

lowboy16• 14 years ago

Assuming this isn't a troll post:

1) He didn't trespass on a protected computer system or hack anything - he's using a web browser.

2) Users are not required to leave their browser's default settings intact when interacting with websites.

3) Where are the theft of services? He paid for a wifi internet connection for the duration of the flight with a price he was offered. He could have just as easily paid using his phone and then tethered his laptop to it.

flatline33• 14 years ago

I think that's a stretch. Here's another example:

A certain airline offers upgrades to first class seating, but only within a certain time period before the flight.

When using their website, I realized that I could pass in the time constraint as a parameter to their webapp. Boom, cheap first class upgrade, at any time!

Is that stealing? Yes. At the very least, theft of service. That first class ticket can sell for thousands of dollars, and instead, this trick would have allowed me to get it for hundreds. Just because their webapp allowed it doesn't make it OK. It's no different than tricking someone at the counter into giving you an item for free, or giving you extra change.

drivebyacct2• 14 years ago

So what if I paid for it and used my USB tether?

Am I committing fraud? Violating the TOS maybe? Both?

masonhensley• 14 years ago

I glanced at the first two screenshots before I read the article and thought he was just going to create a wifi hotspot off his phone... that way he could get internet on both devices for the mobile price.

enigmabomb• 14 years ago

I understand the proof of concept is cool, but why do this? High speed Internet at 35k feet isn't worth $15 to you? You said yourself it was going to be a long flight. Why hussle them out of what is one beer on a plane?

pkill172• 14 years ago

It's basic capitalism; if this "vulnerability" wasn't built into their code, would you submit to a more expensive price on your laptop when you could just as easily get half off (for the same product) on your phone?

If there were no 'hack', and I went on that plane knowing full well that I was going to purchase internet access, I would buy the half-off solution and tether to my phone.

As a user, this is a valid set of decisions. Since they're implementing this in a stupid way, it's perfectly valid to exploit their method and pay for the cheaper item.

If you went to the supermarket and found an item at $10, but you had the option of doing 5 jumping jacks to lower the price to $5, what would you do? Is it immoral to do jumping jacks?

majormajor3• 14 years ago

"Since they're implementing this in a stupid way, it's perfectly valid to exploit their method[...]"

Really?

If you went to buy something on Amazon, and found they had a "stupid" vulnerability you could exploit in order to get half off of your order—maybe some Javascript hack that made the part of their system that calculated the price you pay think you actually ordered a smaller version of the product—is that immoral?

Is leaving your house or car unlocked a sufficiently stupid vulnerability to become "perfectly valid to exploit"?

nrb• 14 years ago

Aren't they hustling you for $10-16 for a few hours of internet access? There is no marginal cost difference between a phone and a tablet or laptop, and that marginal cost is likely VERY low relative to the asking price to begin with.

This is preying on the notion that you "should" have to pay more for a laptop vs a phone access because that's what people have been conditioned to accept from their wireless carrier.

swdunlop• 14 years ago

Not sure what's less impressive. A pricing model based on browser headers, or a 10,000 word article on "hacking gogo inflight" based on changing a browser header.

ajross• 14 years ago

Indeed. I clicked this expecting to find an interesting description of a authentication vulnerability, or a novel way to spoof, or a hidden tunnel, or something.

tl;dr: GoGo implements price discrimination in a naive way. Author "hacks" it with equally naive mechanism to save $8US.

jonny_eh• 14 years ago

You can get internet on a flight?! We live in the future!

Oh, it's $15? Nevermind.

shimsham3• 14 years ago

Never mind, you can order a $20 Pepsi.

butner• 14 years ago

GoGo sucks. Their service has been unusable on recent SFO/JFK flights. At $18 a pop, you can't even get the google home page to respond. What a joke of a company...

southphillyman• 14 years ago

I'm flying to san fran from the east coast next week and specifically booked a Gogo flight in order to get work done by mile high. I saw the pricing structure on the airlines website though and I agree that it's shady. Where I'm from the law of Shade for Shade applies, shall try your method.

slewis• 14 years ago

Discuss: How do you feel about Gogo's pricing model? According to this article they charge $9.95 if they detect you're on mobile. $15.95 otherwise.

arnarbi• 14 years ago

TL;DR: Wifi was cheaper for mobile so he changed the User-Agent header.

raverbashing• 14 years ago

Should have tried the Lynx user agent

saturn7• 14 years ago

Would it be illegal to connect to the internet with your phone (pay mobile price) then tether your phone to your laptop?

JonnieCache• 14 years ago

This is unbelievably lame. The whole thing could have been related in under 100 words. Plus he is defrauding a perfectly legitimate service. $15 is not a ripoff. This isn't the MPAA.

It would have been acceptable if the author was 13 or something but they appear to be an adult who works for google.

What next, spoofing referer to get into porn sites? l33t d00d!

jtokoph• 14 years ago

From September 2010: http://lifehacker.com/5650175/how-to-get-cheap-or-free-in+fl...

shimsham3• 14 years ago

This explains why the Internet is more expensive everyday. I shall hack my mobile so it presents as a desktop browser so I can pay full price. Every little bit helps.

Oh, and what a seriously lame article in almost every respect. Awesome interface etc etc. This was the gentle reminder I needed to push me from these mind-numbing articles. Good luck and good night.

How I hacked Gogo inflight wireless Internet with Chrome

Related Stories