[HN Gopher] A story about bypassing air Canada's in-flight netwo...
___________________________________________________________________
A story about bypassing air Canada's in-flight network restrictions
Author : samray
Score : 165 points
Date : 2025-10-10 07:50 UTC (15 hours ago)
(HTM) web link (ramsayleung.github.io)
(TXT) w3m dump (ramsayleung.github.io)
| 4rt wrote:
| tldr; the wifi's access restrictions still allowed DNS so they
| set up a vpn on the dns port
| technothrasher wrote:
| I remember doing this about twenty years ago when many hotels
| blocked the internet behind a paywall but were naive in their
| approaches. I also remember trying this at a hotel in Tokyo
| about ten years ago and instantly finding my MAC address
| blacklisted. Their networking folks were clearly more
| sophisticated.
| roygbiv2 wrote:
| Iodine has done this for many years.
| https://github.com/yarrick/iodine
| BehindTheMath wrote:
| I haven't used iodine, but this seems simpler. Iodine wraps
| requests with actual DNS requests. In this case that wasn't
| needed, because port 53 wasn't filtered at all. So all they
| needed was a simple proxy on port 53.
| krautsauer wrote:
| iodine automatically checks several modes a "simple" proxy on
| port 53 being one of them. If you're trying to sneak traffic
| through this kind of block, it is really the first tool to
| try.
| kangs wrote:
| Dan Kaminski popularized this in 2007-8 or so. Not that it
| didn't exist here and there, but he made the perhaps first
| public version of a dns tunnel (ozyman). he inspired iodine and
| others and was a fairly well known guy.
|
| Dan passed away in 2021, rip.
|
| if you search for it its hard to find. his blog is down (hea
| dead...), and many companies and people talked about it on his
| behalf to drive traffic (hi duo sec..), so you can see the
| internet forget, rediscover, and rewrite some history even in a
| few years.
| DaSHacka wrote:
| Yeah, I was gonna say I've used Iodine to get free Wi-Fi on
| Delta flights for years at this point.
| traceroute66 wrote:
| > We affirm our strict adherence to all relevant regulations and
| service terms throughout this project.
|
| Except if you bypassed payment and used the service in a manner
| that was not intended, most likely you were by definition not
| undertaking "strict adherance" to service terms ?
| VladVladikoff wrote:
| Yeah I am a bit confused about posts like this. It's bragging
| about breaking the law. There was a particularly bad one a few
| months ago where a kid had hacked Monster's employee training
| site, and was sharing all this internal media in the post. I
| don't understand how they don't end up getting in some
| seriously annoying trouble with law enforcement. Well I looked
| it up just now and the post was deleted, I guess maybe he did
| get in trouble. https://news.ycombinator.com/item?id=44997145
| CaptainOfCoit wrote:
| Could also just be lack of knowledge. Weren't we all a bit
| more risky and playful with other people's websites when we
| were kids and the internet was still accessed via modems?
| Remember talking about that with both other kids and adults
| without getting in trouble, but it was also decades ago. Once
| I saw others getting in real big trouble (like prison), then
| I kind of tried to find more beneficial ways of learning
| programming and computers.
| traceroute66 wrote:
| > Could also just be lack of knowledge.
|
| Huh ?
|
| DNS tunneling is not exaclty something you do "by
| accident".
|
| And if the person doing it on the flight "did not know"
| (which, given the text of the blog, I doubt) , then you can
| bet your botom dollar that the "roommate" that was summoned
| for remote assistance knew very well what was going on.
| CaptainOfCoit wrote:
| Didn't claim so either, but a lack of knowledge about
| that it is in fact illegal, hence the parallel to at
| least my previous experience where I've most surely have
| committed crimes in the past, because I didn't know it
| was illegal in the first place.
|
| I don't know the age of the author, but it almost doesn't
| matter, sometimes people don't know (lack of knowledge).
| anigbrowl wrote:
| Come on now. $31 for inflight wifi is a ripoff, but even
| a 6 year old understands that if there's a price tag it's
| not an invitation to help yourself.
| gus_massa wrote:
| > _Remember talking about that with both other kids and
| adults without getting in trouble._
|
| A few kids doesnt matter. A few adults is only a problem if
| it's their stuff (If they are teachers, they will care more
| about unautorized changes of the wallpaper in the computer
| of the school that anything in a remote computer.) And yuo
| can even later claim they misunderstood or you were
| exagerating.
|
| But here is an in written report in front of thousands of
| persons and about planes that is a sensitive topic.
| eps wrote:
| > breaking the law
|
| Not law per se. More like contractual obligations taken upon
| by connecting to the flight's WiFi.
| traceroute66 wrote:
| > Not law per se. More like contractual obligations taken
| upon by connecting to the flight's WiFi.
|
| Well, being pedantic, you could be said to be breaking
| Civil Law. :)
|
| Jest aside, IANAL but most western countries have some sort
| of Criminal Law relating to mis-use of computers.
|
| A brief search for Canada reveals Criminal Code (R.S.C.,
| 1985, c. C-46)[1].
|
| Again IANAL, but from my reading in this scenario it would
| be (c) -> (a), "uses or causes to be used ... a computer
| system" to "obtains, directly or indirectly, any computer
| service".
|
| [1]https://laws-
| lois.justice.gc.ca/eng/acts/C-46/section-342.1....
| gruez wrote:
| Isn't this pretty straightforwardly "theft of service",
| like "stealing" cable TV service?
| Aurornis wrote:
| Most countries will have laws covering cases of
| unauthorized access, theft of services, and computer
| misuse.
|
| The user agreement helps define the service as a paid
| service with defined access cases. Going around those would
| put the user in violation of some laws.
|
| An analogy would be showing up to a paid event venue and
| noticing a back door was left open. Going into the building
| without paying is not okay, even though you never engaged
| with the ticket office to agree to anything.
| ballenf wrote:
| If the user routed all traffic through a WeChat or other
| messaging service, they would just be using messaging.
| nradov wrote:
| Intent matters. In US legal jurisdictions that could
| potentially be prosecuted as a CFAA violation, although
| I'm not aware of any cases like that yet.
|
| https://www.justice.gov/jm/jm-9-48000-computer-fraud
| DaSHacka wrote:
| The U.S. has one of the most overbearing laws in that
| regard, though. The OP happened on a flight leaving
| Canada.
| zem wrote:
| I would have had far more positive feelings towards the
| hack if they had done that - e.g. had their roommate
| configure a bot to monitor a wechat room and respond to
| url requests by sending back a webpage. tunneling over
| DNS feels icky because the reason DNS traffic goes into a
| separate accounting pool is so that the basic
| infrastructure of the internet can be kept working
| smoothly, so this is getting firmly into tragedy of the
| commons territory.
| hluska wrote:
| This is theft. Stealing is illegal. Giving a blueprint for
| how you stole is the icing on the prosecutorial cake
| because you can't claim lack of knowledge if you create a
| conspiracy to enable the theft.
|
| This may be the dumbest write up I have ever read.
| brailsafe wrote:
| The nature of the non-transaction was such that they were
| given access to a service that was constrained in certain
| ways. They used the service, and the constraints that AC
| technically applied still applied. They used what was
| available to them under the constraints and weren't
| required to pay for any other service but the removal of
| the constraints. I don't see how any theft occurred.
|
| Likewise illegality is just a boring and simple way to
| dismiss someone on moral grounds, but laws are only as
| effective as the level of agreement people have with
| them. Drinking in the park is technically illegal, but I
| don't care, the police don't care, nobody cares, unless
| someone needs to care, and I'm going to do it anyway,
| because the law does not make drinking in the park
| inherently wrong, it just provides a framework for
| telling you to stop if you're interfering with others in
| a way that relates to alcohol consumption.
| jxf wrote:
| IMO a certain amount of youthful indiscretion that takes the
| form of challenging systems and structures feels like it's
| both tolerable and important. Agitation prevents
| calcification.
| ohyoutravel wrote:
| I didn't see this, but the monster hacker blog post is up on
| archive. Honestly the person sounds like a kid:
|
| https://web.archive.org/web/20250823174801/https://bobdahack.
| ..
| pavel_lishin wrote:
| I was about to correct you and say that bobdahacker hacked
| McDonald's, but I guess he did both, and bragged about both.
| anigbrowl wrote:
| I wouldn't go as far as 'breaking the law', and I agree with
| the author that the contractual terms ($31 for wifi) are a
| shitty offer to a captive audience. But I'm also tired of
| pseudolegalism being employed as figleaf for bragging about
| the ability to bypass access controls and presumably making
| everything run a bit slower for all the other passengers (the
| author mentions that they gave up using it after a while
| because the bandwidth was so limited).
|
| Yes, long flights are miserable and air travel is a bit of a
| ripoff. I choose to cope by treating it as an internet break
| and enjoying a dense book.
| CaptainOfCoit wrote:
| Say you're on a plane from Canada to Hong Kong (random
| example), which country's laws would be applicable here? The
| country where the airplane is registered?
| traceroute66 wrote:
| > which country's laws would be applicable here? The country
| where the airplane is registered?
|
| For all intents and purposes it is the country of
| registration of the aircraft.
|
| There are one or two exceptions to the rule, but they would
| not be applicable in this scenario. Mostly stuff relating to
| air safety. For example, if the aircraft did something
| against the aviaition laws of the country being overflown. Or
| hijackings etc.
| Traubenfuchs wrote:
| Same country that would be responsible if you stab your seat
| neighbor for taking too much space I'd guess.
| traceroute66 wrote:
| > if you stab your seat neighbor for taking too much space
|
| IIRC the way it works is that when you land (destination or
| forced landing elsewhere) the offender is delivered to the
| local competent authorities.
|
| They then undertake an initial investigation and decide
| either to exercise their own jurisdiction or undertake
| extradition proceedings to send the offender to the country
| of registration of the aircraft.
|
| In a scenario of (attempted)murder, I suspect that it is
| highly likely it would be dealt with in the local courts
| unless there was a specific external push for extradition.
|
| The point of the convention is to ensure there is never no
| jurisdiction, i.e. the country of registration to the
| aircraft is always there as the ultimate fallback. The
| wording doesn't seek to strictly define the jurisdiction,
| which is why in most cases the delivery country has the
| option to take jurisdiction.
| jan_Sate wrote:
| It depends on which jurisdiction region wants to enforce the
| law. If someone wants to enforce a law, and it succeed, then
| the law of that jurisdiction region applies.
| andy99 wrote:
| > The only downside was that although we broke through the
| network restrictions and could access any website, the plane's
| bandwidth was extremely limited, making web browsing quite
| painful.
|
| Unfortunately this is also the downside of paying. Many times I
| have paid for internet, only to find it unusably bad. To be fair,
| I just flew a transcontinental flight on Air Canada the other day
| and the wifi was fine.
| CrossVR wrote:
| This is likely another layer of security that they didn't break
| through:
|
| To prevent chat apps from consuming lots of bandwidth typically
| your connection is severely bandwidth restricted until you pay.
| If they didn't then someone could simply stream movies from
| their chat apps.
| ms7m wrote:
| I don't think so, compared to transcontinental, which lately
| (before Starlink) has been using the cell towers on the
| ground + satellite backhaul -- even paying would probably
| still result in a garbage experience.
| armada651 wrote:
| The point is that if the connection does have more
| bandwidth available they wouldn't get that extra bandwidth
| without paying.
| sheepscreek wrote:
| I've been the unfortunate one who paid and endured the slow-
| barely-usable/mostly unusable speeds. However, that was before
| the Starlink era. So if you're gonna pay for WiFi, it's worth
| checking if the flight is equipped with Starlink.
| mjr00 wrote:
| Yeah, I just flew WestJet from Canada to Honolulu and was
| amazed; full 1080p YouTube with no hiccups and I was able to
| play some (non-latency sensitive) online games, all over the
| Pacific. This was fully intentional; there wasn't any back-
| of-the-seat iPad for watching movies or anything, they
| straight up tell you to use your own device and watch
| Netflix. I did some research after and found a lot of
| airlines in NA are going to be rolling out satellite internet
| in the next year or two.
|
| For some reason, being fully connected at 50mbps+ on a plane
| seems more futuristic sci-fi to me than everything AI.
| badc0ffee wrote:
| > This was fully intentional; there wasn't any back-of-the-
| seat iPad for watching movies or anything, they straight up
| tell you to use your own device and watch Netflix.
|
| Westjet has required you to use your own device for a long
| time now (10 years?), but they offer an app/website and
| streaming library that works for anyone who connects to the
| in-plane wifi, unrelated to actual access to the internet.
|
| Interesting that they're telling you to use your own
| streaming app/account now. Did you still have to pay extra
| for internet access? Was the Westjet streaming app still
| available?
| mjr00 wrote:
| Nope, wifi was free. Well, have to sign up for WestJet
| rewards, so the price is your personal data and such. No
| WestJet streaming option, the information card in the
| backseat tells you to use your own Netflix account; yes,
| literally mentioning Netflix by name.
| octo888 wrote:
| Do consumer rights exist in the skies? Genuine question!
| RandomBacon wrote:
| Cruise ships wait until they get to international waters
| before allowing gambling.
|
| Maybe planes can offer gambling while over the ocean?
|
| For the exec who pitches this at a board meeting: you're
| welcome (cries)
| ogurechny wrote:
| Limiting availability of third party services based on local
| service provider fee can only be done 100% reliably on a service
| side through an agreement with that provider, i.e. WhatsApp needs
| to disable certain functions to users coming from certain
| dedicated links or IP ranges, or even based on live user status
| metadata. There's an obvious size mismatch, and lack of incentive
| to implement compartmentalisation only needed for some other
| company. It also creates enormous shared responsibility and
| potential circular finger pointing clown shows, all for
| relatively tiny number of affected paying users.
|
| Therefore, it is either done with least amount of work that is
| "good enough", and can be done on a cheapest router (rate limit
| to the absolute minimum, ban connections to ports 80 and 443,
| maybe cut the traffic to most stable IP ranges of biggest
| services, and regular person is going to state that "nothing else
| works"), or trough very extensive commercial DPI with lots of
| guessing and ad-hoc rules (if this feature is important for the
| income, and many will try to game the system). So it's either
| going to be as simple as in this example, or you'll compete with
| the global army of detection rule authors.
|
| Though I do like the wink-wink, nudge-nudge choice of proxy
| software.
| toast0 wrote:
| FWIW, WhatsApp does (or did) support special price networking.
| I used to be the engineering side of that. But the supported
| offerrings were for special priced everything (text+mms+voip)
| or just text+mms if real time voice and video was not to be
| special priced. Text only was not a supported offering while I
| was there. And you needed to be a mobile carrier to get the
| information about IP ranges (the IP ranges were public but not
| directly linked early on, but got limited later).
|
| That said, _many_ networks did these sorts of things without
| communicating with WhatsApp. Even without knowing IP ranges. WA
| traffic is easy to spot. Chat has a destinctive protocol that
| 's neither http, nor https; mms is https with obvious hostnames
| in SNI; voip looks like voip.
|
| You might be able to trick in-air wifi by looking like WA chat,
| but I've never been interested enough to check while on a
| plane. I'd rather use the time to watch awful movies on a tiny
| screen with terrible audio conditions.
| ajd555 wrote:
| If a ping to a specific IP times out, I wouldn't say the IP is
| blocked. It could be that ICMP specifically is blocked, following
| some network rules on the firewall. This is pretty common in
| entreprise networks to not allow endpoint discovery. I could be
| missing something and happy to be corrected here, but I was
| surprised to read that.
| VladVladikoff wrote:
| Yeah, ICMP tunnelling is also a common bypass method for
| captive networks, so simply blocking all ICMP seems logical.
| EvanAnderson wrote:
| Every time I've had to fight with path MTU discovery not
| working I've cursed the people who block all ICMP, though. If
| ICMP echo / echo-reply is the problem just block that. At the
| very least, allow destination unreachable / fragmentation
| needed thru (type 3, code 4).
| pixl97 wrote:
| Most of the people blocking ICMP have no clue that ICMP
| codes/types even exist.
| yardstick wrote:
| I am sure someone will find a way to exfiltrate data using
| any ICMP type. How good are firewalls at validating the
| packets are legit?
| ogurechny wrote:
| Yes, you need to test the exact protocol you want to use. This
| means tcping/curl, TLS with proper certificates and SNI
| domains, etc.
|
| However, just as you make sure that the power supply actually
| supplies power before dismantling something that refuses to
| work down to the last washer, repairing network problems should
| start with the basics. Simple test that does not work, or shows
| something nonsensical, is a great hint that you forgot
| something, or should start digging elsewhere.
| EvanAnderson wrote:
| I find it's important to remember, too, that a failed PING
| tells you nothing other than your echo request did not receive
| a response. If the remote host received your request, and if it
| responded, are both things a failed PING can't tell you,
| because both of those things could be true but you still end up
| with a failed PING.
|
| I've seen technicians get tripped up in troubleshooting
| thinking that a failed PING tells them more than it does. When
| the possibility of asymmetric return paths is involved it's
| always important to remember how little a failed PING actually
| tells you.
| jacquesm wrote:
| And that can be a lot more subtle than you might think. I've
| had a persistent very hard to debug false alarm triggered on
| pings _sometimes_ not making it and most of the time they
| did. But very rarely that would happen three times in a row
| and that was the threshold for raising an alarm. We spent
| days on this. Finally, the root cause was tracked down to a
| BNC 'T' connector at the back of a media adapter that
| filtered out the header of some percentage of ICMP packets.
| It is one of the weirdest IT problems I've ever encountered
| and it makes me wonder how much of what we rely on is
| actually marginal.
| ceejayoz wrote:
| > It is one of the weirdest IT problems I've ever
| encountered and it makes me wonder how much of what we rely
| on is actually marginal.
|
| Vernor Vinge had a character who was a "Programmer-
| Archeologist" on a relativistic starship. Feels more and
| more prescient as time goes on.
| pbh101 wrote:
| I thought that too up until this GenAI moment, and now I
| wonder if needing to be an archaeologist will be so
| valuable if one can get your needs met by a quickly
| GenAI-written script/program.
| jacquesm wrote:
| I've yet to have my needs met by a GenAI-written
| script/program. Archaeologists tend to be a lot more
| precise in their statements, especially about what is
| speculation and what is not.
| toast0 wrote:
| I mean, if you're willing to accept AI slop, that's fine.
| But if you're willing to accept AI slop, you'd probably
| be willing to accept human slop (at least if it claims to
| be AI) too, and then the job gets a lot easier.
| palmotea wrote:
| > I thought that too up until this GenAI moment, and now
| I wonder if needing to be an archaeologist will be so
| valuable if one can get your needs met by a quickly
| GenAI-written script/program.
|
| I never have actually read those books (though I read
| some summaries about them, interesting concepts). My
| understanding is the "programmer-archeologists" basically
| had an archive of _massive quantities_ of _very high-
| quality software_ that did pretty much anything you 'd
| want software to do. So it made more sense to _find_ the
| software you need and glue it together than write from
| scratch.
|
| And given GenAI doesn't write high quality software (at
| least not yet, and hopefully never), I don't think that
| "GenAI-written script/program" would be a good
| replacement (though an AI archeologist might make more
| sense, with such an archive).
| cmehdy wrote:
| I work at a company that invented an internal syntax to
| compile into C++ code, that still relies on c-shell and
| conventions taken when OS/2 was in use there, and with a
| web of Jenkins instances and homemade wrappers and DBs to
| build that stuff.
|
| I can safely say that title exists already. And I value
| my current experience as a humbling example of what is to
| come as software becomes an older industry, and not just
| a world of startups and their freshest
| languages/frameworks/tools.
| thwarted wrote:
| The way you describe this system is exactly how I'd
| describe a system I worked on in the early 90s at PW
| (before it was PWC).
| gosub100 wrote:
| I'm a SRE and encountered this recently. To prevent DDoS,
| there is a buffer setting on the kernel that will limit the
| number of pings (a few settings actually). So if you have a
| group of machines that all ping a single destination at
| once, it's very possible to have some that fail to get a
| reply.
| jacquesm wrote:
| Oh, that's nasty. How long did it take you to
| troubleshoot that?
| gosub100 wrote:
| Relatively speaking, it wasn't that bad. It took a few
| weeks of getting trouble tickets with no root cause, and
| a bit of googling. But management wasn't okay with fixing
| the root cause, instead they just increased the
| timeout/retry window.
| jacquesm wrote:
| Wow. That's a classic. We were quite motivated because we
| were the ones that got the automated alerts. I still see
| them in my nightmares: "chopper is down". The machine was
| called chopper, I'll never forget, it's been close to 30
| years. My buddy Jasper and me spent multiple nights
| trying to track it and when we finally found it we still
| couldn't believe that that was it. But a simple swap was
| proof.
| dylan604 wrote:
| Did someone yell for you to "Get to the choppa! Do it!
| Now!!"?? Please say that's not been wasted!
| gosub100 wrote:
| whose chopper is this?
| jacquesm wrote:
| I think we were past the point of humor during that
| particular episode but there was a reason it was named
| like it was.
| dylan604 wrote:
| if it wasn't an Arnie reference, could it have been a
| Stand By Me reference, "Chopper, sick balls"? or Eric
| Bana's Chopper: "if you keep stabbing me, I'm gonna die"?
|
| clearly, i'm the type where everything is a movie
| reference, or it's a missed opportunity
| pixl97 wrote:
| It's for reasons like this that ping is one of the worst
| protocols to use for aliveness.
|
| Even worse is I've had completely dead Linux boxes that
| will gladly respond to ping and nothing else.
| webstrand wrote:
| I had an experience recently setting up a third-party VPN
| where the echo responses were being delivered to the correct
| (host,interface) but with the wrong destination address (not
| the same as made the request)
| kulahan wrote:
| I've always assumed that in situations like this, a
| traceroute is better. You can get more information simply by
| reaching the next stage in the trace, even if you're given
| zero information beyond "I'm now at the next server".
| throwaway173738 wrote:
| I've had to explain this over and over throughout my career.
| The only way to know if something is accessible is to try the
| exact endpoint and protocol. Even application-aware firewalls
| will mess with things at times.
| _trampeltier wrote:
| In my old company it was the oposite. Ping worked allways, even
| when you where blocked on to a specific VLAN.
| EvanAnderson wrote:
| I've worked in gigs that wanted that. They were all about
| segmentation, but wanted ICMP echo / response available
| throughout.
|
| Edit: I wonder if any "enterprise" firewalls do ICMP echo
| proxying. Having the firewall replace the payload would
| remove some of the tunneling capability (thought I assume you
| could still finagle a side channel by just timing the
| packets) but would also eliminate some of the utility (since
| being able to craft the payload provides a way to test for
| specific bit patterns in packets causing problems).
| yardstick wrote:
| It's been years but I've likely used NAT to redirect ICMP
| pings so the local firewall responds rather than whatever
| boat they were trying to reach.
|
| Systems change - a server that once used to respond to
| pings may no longer do so, but client software may not be
| updated to stop doing pings before connecting to the actual
| service on the server. In an ideal world the client code
| would be updated, in practice: hello firewall.
| dogtorwoof wrote:
| AC offers free WhatsApp, iMessage, messenger in most flights. You
| can ask meta through WhatsApp to effectively browse the net :)
| CaptainOfCoit wrote:
| Ah "network neutrality", how you won initially yet lost over
| time...
| cced wrote:
| I mean, if everyone was watching 4k YouTube videos they
| probably couldn't support it, right?
| axus wrote:
| Now imagine the same restrictions on your home Internet
| jeroenhd wrote:
| I don't think there are any net neutrality laws that don't
| exempt things like in-flight Wi-Fi, where the upstream is so
| heavily restricted that providing balanced services to
| everyone is basically impossible or leaves the entire
| connection useless.
|
| With Starlink things may be looking a bit better, but I think
| demanding net neutrality on in-flight satellite internet and
| plane-to-cell-tower internet is excessive.
| Dylan16807 wrote:
| You can still have a very slow free tier, a normal tier,
| and a quality video tier. Limited bandwidth is not a good
| reason to abandon net neutrality.
| ogurechny wrote:
| Many years ago, some dial-up providers in my city offered free
| public logins to use their websites (for scratch card
| activation, account renewal, user guides, and so on). Some
| companies also paid ISPs to have their sites and services
| accessible in similar fashion for promotional reasons.
|
| At a certain provider, all those free logins used the same
| firewall configuration to only allow traffic to those free
| services and ISP site, probably for simplicity, so all of them
| were accessible with any promotional login. Most of them were
| not useful (to me), but different agreements with ISP resulted
| in different call time limit until hang-up, 10-15 minutes
| instead of 3-5.
|
| However, the main treasure was the addition of external page
| translation service as a feature on some big site. Back then,
| it was strictly static and server-side, URL in request gave you
| its HTML source with translated text strings and absolute paths
| to external resources, so in order for translation to work,
| users needed to be able to access that third party server, too.
| Obviously, if you gave it any other URL, the server would also
| grab it to translate (and choosing least similar language in
| parameters would leave most of the page text intact).
|
| You can imagine that having a browser supporting tabs and
| switching media off was very handy for loading as many free web
| pages in text only form as those dial-up sessions allowed.
|
| Obviously, WWW-to-email services for people who only paid for
| mail server access had existed even before that.
| eps wrote:
| "All new is something already known, but well forgotten."
|
| Escaping locked down networks by tunneling things over DNS is one
| of these things. We've used it back in 00's to get out of
| restrictive hotel networks. Not even WiFi, but the actual wired
| Ethernet ones.
| bawolff wrote:
| I feel like you have to be brave messing with a plane's network.
| People tend to get really touchy when airplanes are involved.
| CaptainOfCoit wrote:
| Imagine if anything essential/of value/useful was exposed on
| the passengers WiFi, this story could have been a huge scoop.
| But alas, everything is heavily separated.
| reactordev wrote:
| I was going to say this too.
|
| I once merely mentioned the words "Heart Attack" on a plane and
| was kicked off by the flight attendants. No context, they just
| heard the words and forced me off.
|
| There are things that trigger them because of laws and
| regulations like mentioning "bomb" (even if you're describing
| something fantastic).
|
| So messing with the gogo flight entertainment is up there with
| flirting with terrorism charges.
| yabones wrote:
| I'm pretty "curious" when it comes to public networks. I'll
| scan coffee shops, stadiums, hotels, bus hotspots, anything I
| can connect to. Some networks are set up well, others not so
| much.
|
| I would never in a thousand years run a sweep on an airplane
| network. That's massively risky, to the point you might never
| be allowed on a jet again. Anything to do with aviation I am
| on my absolute best behaviour.
| zavec wrote:
| Without commenting on the appropriateness of what they did,
| the author doesn't say they did anything like a sweep. It
| looks like they were manually poking a few things with dig
| and ping, not firing up nmap.
| reactordev wrote:
| Circumventing security on a network, on a plane, is
| definitely up there regardless if you sweeped or not.
| IANAL but that could put you in DHS crosshairs.
| ogurechny wrote:
| The exaltation displayed in this discussion thread is
| something everyone should ponder about. Some stupidity
| specific to certain era and place on Earth, just another
| tumour of uncontrolled bureaucracy which always grows, is
| discussed as some eternal property of God-given Universe.
|
| Hijacked plane is a popular media spectacle with lots of
| ties to other images and scenes. Millions are ready to
| discuss it, or listen to the thrilling stories. "This is
| important for security!" is a shazam in that context. At
| the same time, much closer and routine dangers directly
| affecting many people (power plants, refineries,
| railroads and so on) are kept in check by underpaid
| workers who can't even make companies fix sensors or
| replace something until it is rusted through.
| Effectively, "this is not important for anything", nor
| public is interested in TV shows about working pipeline
| that is not getting blown up. Those who want money and
| power naturally stick to impressions that work for the
| crowd they are given.
|
| Propaganda is most successful when people do the required
| thing on their own, agree that it's absolutely impossible
| to evade, and even encourage each other. Something in
| this day and age makes people themselves adore certain
| forms of propaganda, and even demand to be told specific
| lies. Among other things, images of stupid social
| machines crushing someone ("they'll put you on the list",
| etc.) seem to weirdly stimulate the crowd.
|
| Even in so-called globalised world there are examples
| that crack the habituation. In country A, any big
| gathering of people needs to be formally approved,
| supplied with hordes of policemen (thankfully, not
| tanks), fences (thankfully, not barbed wire), entrance
| searches (thankfully, without stripping). When you ask
| anyone about that, they promptly respond with "What if
| terrorists/enemies decide to attack the crowd?" or "What
| if they start to riot?" (notice that "they"), etc. Even
| most obvious security theatre acts are automatically
| accepted with promotion to "psychological stuff that
| helps to detect _those people_ in the crowd". In country
| B, no less "civilised", the same event is handled by some
| private company that is mostly worried about portable
| toilets or electric generators, and people come freely to
| the venue if they like it (just buy the ticket).
|
| The odds of something wrong happening are roughly the
| same, but people reason about themselves and those around
| them very differently. That mental picture of the world
| shapes the thing that happens, not the alleged expert
| opinions or calculations.
| woodrowbarlow wrote:
| i appreciated this comment, even though it downplays real
| pragmatic concerns. from a security perspective, should
| getting on an airplane (especially for domestic flights)
| really be all that different from getting on a bus? are
| the potential outcomes different enough to justify the
| differences in security measures?
| ActorNightly wrote:
| The router is 100% separated from the rest of the plane,
| and has a fuse on the power. You can't really mess anything
| up and the only chance of you getting caught is if you
| somehow manage to ddos the network.
|
| The fun thing to do on the plane is clone the wifi and add
| an option to log in with google or meta or apple
| credentials....
| throw83949r049 wrote:
| I do not buy this.
|
| I was on airplane with large aggressive dog, that was
| harassing other passengers. I was worried it would ampute my
| limb mid flight.
|
| I voluntary left before take off, dog stayed!
| FlynnLivesMattr wrote:
| I agree, this sounds a bit too stretched. Or maybe they
| were looking for any excuse under the sun to get someone
| off what could have been an overbooked flight. But just
| saying the two words "heart attack" would not be enough
| Mattwmaster58 wrote:
| > I once merely mentioned the words "Heart Attack" on a plane
| and was kicked off by the flight attendants.
|
| Well now you have a chance to tell your side - were you
| merely sitting and just uttered the words "heart attack" for
| no externally apparent reason?
| FlynnLivesMattr wrote:
| If you move to an empty seat to prevent WiFi signal strength
| triangulation, and assuming the cabin has no cameras, you
| didn't auth to the network with identifiable information,
| actually encrypt your Xray proxy connection (which OP didn't),
| and you have MAC randomization on, there's next to no way the
| airliner would be able (or even care) to identify that you did
| what was described in the article. Sure, they could use DPI and
| behavioral analysis to _detect_ you were misusing the network,
| but if they 're doing that, they would just block this sort of
| "backdoor" from the get-go.
|
| I'll echo the article's disclaimer: This reply is intended
| solely for educational and research purposes. I affirm the
| strict adherence to all relevant regulations and service terms.
| ryandrake wrote:
| I highly doubt any airline staff are on your flight (or even
| remotely) counter-hacking one in a billion passengers messing
| around with the in-flight WiFi. That $30.75 they're not
| getting doesn't justify anyone looking into it.
| wildzzz wrote:
| Plus, the free tier is usually set to a very low QoS such
| that chat is pretty much the only thing you'd bother doing.
| Short videos will download in a reasonable amount of time
| but on average, the actual data rate is small. There's only
| so much bandwidth available and they want to make the $30
| somewhat of a value for those needing full Internet access.
| One person absolutely saturating the limited bandwidth
| allowed for the free tier is not going to make much of a
| difference for everyone else but it could be an issue if
| everyone was doing it (like if a VPN was all that was
| required to bypass the restrictions).
| bennydog224 wrote:
| Brave or stupid.
| jeroenhd wrote:
| I refuse to believe that anything important for flying the
| plane is actually hooked up to the system providing Netflix to
| passengers.
|
| People do get nervous, and in theory you could probably break
| some kind of informational system utility if you kernel panic
| the box that booms up to the satellite receiver, but unless
| you're trying to get root on the plane's routers I don't
| believe there's a need to feel brave.
|
| The braver part is publishing the results of this stuff online
| under your own name.
| notahacker wrote:
| yeah, you're not interfering with anything flying the plane
| through the IFE system, and it won't be the same bandwidth
| they use for comms either (there might be some semi-sensitive
| passenger information stored on the in-flight server, but
| entirely different techniques would be needed to bypass
| whatever security that's wrapped in).
|
| But "hacking" on an aircraft isn't going to be looked on
| particularly sympathetically by courts
| chrisbrandow wrote:
| I wouldn't expect that either given the little that I know
| about the rigorous software requirements for aviation.
|
| But I assume that neither of us has anywhere near enough
| expertise to "refuse" to believe that any computer/software
| system could be used in dangerously absurd ways even
| accidentally.
| ajross wrote:
| tl;dr: The firewall on the plane allows any traffic to pass on
| port 53 (to allow for DNS queries) but doesn't do any state
| inspection or rate limiting so you can do whatever you want on
| it.
|
| > My roommate spent about an hour setting up a proxy server
| exposing port 53 using xray 1, and sent me the configuration via
| WeChat:
|
| An hour!? As opposed to just spinning up an sshd on that port and
| coming in using ssh -D to establish a local socks proxy?
| crispair wrote:
| This was a thing back in the days too. You'd use a tool like
| iodine to tunnel ip through dns queries. Fun!
| MarsIronPI wrote:
| My question is: would proxying over SSH running on port 53 have
| worked? Seems simpler than using Xray.
| Doohickey-d wrote:
| On some networks, yes: I used to use a prepay mobile network (=
| buy a fixed quantity of GBs in advance, use them, once you run
| out, you get a restricted captive portal where you can buy
| more, just like on this flight). But all traffic on port 53 was
| allowed, it didn't need to be actual DNS traffic.
|
| There's even some commercial VPN providers which offer openVPN
| on port 53.
| noxvilleza wrote:
| If they had a ssh server on the remote machine they could have
| also done something like `ssh -g -ND 53 root@localhost` from
| the remote machine, which would have exposed a remote-
| accessible SOCKS proxy on port 53.
| appreciatorBus wrote:
| > Here we exploited a simple cognitive bias: not all services
| using port 53 are DNS query requests.
|
| Eh, I don't think this is a result of cognitive bias. I'm sure
| the people involved in creating whatever hardware or software is
| running the network know that you can run other stuff on ports.
| More likely the extra effort involved in inspecting packets was
| not deemed worth the risk, a decision either made by the
| manufacturer of the hardware/software, or someone on Air Canada's
| IT team.
| gwbas1c wrote:
| To quote https://news.ycombinator.com/item?id=45537828
|
| > This is likely another layer of security that they didn't
| break through:
|
| > To prevent chat apps from consuming lots of bandwidth
| typically your connection is severely bandwidth restricted
| until you pay. If they didn't then someone could simply stream
| movies from their chat apps.
| stackedinserter wrote:
| Why does Air Canada charges $30 for internet, that's brutal.
| Especially on 12hr flight where it should be provided for free
| imo.
| huhtenberg wrote:
| That's Air Canada. They are already making you a favor by
| allowing on board.
| gruez wrote:
| >Especially on 12hr flight where it should be provided for free
| imo.
|
| "Should" in the sense that "everyone _should_ get free food,
| housing, and healthcare " or that other airlines actually
| provide it for free? I don't know of any airline that provides
| it for free, the most is some Asian/Gulf airlines providing
| "free for 1 hour" or similar. Compared to that, "free texting,
| unlimited" doesn't seem too bad, considering there are also
| trans-continental flights with no internet access at all.
| apple1417 wrote:
| On a recent 12h Air New Zealand flight I went on they offered
| free wifi for everyone. They say you can:
|
| - Browse the web.
|
| - Send and receive emails and messages.
|
| - Check and post to social media
|
| In practice I think they just whitelist a few messenger apps.
| Everything else was unusable - I couldn't even load this
| site. Only had my phone so couldn't check if I was actually
| receiving any bytes from other sites, but it at least wasn't
| immediately blocked.
| theideaofcoffee wrote:
| > - Browse the web.
|
| > - Check and post to social media
|
| > In practice I think they just whitelist a few messenger
| apps. Everything else was unusable
|
| That was probably intentional, because to the vast majority
| of the users of these services, 'the web' is just a handful
| of the same social sites. As long as they can post a few
| things about their trip, that's the extent of the web
| access that they need or care to want. Sucks when you're
| expecting the whole kit and kaboodle, but the airlines seem
| to know their customers.
| stackedinserter wrote:
| "Should" in the sense that they need to provide basic dignity
| to people on board. Same as toilet and basic necessities like
| glass of water or very basic meal.
|
| Although "dignity" and modern planes can't be used in the
| same sentence, unless you pay 5x for business class,
| passengers are humiliated less there at least.
| triceratops wrote:
| > Especially on 12hr flight where it should be provided for
| free imo
|
| That's junkie talk /s
|
| No but seriously if you think Internet access is so vital that
| it has to be provided for free on a long-ish flight, you may
| have a problem. Watch an in-flight movie, read a book, take a
| nap, look out the window. There are many ways to pass 12 hours.
| stackedinserter wrote:
| > look out the window
|
| They took even this basic pleasure. On B787 flights crew
| forcibly dim windows for the whole flight. I guess it will be
| paid feature soon.
| adolph wrote:
| If you had a window seat you could make bank with a starlink
| mini and undercut the Air Canada by a small amount, like $40
| Canadian. Just use pfSense Captive Portal and make sure you
| forward any port 53 or 853 to the external interface to the
| local DNS.
| Nzen wrote:
| Could y'all point at instructions for how to imitate this limited
| internet situation ?
|
| I ask because, two years ago, I was able to circumvent the
| Windows-11-requires-internet-and-a-microsoft-account part of the
| set up for a new laptop computer by doing this on a flight.
| Apparently, connecting to the airplane wifi (without yet logging
| in) was enough to satisfy the OS set-up, but limited enough that
| my laptop didn't require a microsoft account. With windows 10 now
| end of life, I will probably get a new desktop computer and would
| like to repeat the feat at home. Thanks
| gruez wrote:
| >Apparently, connecting to the airplane wifi (without yet
| logging in) was enough to satisfy the OS set-up, but limited
| enough that it didn't require a microsoft account.
|
| Set up a wifi network with no internet? If you have a separate
| router/modem, just unplug your modem from your router. If your
| mode/router is combined unplug the coax/fiber/phone line.
| jeroenhd wrote:
| Boot up a router without any ethernet cables hooked up to it.
| Or turn on tethering on your phone but disable mobile data.
|
| I believe this trick doesn't work on Windows 11 anymore,
| though. Microsoft will happily wait for you to move some place
| with internet access to finish the OOBE, especially with
| upcoming changes where they disable various internal mechanisms
| to bypass the account restrictions.
|
| For about 30 bucks (or a crack) you get more life out of
| Windows 10 if switching to Linux isn't an option for you.
| You'll need to log in to an MS account once every three months
| to keep that going, but you can log out in between. If you live
| in the EU, you'll get the first year for free if you just sign
| in to an MS account, which I believe will also work as long as
| you sign in once every three months to keep the computer
| registered for updates.
| rubatuga wrote:
| I never understood the need to post about this. Just pay the $30
| or just keep quiet so others can continue to browse for free.
| dlenski wrote:
| Great writeup.
|
| I have done similar things on several long flights.
|
| Very often, there is at least one large cloud provider or CDN
| (e.g. Microsoft/Azure or Amazon/AWS or Google/GCP) that is
| whitelisted by the in-flight Internet gateway so that it can
| serve static pages, and I can get access to all the sites hosted
| by that provider simply by using domain fronting (which the
| author of this post describes as "disguise domain":
| https://ramsayleung.github.io/en/post/2025/a_story_about_byp...)
| pehtis wrote:
| Another option would be to setup a wireguard server listening on
| 53. Wireguard traffic is UDP so it would work even if TCP DNS
| requests are blocked. And it would also make the client
| configuration much easier, ie just connect to the wireguard
| server.
| NoahZuniga wrote:
| I'm not following the reasoning here:
|
| > Since acwifi.com is accessible but github.com is not, is it
| possible that the network has imposed restrictions on the DNS
| server, only resolving domain names within a whitelist (such as
| instant messaging domains)?
|
| > If this is the case, can I modify /etc/hosts to disguise my
| server as acwifi.com, so that all request traffic passes through
| my server before reaching the target website (github.com)?
|
| But by putting the host in /etc/hosts, you're skipping asking the
| planes DNS server, so how are you "disguising" an external
| server? And why go through the effort of proxying through
| acwifi.com instead of going straight to the example of github.com
| avidiax wrote:
| It could be that they allow any HTTP/HTTPS request that has
| Host: acwifi.com
|
| regardless of whether the IP address destination of the request
| is valid for acwifi.com.
|
| You see these sorts of shenanigans being used to get around
| country-wide firewalls. Plenty of deep packet inspection is
| unable to handle edge cases like the "Host:" header being
| misleading, having it fragmented into two TCP packets, etc. See
| "domain fronting".
| otterley wrote:
| Lesson for implementers: block all DNS requests from customers
| unless they are addressed to a onboard DNS cache (whose IP
| address is supplied by the DHCP response).
| pumanoir wrote:
| Where can i learn to do this kind of things? Any book(s) that'd
| teach this kind of stuff?
| mcpherrinm wrote:
| I don't know specifically what skills you're interested in, but
| this is all pretty much networking fundamentals.
|
| I think I learned most of what I'd need to do this in 'TCP/IP
| Illustrated: Volume 1'.
|
| There's plenty of "network penetration testing" type books
| which might also be of interest, though I don't have a specific
| recommendation here.
|
| There's a wider set of books at
| https://github.com/jacobian/infosec-engineering that's pretty
| good too, though it's a wider set of things than this.
| pumanoir wrote:
| Excellent, thanks! Just took a look at "TCP/IP Illustrated:
| Volume 1" and was exactly what I was looking for. Any book
| along those lines that is compressed/water down (just to get
| started over a weekend)?
| Evidlo wrote:
| Why is there an in-flight internet bypass blog post every year,
| but they never mention Iodine?
| t1234s wrote:
| Planes that use the Panasonic system allow access to the full
| *.paypal.com domain to allow the paywall to work. If there is a
| way to somehow proxy all your traffic though something under
| paypal.com you could get free wifi on certain flight. Or you can
| pass the time away reading all the paypal API documentation.
| joshheyse wrote:
| I'm guessing the speeds were slow because QOS was limiting the
| slowed for what was speed to be a chat only connection.
|
| What not just spoof the MAC address of "machine" that has paid.
|
| I had written a utility that monitors MAC address on the network
| and tries them each until it finds on that is allowed.
|
| Looks like someone released an app to do just that.
|
| https://github.com/t-mullen/wififox
| barbs wrote:
| Can someone please explain what project X/Xray is? Judging from
| the context I imagine it's some sort of proxying software but I
| can't seem to find out more. The website and github seem to be
| littered with vague jargon or is in Chinese and Googling brings
| up something called XTLS?
___________________________________________________________________
(page generated 2025-10-10 23:00 UTC)