Wednesday 22 October 2014

Boingo Hotspot Bypass Analysis

In this post I'll take a look at what seems to be a bypass vulnerability in the current version of Boingo hotspot that allows anyone to access free wifi.


Boing-what-go?

While waiting for my plane at JFK airport I thought I'd check for free wifi, scanning the local area I saw an AP called "Boingo hotspot" and decided to give it a go.


However after connecting to the access point I found out Boingo was a pay only wifi service and all my requests were being redirected to the Boingo site.

https://www.boingohotspot.net/ResponsivePreroll.aspx?lang=en&SCC=CCGJFK001

Looking over the site I came across the "Good Stuff" feature which appeared to allow access to a small number of whitelisted sites for free. However after visiting one of the Good Stuff links I somehow gained full unrestricted internet access...

Googling this feature it turns out the flaw had already been discovered and publicly disclosed. No where however explained how the flaw worked. Lets take a look.


Secret to the Good Stuff

The Good Stuff feature, in theory, provides access to a small selection of whitelisted sites. For example:


Behind each of those buttons is an interesting looking link, something like this:

https://www.boingohotspot.net/ClickCapture.aspx?linkID=BoingoSponsorship&promoId=BIP000000000108&promocode=JFKTheGoodStuff&redirectURL=http://www.imdb.com/

It turns out the promoId/promocode function as a kind of username/password and once the link is clicked an authentication process is kicked off. Roughly something like this:

1. After clicking the link the server will return a sessionID ("s"), which is then sent with the promoid/promocode to retrieve temporary credentials.

https://www.boingohotspot.net/SponsorInternalBoingoRadius.aspx?campaignType=0&s=bnagn1j42rohtxvlzqhq1qgg&promoId=BIP000000000108&promocode=JFKTheGoodStuff

2. The temporary username and password received are then submitted to login.aspx in a POST request. Notice that the temporary username includes my MAC address, promocode, airport, terminal and a suspicious password-like string "bwpromo!1".

username=boingo/bwpromo!1|C01885DBFED1|0|0|0|Promo|0|BIP000000000108|jfk|term7|0|1412015104&password=ee0472ab2c647b2f77322257642b876bc346a3eb4dcaeef52a792f15fff6241c&domain=&dst=https://www.boingohotspot.net/

3. Once the login request completes, your ip should have been added to the allowed list and you can now browse the full internet!


https://www.boingohotspot.net/welcome.aspx?username=boingo/bwpromo!1|C01885DBFED1|0|0|0|Promo|0|BIP000000000108|jfk|term7|0|1412015104&logoutURL=http://jfk-t7.boingohotspot.net/logout


What the heck is going on?

The main issue is that whitelist restrictions for "Good Stuff" users are simply not enforced. There should be some server-side mechanism that is monitoring and filtering http requests to only allow content from whitelisted sites, this seems to be missing or at least was not enabled.

Also I'm not too sure why they included an authentication process for the free content. For paying customers authentication makes sense but for free content it shouldn't be needed. Tracking users is one possibility but this could have been done with cookies, headers or POST requests.


Final thoughts

With only an hour to spare before my flight it was a shame I didn't have longer to play with the Boingo hotspot. When you come across issues as bizarre as this you just know there are more security holes just lurking below the surface :)

Thanks for reading, feedback and questions are welcome, just drop me a comment below.

70 comments:

  1. This is the absolutely very first time I see right here. I placed many satisfying things on your blog site, especially its conversation. From the deals of reviewing your fast evaluations, I think I am not the just one having all the pleasure below! Maintain the amazing.
    Take instant support from Quickbooks Support to solve any query or problem that you are facing with your accounting software. Explore more on
    QuickBooks help

    ReplyDelete
  2. It really makes me happy and I am satisfied with the arrangement of your post. You are really a talented person I have ever seen.
    Norton setup provides you the highly secure antivirus software that protects your PC and Laptops from threats, viruses, and Malware. install the software on your Devices by visiting: Norton product key

    ReplyDelete
  3. Quickbooks is widely used business management software. they always try to serve their user better. to avail them user friendly interface. Quickbooks provide customer assistance service for users. they can contact at Quickbooks Tech Support 24/7 for help.

    ReplyDelete
  4. Looking through the helping stage to enable you to dispose of the undesirable tech glitches with AOL email? In the event that your answer is truly, at that point promptly want to contact our AOL Customer Service Number for a moment arrangement administration. Our sans toll number is accessible all day, every day hours where you may get in touch with us.
    AOL Customer Service Number
    AOL Support Number

    ReplyDelete
  5. Norton setup provides you’re the highly secure antivirus software that protects your PC and
    Laptops from threats, viruses, and Malware. install the software on your
    Devices by visiting.
    norton.com/setup

    ReplyDelete
  6. Your blog is valuable us with significant information flight booking at,your new travel Eva Phone Number booking associate. Contact our pros. It was the key bearers to show Premium Economy Each and each tip of your post are astonishing. Much refreshing for sharing. Keep blogging.if you any issue you can interface authorities groups master bunch best deals of Eva Airlines Number.

    ReplyDelete
  7. Excellent thread, I have to thank for this. It helps me a lot to enhance my knowledge. I really like the way the writer presented his views.
    perdisco assignment help
    engineering assignments help

    ReplyDelete
  8. Nice Blog, I have get enough information from your blog and I appreciate your way of writing

    Visit: www.malwarebytes.com/install

    ReplyDelete
  9. Great post I would like to thank you for the efforts you have made in writing this

    Visit: www.trendmicro.com/bestbuypc

    ReplyDelete

  10. Lovely blog and how nicely you posted. Nice topic and writing . I am also available here to provide information about
    GetSupportPro If you are also one of them who is facing technical issues with the printer then contact us here GetSupportPro to help.
    Here, some other keywords are also available, on which you may click and get info.
    123.hp..com
    123.hp..com
    123 hp setup 3830
    hp officejet 3830 setup
    hp printer setup

    ReplyDelete
  11. Wonderful post, Thank you! This article very useful for us.
    Netgear router login

    ReplyDelete
  12. Thanks for posting this useful info. It really helped me!!! www.trendmicro.com/bestbuypc

    ReplyDelete
  13. Nice post. Thanks for sharing! I want people to know just how good this information is in your article. It’s interesting content and Great work. Webroot geek squad

    ReplyDelete
  14. webroot.com/safe - Millions of people access the internet daily on different devices like mobile phones, computers, and laptops and everyone faces security issues at some point in time because of excessive internet usage.

    ReplyDelete
  15. I think this is one of the most significant information for me. And i’m glad reading your article. Thank for sharing!
    www.norton.com/setup

    ReplyDelete

  16. It is a very helpful and informative blog post. I would like to thank to you for providing such information I have also have a website providing very good information.


    Visit aol desktop gold download

    ReplyDelete

  17. Your content helped me a lot to take my doubts, thank you very much.
    www.malwarebytes.com/install

    ReplyDelete
  18. Nice one! thank you so much! Thank you for sharing this post. Your blog posts are more interesting and impressive.
    comcast email sign in

    ReplyDelete
  19. With our ready and fit solutions for your electric cooktop flaws, dishwasher faults or air-conditioner glitches, we are your best bet when you need technicians on the call or for doorstep services 24x7. Call our Geek Squad Phone Number helpline; set a schedule of help with our Geek Squad team. They will reach your doorsteps with thorough and technically-perfect resolution ideas. They will come to your place in the least possible time to take a comprehensive care of your faulty home/office appliances. As a plus, along with our current services, our perfect Geek Squad tech support personnelserve our customers with all that is current in the world of technology. In this direction, they are stretching our horizon to include new customers services to keep abreast with the changing times as well as global technology.

    ReplyDelete
  20. Nice Post....
    How do I install HP Solution Center?
    You can easily install the HP Solution Center by visiting the official website of HP Support or by going through the HP printer install wizard for Windows. It will scan your system for devices, software and drivers.

    ReplyDelete
  21. LG's brand new bargain with Tubi to get ad-supported articles on its own smart apparatus arrives just months following the firm revived its business Cope with Xumo -- a Tubi competition recently obtained by Comcast -- to Keep on serving as the motor to get LG Channels, the ad-supported Video-streaming agency on LG clever TVs
    tubi.tv/activate
    tubi.tv/activate enter code
    tubi.tv/activate

    ReplyDelete
  22. Interesting article thanks. I think this is a problem for the owners of these access points, since the bypass can be found in the public domain and they do not cover this vulnerability. From my own experience, I knew that if you go through identification on one access point of this provider, then when you connect the same device to another point, you did not need to go through identification (then it turned out that this is the case for all providers that provide sms authorization). No identification was required even when using a different browser. This means that the provider somehow remembers our hardware. The very first thing that came to my mind is the provider remembers the mac-address of our device. This means that if we set ourselves the mac-address of someone who has already been identified, then we can safely use the network. Also, for anyone interested in the topic of reviewing authentication on open hotspots, I recommend looking for videos on YouTube in which the authors can use various bypass paths. I found a lot of such videos there and noticed that most often they are published by accounts that have almost 25 thousand subscribers! I am sure this is because the owners of such accounts have repeatedly used the services of
    https://soclikes.com/ to cheat their number.

    ReplyDelete
  23. "Thankyou for sharing the wonderful post and all the best for your future. I hope to see more post from you. I am satisfied with the arrangement of your post.
    You are really a talented person I have ever seen
    aol email login| aol email login|
    netgearrouterlogin|facebooksignin|
    gmail not working|comcastemaillogin|
    roadrunneremaillogin|
    aol email login|
    paypallogin||aol email login||
    yahoo maillogin||yahoo maillogin|
    quickbooks online login||
    intuit quickbooks login||
    amazoncompromocode"

    ReplyDelete
  24. You can make video about it and post it on your instagram profile. I read from here https://bloggingrepublic.com/best-use-of-instagram-for-social-media-marketing/ that it is very easy to get followers for instagram profile

    ReplyDelete
  25. Indiasells.com is one of the biggest platforms to buy and sell Wires and Cables of any kind.
    It helps you reach millions of people. You can find thousands of wires and cables in multiple categories such as 20 Pair Telephone Cable, power cable, House wire, Battery cable etc....

    ReplyDelete
  26. This comment has been removed by the author.

    ReplyDelete
  27. This comment has been removed by the author.

    ReplyDelete
  28. Interesting article thanks. I think this is a problem for the owners of these access points, since the bypass can be found in the public domain and they do not cover this vulnerability. From my own experience, I knew that if you go through identification on one access point of this provider, then when you connect the same device to another point, you did not need to go through identification (then it turned out that this is the case for all providers that provide sms authorization). I advice you to post this article as a video-review on Youtube so that many interested people can see it. And you can always use the services of https://viplikes.net/ to increase the number of followers.

    ReplyDelete

  29. The email server settings area unit required to be originated to protect data and access your email account simply. The incoming server settings (IMAP or POP) and outgoing server settings (SMTP) area unit every email shopper that varies by a touch bit. The IMAP server setting of Yahoo mail is imap.mail.yahoo.com, and SMTP server settings area unit smtp.mail.yahoo.com. The SMTP server's port range is 465. to grasp a lot of concerning theYahoo Mail Server Settings,

    ReplyDelete
  30. Best Hospitals in Tunisia


    Clinique Taoufik, Tunis
    Clinique Montplaisir, Tunisia
    Clinique Carthagene, Tunis
    Clinique El Amen, Mutuelleville
    Clinique Avicenne, Tunis
    Clinique El Amen, La Marsa
    Clinique De L`espoir
    El Manar Clinic, Tunis
    Polyclinique les Jasmins, Tunis
    Pasteur Clinic, Tunis

    To Know more about best hospital you can visit mespoir.com

    ReplyDelete
  31. Do you need an urgent loan of any kind? Loans to liquidate debts or need to loan to improve your business have you been rejected by any other banks and financial institutions? Do you need a loan or a mortgage? This is the place to look, we are here to solve all your financial problems. We borrow money for the public. Need financial help with a bad credit in need of money. To pay for a commercial investment at a reasonable rate of 3%, let me use this method to inform you that we are providing reliable and helpful assistance and we will be ready to lend you. Contact us today by email: daveloganloanfirm@gmail.com Call/Text: +1(501)800-0690 And whatsapp: +1 (501) 214‑1395

    NEED A LOAN?
    Ask Me.

    ReplyDelete
  32. immune cz tablet uses


    Immune CZ tablet is a multivitamin tablet comprising of ascorbic acid, zinc, and vitamin D3. This tablet is used to treat vitamin or mineral deficiencies caused by illness, pregnancy, poor nutrition, digestive disorders, certain medications and many other conditions.

    Hope This Information will help you.

    ReplyDelete
  33. This card helps users to fund their varied sorts of desires like window shopping, meals, drinks, and doing searching. you'll do the payment in mere one swap exploitation the Mastercard, however it's necessary to envision whether or not it's acceptable or not. But, to access of these edges, you want to have a activate venmo card.

    ReplyDelete
  34. If you are unable to stream videos from your Hulu subscription on your firestick, then there might be some problem with the Hulu app you are using. Try updating the app to fix Hulu activate not working issue. Else, relaunch the app or you can try disabling the ad-blocker on your device and see if you could stream Hulu shows or not.

    ReplyDelete
  35. If you can't change or update the Roku PIN from your account, then you might be following an incorrect way for the same. For a quick and hassle-free Roku PIN reset, you need to access the Parental Controls section from your Roku account. From here, you can go to the PIN Preferences section and update the new PIN for Roku.

    ReplyDelete
  36. custom packaging boxes are equally crucial for small and more significant businesses. As custom boxes wholesale can beautifully showcase the items for clients. With all its artistic and attractive design features. ..

    ReplyDelete
  37. take away amager Kan kun varmt anbefale Aamanns, det er KĆøbenhavns/Danmarks/verdens bedste smĆørebrĆød, og betjeningen er altid sĆød og betƦnksom.

    ReplyDelete
  38. A 2D animation company creates 2D animated videos, as the name implies. In today's world, 2D animated videos are getting a lot of traction among businesses, thanks to the high-quality material that animation firms provide in these movies. This may be because, after working with a variety of organisations and assisting them in growing through audio visual material, a firm already has the majority of the methods in place to offer exactly what they really want. At EZ, you can learn more about the function of such businesses from 2D animation and audio visual production services professionals. So, don't hesitate to contact us for more information!

    ReplyDelete
  39. Roku com link is a team of experts that can help you to provide services to activate roku streaming device using roku com link enter code.

    tv.youtube.com/start/roku
    roku com link
    amazon.com/mytv
    afrikastv roku
    bravotv.com/link activate

    ReplyDelete
  40. Teknobuilt serves the world with professional construction approaches from planning to execution of the project. Our solutions are based on your needs and this is why we keep our focus on ensuring productivity, quality, and excellence in our services. We also provide Digital Construction and safety health and environment at workplace services for better development. For more information, contact @ +91-11-41072395, or you can mail us at info@teknobuilt.com.

    ReplyDelete


  41. I really like your blog post and I learn so many new things from your blog. Kings Auto Deals in second-hand luxury cars in India. We provide the Certified used Luxury Cars with the best market price. Visit Our showroom for exciting offers. Call us +91 - 999 9727 272 for more details

    ReplyDelete
  42. What’s Amazon MyTV (Television)?
    Amazon Prime via www.Amazon.Com/mytv may be discovered to proprietors of flowing applications and equipment. Together with Amazon Prime you are able to circulate limitless films and tv episodes on amazon high video software. It’s possible to experience amazon top video too on-hearth television, SMART-TV, streaming media player, video video games console, cellular telephone or pill pc.
    www.amazon.com/mytv
    www.amazon.com/mytv
    www.amazon.com/mytv enter code
    amazon enter code

    ReplyDelete
  43. Desi Domestice Service can help you with the same. We have helped many families with our In-home care Service
    ". We can help in taking care of your naughty little one as well as your parents and grandparents.

    ReplyDelete
  44. Hi....
    Login Free Boingo Password account using your Free Boingo Password login id or password. ... PwnDizzle: Boingo Hotspot Bypass Analysis.
    You are also read more Online Business Loan in India

    ReplyDelete
  45. Hi....
    For many, public Wi-Fi hotspots are too convenient to ignore. ... like Optimum or Spectrum, or from paid hotspot providers like Boingo.
    You are also read more Best Housing Loan in India

    ReplyDelete
  46. You have a lot of interesting content on your blog. No doubt I'm having a good time here, and it looks like others are too! Good job, keep it up. For more information about Increase your clicking, please refer to the article click counter. Thank you so much for taking the time to read this.

    ReplyDelete
  47. Student assignment help offers you assignment proofreading service in which our well-trained PhD experts provide you 100% error-less & well-formatted assignment proofreading service before the deadline of your university at a cheap price. And we provide high quality assignment proofreading service.

    ReplyDelete
  48. Global Translation Help offers reliable, secure, and reasonable certified translation san francisco for passport documents .If you need the translation help with authentic and recognized translation then contact our team today.We provide you 100% accurate translation at very reasonable price.

    ReplyDelete
  49. Hollywooddo is a trusted digital media brand dedicated to serve all the latest updates or insider news to the viewers of entertainment,fashion,lifestyle,music,movies,celebs gossips and awards.
    We show case your Product and services in front of our Millions of readers.
    https://hollywooddo.com
    hollywooddo

    ReplyDelete
  50. Found your post interesting to read. Thank you for sharing. I would like to share the latest article with you about Spacebar Counter Comment your opinion after reading the complete article.Thanks.

    ReplyDelete
  51. I'm genuinely thankful to the holder of this weblog who has shared this enormous article. Thanks a lot and I’m looking ahead to read more fce-umunze cut off mark

    ReplyDelete
  52. Nice post. I was checking this blog and I’m impressed! Extremely useful information. Thank you and keep up the good work. dissertation help singapore

    ReplyDelete
  53. Are you also one of those facing issues while apply for ICA offices ?Don't worry just hire singapore translators team whose capable translators offer ica translation services in singaporefor all kinds of dcouments in over 200+ languages.

    ReplyDelete
  54. You're one of my best surf through today, It’s nice and great work, Keep it up to more updates. Thanks a lot for sharing. Meanwhile, check download CRS jamb past questions pdf

    ReplyDelete
  55. Shop for glock guns online always on lowest price range from thebestofguns.com, we are the legit dealers of all such guns products, contact us today.

    ReplyDelete
  56. I appreciate your website. Its really very help full. Thanks for sharing the great information
    Best office furniture
    furniture dealership

    ReplyDelete
  57. If you want to deal with Lexmark printer troubleshooting then start by checking the printer connection. After that, users need to update the printer driver which you can either through the manual process or through the automatic process. In case, the issue is unresolved then users can check out the status of the printer by turning it on or off. Lastly, users can restart the printer spooler device by clicking on Windows logo keys and E button together or clicking on P and navigating to the print spooler items. https://prompthelp.us/printer/lexmark-printer/

    ReplyDelete
  58. Nice post. I was checking this blog and I’m impressed! Extremely useful information. Thank you and keep up the good work. thesis writing help singapore

    ReplyDelete
  59. Its amazing post! I am impressed! Extremely helpful information particularly the last part. Thanks so much for the nice effort. A million thanks for sharing. Also visit federal poly bauchi admission list

    ReplyDelete
  60. This is the usual question and hence people should develop their skills to find the answer to their queries. They must initiate to seek out the source that may allow them to get the real-time answer to their query such as what is Cash App Bank Name. That will prove amazing for them as they would have the option of using the cash app with effectiveness and also sending money in a secure mode.

    ReplyDelete
  61. How can I use my HP wireless printer?
    For using your HP wireless printer, you should first go on the printer's control panel, and then go to the Network menu or touch the wireless icon and then go to settings. Now, you should select Wireless Setup Wizard. The Wireless Setup Wizard will be displaying a list of wireless networks in the area. Do select your preferred one.
    https://www.printerssupportpro.com/blog/hp-wireless-printer/

    ReplyDelete
  62. I really enjoy reading this content. Do you understand what a QWERTY keyboard is? If not, use the profile qwerty keyboard tester to find out more information.

    ReplyDelete
  63. Sus ideas nos recuerdan que, incluso en medio del caos, siempre se puede encontrar un resquicio de esperanza. Estoy convencido de la idea de incorporar la clicks por segundo en mi rutina, gracias a esta publicaciĆ³n bien escrita y persuasiva.

    ReplyDelete
  64. Sulfuric acid prices can fluctuate due to several factors, including demand from various industries like chemicals, fertilizers, and manufacturing. Changes in raw material costs, such as sulfur or energy prices, also impact its pricing. Global economic conditions, supply chain disruptions, and environmental regulations can further influence the market, leading to varying sulfuric acid prices over time.

    ReplyDelete
  65. In this post, I'll delve into the discovered bypass vulnerability within the current version of Boingo hotspot, shedding light on the potential risks it poses. As a cybersecurity enthusiast, I'm intrigued by the intricacies of such exploits and their implications for online security. The apparent flaw allowing unrestricted access to free wifi highlights the critical need for robust security measures in public networks. Utilizing my expertise, akin to the precision of a Cherokee form scrub, I'll analyze the intricacies of this vulnerability to better understand its mechanics and potential mitigation strategies. Stay tuned as we unravel the layers of this security lapse and explore avenues for bolstering network defenses.

    ReplyDelete