Wednesday, 22 October 2014

Boingo Hotspot Bypass Analysis

In this post I'll take a look at what seems to be a bypass vulnerability in the current version of Boingo hotspot that allows anyone to access free wifi.


Boing-what-go?

While waiting for my plane at JFK airport I thought I'd check for free wifi, scanning the local area I saw an AP called "Boingo hotspot" and decided to give it a go.


However after connecting to the access point I found out Boingo was a pay only wifi service and all my requests were being redirected to the Boingo site.

https://www.boingohotspot.net/ResponsivePreroll.aspx?lang=en&SCC=CCGJFK001

Looking over the site I came across the "Good Stuff" feature which appeared to allow access to a small number of whitelisted sites for free. However after visiting one of the Good Stuff links I somehow gained full unrestricted internet access...

Googling this feature it turns out the flaw had already been discovered and publicly disclosed. No where however explained how the flaw worked. Lets take a look.


Secret to the Good Stuff

The Good Stuff feature, in theory, provides access to a small selection of whitelisted sites. For example:


Behind each of those buttons is an interesting looking link, something like this:

https://www.boingohotspot.net/ClickCapture.aspx?linkID=BoingoSponsorship&promoId=BIP000000000108&promocode=JFKTheGoodStuff&redirectURL=http://www.imdb.com/

It turns out the promoId/promocode function as a kind of username/password and once the link is clicked an authentication process is kicked off. Roughly something like this:

1. After clicking the link the server will return a sessionID ("s"), which is then sent with the promoid/promocode to retrieve temporary credentials.

https://www.boingohotspot.net/SponsorInternalBoingoRadius.aspx?campaignType=0&s=bnagn1j42rohtxvlzqhq1qgg&promoId=BIP000000000108&promocode=JFKTheGoodStuff

2. The temporary username and password received are then submitted to login.aspx in a POST request. Notice that the temporary username includes my MAC address, promocode, airport, terminal and a suspicious password-like string "bwpromo!1".

username=boingo/bwpromo!1|C01885DBFED1|0|0|0|Promo|0|BIP000000000108|jfk|term7|0|1412015104&password=ee0472ab2c647b2f77322257642b876bc346a3eb4dcaeef52a792f15fff6241c&domain=&dst=https://www.boingohotspot.net/

3. Once the login request completes, your ip should have been added to the allowed list and you can now browse the full internet!


https://www.boingohotspot.net/welcome.aspx?username=boingo/bwpromo!1|C01885DBFED1|0|0|0|Promo|0|BIP000000000108|jfk|term7|0|1412015104&logoutURL=http://jfk-t7.boingohotspot.net/logout


What the heck is going on?

The main issue is that whitelist restrictions for "Good Stuff" users are simply not enforced. There should be some server-side mechanism that is monitoring and filtering http requests to only allow content from whitelisted sites, this seems to be missing or at least was not enabled.

Also I'm not too sure why they included an authentication process for the free content. For paying customers authentication makes sense but for free content it shouldn't be needed. Tracking users is one possibility but this could have been done with cookies, headers or POST requests.


Final thoughts

With only an hour to spare before my flight it was a shame I didn't have longer to play with the Boingo hotspot. When you come across issues as bizarre as this you just know there are more security holes just lurking below the surface :)

Thanks for reading, feedback and questions are welcome, just drop me a comment below.

99 comments:

  1. This is the absolutely very first time I see right here. I placed many satisfying things on your blog site, especially its conversation. From the deals of reviewing your fast evaluations, I think I am not the just one having all the pleasure below! Maintain the amazing.
    Take instant support from Quickbooks Support to solve any query or problem that you are facing with your accounting software. Explore more on
    QuickBooks help

    ReplyDelete
  2. It really makes me happy and I am satisfied with the arrangement of your post. You are really a talented person I have ever seen.
    Norton setup provides you the highly secure antivirus software that protects your PC and Laptops from threats, viruses, and Malware. install the software on your Devices by visiting: Norton product key

    ReplyDelete
  3. Quickbooks is widely used business management software. they always try to serve their user better. to avail them user friendly interface. Quickbooks provide customer assistance service for users. they can contact at Quickbooks Tech Support 24/7 for help.

    ReplyDelete
  4. Looking through the helping stage to enable you to dispose of the undesirable tech glitches with AOL email? In the event that your answer is truly, at that point promptly want to contact our AOL Customer Service Number for a moment arrangement administration. Our sans toll number is accessible all day, every day hours where you may get in touch with us.
    AOL Customer Service Number
    AOL Support Number

    ReplyDelete
  5. Really great article, Glad to read the article. It is very informative for us. Thanks for posting.Norton™
    provides industry-leading antivirus and security software
    for your PC, Mca, and mobile devices Visit @: - McAfee.com/activate | norton.com/setup | McAfee.com/activate

    ReplyDelete
  6. Thank™ you for sharing excellent information. ✆ Your website is so cool. I am impressed by the details that you have on this website ☞ It reveals how nicely you understand this subject. Bookmarked♠ this website page, will come back for extra articles. You, my friend, ROCK£ I found simply the info I already searched everywhere and simply could not come across. What a great website. Visit௹☞ Norton.com/setupoffice.com/setupTelstra supportPlumbers Near Me | office.com/setup | Nurton.com/nu16..

    ReplyDelete
  7. The 123.hp.com/setup team of technical experts is an excellent group of people who believe in great repairs. They have been working in the same domain from almost a decade and that is why they deliver the most amazing services & The 123.hp.com/setup team of technical experts is an excellent group of people who believe in great repairs. They have been working in the same domain from almost a decade and that is why they deliver the most amazing services.

    ReplyDelete
  8. To install office setup you have to select the downloaded file otherwise insert the office setup CD disc. If you use the CD disc then you have to enter the Office Product Key for authorizing it. After selecting the downloaded file you have to run or setup this file on your computer.

    office.com/setup

    ReplyDelete
  9. If you are looking for laser printer, then Brother is the place for you to look for it. If you’ve purchased a Brother Printer but don’t know how to setup the printer with your computer, then don’t worry. All you need is to give us a call for technical assistance and get a step-by-step solution to install your machine. Brother Printer Support is available 24/7 to help tackle unique problems you face with your brother printer.

    ReplyDelete
  10. You could definitely see your skills in the article you write. The world hopes for even more passionate writers like you who aren’t afraid to say how they believe. All the time go after your heart.
    Factory Reset Computer

    ReplyDelete
  11. Are you looking for HP Printer Assistant. Visit Help Number USA to fix technical error. Get support from HP Printer Assistant!
    HP Printer Assistant download |
    HP Support Assistant download |
    How to change password in Outlook |
    How to reset apple id password on iPhone |

    ReplyDelete
  12. Thank for important information . I like your explanation of topic and ability to do work.I really found your post very interesting .
    Netflix Password Reset

    ReplyDelete
  13. It has been great to read this article it was quiet to be nice you every detail about the topic Thanks for sharing this article with us.
    How to reset mac computer

    ReplyDelete
  14. Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work!
    How to reset your Wireless Router successfully

    ReplyDelete
  15. To get protection, download, install and activate norton setup with 25-digit alphanumeric product key at norton.com setup. In case a new user, then create an account or log In by entering email address and password.

    ReplyDelete
  16. Download Or Install Office Setup Step 1. Go to www.office.com/setup - Sign in, 2nd. Enter product key, and 3rd. we can also help you with office.com/setup online.

    ReplyDelete
  17. www.trendmicro.com/downloadme
    For Trend Micro Download , you must create a Trend Micro account from trend micro that can help you in smooth Trend Micro installation. Protect your systems and online data from multiple threats, including viruses, spyware, identity theft, malware, rootkits, Trojans, phishing attacks, ransomware, Adware, Worms, Bots, Horses, and other threats.You can activate the Trend Micro software by installing the Trend Micro download

    ReplyDelete
  18. the user must purchase a license of Avg antivirus from the retail store or online. Though download AVG software is the easiest process, your system must match the essential prerequisites of Avg antivirus. Once you will get AVG activation code and will create an AVG account , then you can install AVG with license number. install-avg-with-license-number | www.avg.com/activation | www.avg.com/retail

    ReplyDelete
  19. You can purchase the McAfee Antivirus software online or from the local Retail Store as it is available on all the retail store available near you. www.mcafee.com/activate | mcafee.com/activate

    ReplyDelete
  20. Norton is a reputed and cost-effective antivirus suite
    company which offers protection so that no virus can damage
    your computer. It also provides many other products and
    services apart from antivirus.
    norton.com/setup

    ReplyDelete
  21. Norton setup provides you’re the highly secure antivirus software that protects your PC and
    Laptops from threats, viruses, and Malware. install the software on your
    Devices by visiting.
    norton.com/setup

    ReplyDelete
  22. Norton Antivirus protect your computer, mobile, and tablets against Viruses, Trojan, Malware and other online threats.

    To get support for installing, downloading Norton Setup in your device so click on the following link.
    Norton.com/setup

    ReplyDelete
  23. AVG is compatible with almost all the devices, including computers, windows, laptops, and smartphones.
    www.avg.com/retail |
    avg.com/retail

    ReplyDelete
  24. Hello Sir/mam This is a very helpful Blog articale thanks for sharing with us I like this Article.Thnak You so much.
    Mcafee.com/mis/retailcard | mcafee.com/activate

    ReplyDelete
  25. Very Unique article thanks for sharing with us. this is very knowledgeable for me.

    TomTom Home | office.com/setup | garmin.com/express | turbotax login | norton.com/setup

    ReplyDelete
  26. Please report to the porter of the airline’s check-in if you get any trouble while check-in. Make your journey easy and comfortable by calling at American Airlines Phone Number.

    ReplyDelete
  27. Our experts will guide you throughout the journey whenever you want to know about the lowest priced hotels, rental cars, and travel packages. You can also know about the best time to travel to a specific destination with Air China Customer Service helpline to enjoy the great deals as well as their special weather while beating the crowds.

    ReplyDelete
  28. Call us at Air China Phone Number and get an attractive service with offers and discounts from our customer service team. We have a team of inspiring and motivated professionals. They are so dedicated to their work that they help you with best deals and offers available in the market.

    ReplyDelete
  29. You want to book an air ticket, then visit American Airlines official site to make your vacations and meetings comfortable. Check out our online portal for American Airlines Reservations and get the best discount and offers on your bookings. If you want more concessions, then call on our support number.

    ReplyDelete
  30. Baggage has always been an issue for all travelers. There are few things which are must to carry, but due to a limited baggage policy, travelers had to leave the items. But now, you can get all the desired stuff with you while traveling. Make your United Airlines Reservations with us and get the additional baggage.

    ReplyDelete
  31. Out team at Southwest Airlines, Phone Number helpdesk now offers cheapest prices on flight tickets and on additional services. We aim at providing the best flight combination for your desired destination and that to be in your specified budget. Our core mission while operating Southwest Phone Number support desk is to provide the highest quality of customer service at the best price. With our motto being operating with sense professionalism and friendliness.

    ReplyDelete
  32. Trend Micro Internet Security subscription is the single way to download the software on multiple devices through www.trendmicro.com/downloadme . Trend micro has become a superior antivirus program over many antiviruses due to its advanced protection features. trend micro download process becomes easy when you purchase the subscription. But when the subscription expires, the user needs to renew it; otherwise, it won’t protect your device anymore. In this blog, we will discuss how you can renew your Trend Micro Internet Security subscription.

    ReplyDelete
  33. Dragon Naturally Speaking software is a speech recognition program that allows the user to speak into a microphone on a computer with the software translating the spoken words into text in a text program.
    dragon naturally speaking | dragon naturallyspeaking

    ReplyDelete
  34. Your blog is valuable us with significant information flight booking at,your new travel Eva Phone Number booking associate. Contact our pros. It was the key bearers to show Premium Economy Each and each tip of your post are astonishing. Much refreshing for sharing. Keep blogging.if you any issue you can interface authorities groups master bunch best deals of Eva Airlines Number.

    ReplyDelete
  35. Excellent thread, I have to thank for this. It helps me a lot to enhance my knowledge. I really like the way the writer presented his views.
    perdisco assignment help
    engineering assignments help

    ReplyDelete
  36. Nice Blog, I have get enough information from your blog and I appreciate your way of writing

    Visit: www.malwarebytes.com/install

    ReplyDelete
  37. Great post I would like to thank you for the efforts you have made in writing this

    Visit: www.trendmicro.com/bestbuypc

    ReplyDelete
  38. Thankyou for Sharing The Awesome Blog Post I Found This Article
    To Be Very Infromative and Helpfull, I am a Web Developer and
    Graphic Designer From Canada and I Love to read and Write Blog About
    New Techonology Trends.
    Some Of My Web Blogs
    Click to Process
    norton.com/setup
    www.norton.com/setup
    login.norton.com
    my.norton.com
    norton support
    norton com setup
    norton chat support

    ReplyDelete
  39. I really happy found this website eventually. Really informative and inoperative, Thanks for the post and effort! Please keep sharing more such blog.

    norton.com/setup

    spectrum email login

    kaspersky activation

    ReplyDelete

  40. Mcafee Login Mobile:
    Mcafee pro antivirus I personally used it for 7 years its popular virus protection software antivirus which secures your laptop and mobile devices from the virus. You can log in by using McAfee login mobile. For more information visit our:https://mcafeepro.com/

    ReplyDelete
  41. This is very informative post, good work, i like this content and wish to read more from you. Thanks for such a informative post. I also like to share
    McAfee Login
    McAfee Total Protection Login
    McAfee Antivirus Login
    McAfee Login Mobile

    ReplyDelete
  42. Hi friend I am using Mcafee software which is a popular product for me because it takes care of my PC and is completely secure from virus and malware protection. If you want then you can download the world’s most trusted antivirus from McAfee official website and login in a few simple steps. I am also getting live support with easy access of Mcafee login to solve all issues myself.

    ReplyDelete
  43. Getsupportpro is a kind of digital directory, Provides the all type of local and global verified business information, toll-free numbers, and customer services in one step.

    ReplyDelete
  44. We are a team of highly experienced and well trained, those who provide a solution related to windstream email such as windstream email login, windstream net email login, windstream login and much more. For more info contact our support team to get instant assistance.

    ReplyDelete
  45. Plenty of Fish is one of the largest global online dating companies, and is available in 11 languages and more than 20 countries. Unlike many dating offerings today, POF Login offers a less prescriptive, low-pressure user experience that allows singles to discover what they're looking for.
    For more details visit!
    https://plenty-offish.com/

    ReplyDelete

  46. 123 HP com setup officejet 3830: If you are looking for the right method for 123 HP com setup officejet 3830, then we are here to help you. In order to set up a printer for the first time, first, you have to remove all the packaging materials, connect the power cable, install the ink cartridges, and then finally, you will have to load paper into the input tray. For more information visit hp printer setup here https://getsupportpro.com/hp/123-hp-com-setup-3830/

    ReplyDelete
  47. canon.comijsetup setup into your pc, your system does not need to install the driver on it. Canon printer that can be downloaded via page is the best wireless printer that you can connect to your device and print data smoothly. canon.com/ijsetup
    CD is not the well-suited technique to use canon.comijsetup setup installation for longer.canon ij printer setup offers the Printer Setup download link where you can install the printer setup further. With the online canon.com/ijsetup setup , the user can set up the Canon Printer Model

    ReplyDelete
  48. HP Laserjet Printer, you can print high-quality documents and graphic outputs using the wireless connection. This printer is designed considering the commercial requirements and comes with an embedded security package that protects the users from external threats.
    123.hp.com/setup |
    123.hp.com/laserjet

    ReplyDelete
  49. Norton offers support to install Norton internet security in your device from norton.com/setup the software on the computer the same way we, here at superb support, offer premium services to support the user to install www.norton.com/setup and other antivirus programs and other computer related issues.

    ReplyDelete
  50. Go to the retail store or visit the online store of www.mcafee.com/activate and then proceed for the McAfee activate process. McAfee offers protection from thousands or can say many viruses and threats.McAfee offers best virus protection features with mcafee.com/activate redeeming steps. Get it today and make your device protected.

    ReplyDelete
  51. Trend Micro Software, a highly rated antivirus software that can be easily installed and run fast. Within a few seconds, it can defend yourself and your family. You can plan it manually or you can Scan automatically. Trend Micro will continue to defend you day and night. However check out the Prerequisite before download and install Trend Micro on your PC.
    www.trendmicro.com.au downloadme | www.trendmicro.com/downloadme |
    trendmicro.com/downloadme

    ReplyDelete
  52. Canon printer that can be downloaded via canon.com/ijsetup page is the best wireless printer that you can connect to your device and print data smoothly. Canon ijsetup CD is not the well-suited technique to use canon.comijsetup setup installation for longer.
    canon.com/ijsetup |
    canon.com/ijsetup |
    canon ij printer setup |
    canon ij printer setup

    ReplyDelete
  53. Access the Norton account by going to www.norton.com/enroll webpage and register your subscription. At norton.com/enroll URL, you can enroll Norton product and secure your data, devices, and other online works and network. Sign in to Norton, download, and install Norton.
    norton.com/enroll |
    www.norton.com/enroll

    ReplyDelete
  54. Norton Setup – Increasing demand and advancement of technology has created a need for cybersecurity. One cannot imagine their day without a computer, internet, email, or other cyber stuff.
    www.norton.com/setup |
    norton.com/setup

    ReplyDelete
  55. he present digital world is filled with threats. If you are an optimist and have total faith in your device’s first-party antivirus, then it’s great but fighting against advanced malware and viruses requires modern technology.
    mcafee.com/activate |
    www.mcafee.com/activate

    ReplyDelete
  56. Are you facing problems in bigpond emails login access.follow our article to setup bigpond emails.

    ReplyDelete
  57. McAfee Total Protection has definitely taken a hit with the update of the McAfee antivirus. The McAfee WebAdvisor tool has also been less impressive than the previous updates. The performance boosting features are also underwhelming in the latest McAfee Total Protection.You can either go to our website or contact us via call. Visit here: https://mcafeepro.com/

    ReplyDelete
  58. silahkan kunjungi situs yang akan memandu kalian untuk mengetahui cara bermain live game yang baik dan benar, anda juga akan mendapatkan panduan bermain dengan benar. disini kalian akan diajarkan cara bermain permainan Roulette, Sicbo, 24D Spin, Baccarat, 3D SHIO, Dragon Tiger dan live game lainnya. semua panduan cara bermain bisa kalian pelajari di Cara Bermain Live Game IDN LIVE

    ReplyDelete

  59. Lovely blog and how nicely you posted. Nice topic and writing . I am also available here to provide information about
    GetSupportPro If you are also one of them who is facing technical issues with the printer then contact us here GetSupportPro to help.
    Here, some other keywords are also available, on which you may click and get info.
    123.hp..com
    123.hp..com
    123 hp setup 3830
    hp officejet 3830 setup
    hp printer setup

    ReplyDelete
  60. I like this post, because it's a very useful and creative blog. So, there are some blogs for me to visit and read too. These are extremely informative. Thank you so much. . Webroot.com/safe

    ReplyDelete
  61. This post is very informative on this topic Thank you for sharing this post with us. www.trendmicro.com/downloadme.

    ReplyDelete
  62. Wow, fantastic blog layout! How long have you been blogging for? you make blogging look easy. The overall look of your site is magnificent, as well as the content! www.norton.com/setup

    ReplyDelete
  63. Wonderful post, Thank you! This article very useful for us.
    Netgear router login

    ReplyDelete
  64. Thanks for posting this useful info. It really helped me!!! www.trendmicro.com/bestbuypc

    ReplyDelete
  65. Nice post. Thanks for sharing! I want people to know just how good this information is in your article. It’s interesting content and Great work. Webroot geek squad

    ReplyDelete
  66. I am happy to find this post very useful for me

    Visit: webroot.com/safe

    ReplyDelete
  67. This post is very informative on this topic Thank you for sharing this post with us.

    Visit: Webroot geek squad download

    ReplyDelete
  68. Great Post. Really very nice. Thanks for sharing.

    Visit: www.norton.com/setup

    ReplyDelete
  69. Best buy is leading Retail store of Electronics devices and Software’s ,New PC & Laptop users most often choose Anti virus security from same store to Install Trend Micro best buy,

    Visit: www.trendmicro.com/bestbuypc

    ReplyDelete
  70. Webroot geek squad download is an internet security product (or antivirus) that helps your system from frequent cyber threats.

    ReplyDelete
  71. www.webroot.com/safe
    is undoubtedly one of the most appreciated and renowned for removing viruses and restricting malicious links and sites to open on the device and thus it protects data and devices on a large scale.

    ReplyDelete
  72. www.norton.com/setup
    - Norton is unarguably one of the most popular and used antivirus programs.

    ReplyDelete
  73. www.trendmicro.com/downloadme
    is a platform for installing the trend micro antivirus without any problems directly. Trend Micro maximum security provides 100% protection for your device online as well as offline.

    ReplyDelete
  74. Trend Micro is one of the leaders Antivirus you're only supposed to buy. If you try to find the ideal Kit that keeps all your gadgets safe and sound, then Trend Micro Antivirus software is ideally suited to protect you in every way. www.trendmicro.com/bestbuypc

    ReplyDelete
  75. for installing trend micro antivirus you'll visit trend micro best buy page from its official website.
    www.trendmicro.com/bestbuypc

    ReplyDelete
  76. Webroot geek squad download is undoubtedly one of the most appreciated and renowned for removing viruses and restricting malicious links and sites to open on the device and thus it protects data and devices on a large scale.

    ReplyDelete
  77. webroot.com/safe - Millions of people access the internet daily on different devices like mobile phones, computers, and laptops and everyone faces security issues at some point in time because of excessive internet usage.

    ReplyDelete
  78. www.norton.com/setup gives this another option for downloading the complete Norton setup. The Steps are mostly same but with some changes in the downloading procedures. Read and follow the procedure to download on another device easily.

    ReplyDelete
  79. www.trendmicro.com/bestbuypc is an antivirus platform that offers you the easiest way to download Trend Micro antivirus. Trend Micro antivirus provides a vital range of security for multiple devices, including PCs, Macs, Windows, Laptops, Mobile phones, and smartphones.

    ReplyDelete
  80. www.trendmicro.com/downloadme Antivirus and cybersecurity products from this brand are easy to use and install and can be done in a simple manner by following a few steps. The security package offered by this brand is incredibly easy to set up and install. You can easily install and upgrade any of the Trendmicro Antivirus products that help you handle cybersecurity in the best possible manner.

    ReplyDelete
  81. I think this is one of the most significant information for me. And i’m glad reading your article. Thank for sharing!
    www.norton.com/setup

    ReplyDelete

  82. It is a very helpful and informative blog post. I would like to thank to you for providing such information I have also have a website providing very good information.


    Visit aol desktop gold download

    ReplyDelete

  83. I really happy found this website eventually. Really informative and inoperative, Thanks for the post and effort! Please keep sharing more such blog.

    Visit www.trendmicro.com/bestbuypc

    ReplyDelete
  84. This is very informative post, good work, i like this content and wish to read more from you. Thanks for such a informative post. I also like to share

    Visit www.webroot.com/safe

    ReplyDelete