Wednesday, 22 October 2014

Boingo Hotspot Bypass Analysis

In this post I'll take a look at what seems to be a bypass vulnerability in the current version of Boingo hotspot that allows anyone to access free wifi.


Boing-what-go?

While waiting for my plane at JFK airport I thought I'd check for free wifi, scanning the local area I saw an AP called "Boingo hotspot" and decided to give it a go.


However after connecting to the access point I found out Boingo was a pay only wifi service and all my requests were being redirected to the Boingo site.

https://www.boingohotspot.net/ResponsivePreroll.aspx?lang=en&SCC=CCGJFK001

Looking over the site I came across the "Good Stuff" feature which appeared to allow access to a small number of whitelisted sites for free. However after visiting one of the Good Stuff links I somehow gained full unrestricted internet access...

Googling this feature it turns out the flaw had already been discovered and publicly disclosed. No where however explained how the flaw worked. Lets take a look.


Secret to the Good Stuff

The Good Stuff feature, in theory, provides access to a small selection of whitelisted sites. For example:


Behind each of those buttons is an interesting looking link, something like this:

https://www.boingohotspot.net/ClickCapture.aspx?linkID=BoingoSponsorship&promoId=BIP000000000108&promocode=JFKTheGoodStuff&redirectURL=http://www.imdb.com/

It turns out the promoId/promocode function as a kind of username/password and once the link is clicked an authentication process is kicked off. Roughly something like this:

1. After clicking the link the server will return a sessionID ("s"), which is then sent with the promoid/promocode to retrieve temporary credentials.

https://www.boingohotspot.net/SponsorInternalBoingoRadius.aspx?campaignType=0&s=bnagn1j42rohtxvlzqhq1qgg&promoId=BIP000000000108&promocode=JFKTheGoodStuff

2. The temporary username and password received are then submitted to login.aspx in a POST request. Notice that the temporary username includes my MAC address, promocode, airport, terminal and a suspicious password-like string "bwpromo!1".

username=boingo/bwpromo!1|C01885DBFED1|0|0|0|Promo|0|BIP000000000108|jfk|term7|0|1412015104&password=ee0472ab2c647b2f77322257642b876bc346a3eb4dcaeef52a792f15fff6241c&domain=&dst=https://www.boingohotspot.net/

3. Once the login request completes, your ip should have been added to the allowed list and you can now browse the full internet!


https://www.boingohotspot.net/welcome.aspx?username=boingo/bwpromo!1|C01885DBFED1|0|0|0|Promo|0|BIP000000000108|jfk|term7|0|1412015104&logoutURL=http://jfk-t7.boingohotspot.net/logout


What the heck is going on?

The main issue is that whitelist restrictions for "Good Stuff" users are simply not enforced. There should be some server-side mechanism that is monitoring and filtering http requests to only allow content from whitelisted sites, this seems to be missing or at least was not enabled.

Also I'm not too sure why they included an authentication process for the free content. For paying customers authentication makes sense but for free content it shouldn't be needed. Tracking users is one possibility but this could have been done with cookies, headers or POST requests.


Final thoughts

With only an hour to spare before my flight it was a shame I didn't have longer to play with the Boingo hotspot. When you come across issues as bizarre as this you just know there are more security holes just lurking below the surface :)

Thanks for reading, feedback and questions are welcome, just drop me a comment below.

48 comments:

  1. This is the absolutely very first time I see right here. I placed many satisfying things on your blog site, especially its conversation. From the deals of reviewing your fast evaluations, I think I am not the just one having all the pleasure below! Maintain the amazing.
    Take instant support from Quickbooks Support to solve any query or problem that you are facing with your accounting software. Explore more on
    QuickBooks help

    ReplyDelete
  2. It really makes me happy and I am satisfied with the arrangement of your post. You are really a talented person I have ever seen.
    Norton setup provides you the highly secure antivirus software that protects your PC and Laptops from threats, viruses, and Malware. install the software on your Devices by visiting: Norton product key

    ReplyDelete
  3. Quickbooks is widely used business management software. they always try to serve their user better. to avail them user friendly interface. Quickbooks provide customer assistance service for users. they can contact at Quickbooks Tech Support 24/7 for help.

    ReplyDelete
  4. Looking through the helping stage to enable you to dispose of the undesirable tech glitches with AOL email? In the event that your answer is truly, at that point promptly want to contact our AOL Customer Service Number for a moment arrangement administration. Our sans toll number is accessible all day, every day hours where you may get in touch with us.
    AOL Customer Service Number
    AOL Support Number

    ReplyDelete
  5. Really great article, Glad to read the article. It is very informative for us. Thanks for posting.Norton™
    provides industry-leading antivirus and security software
    for your PC, Mca, and mobile devices Visit @: - McAfee.com/activate | norton.com/setup | McAfee.com/activate

    ReplyDelete
  6. Thank™ you for sharing excellent information. ✆ Your website is so cool. I am impressed by the details that you have on this website ☞ It reveals how nicely you understand this subject. Bookmarked♠ this website page, will come back for extra articles. You, my friend, ROCK£ I found simply the info I already searched everywhere and simply could not come across. What a great website. Visit௹☞ Norton.com/setupoffice.com/setupTelstra supportPlumbers Near Me | office.com/setup | Nurton.com/nu16..

    ReplyDelete
  7. The 123.hp.com/setup team of technical experts is an excellent group of people who believe in great repairs. They have been working in the same domain from almost a decade and that is why they deliver the most amazing services & The 123.hp.com/setup team of technical experts is an excellent group of people who believe in great repairs. They have been working in the same domain from almost a decade and that is why they deliver the most amazing services.

    ReplyDelete
  8. To install office setup you have to select the downloaded file otherwise insert the office setup CD disc. If you use the CD disc then you have to enter the Office Product Key for authorizing it. After selecting the downloaded file you have to run or setup this file on your computer.

    office.com/setup

    ReplyDelete
  9. If you are looking for laser printer, then Brother is the place for you to look for it. If you’ve purchased a Brother Printer but don’t know how to setup the printer with your computer, then don’t worry. All you need is to give us a call for technical assistance and get a step-by-step solution to install your machine. Brother Printer Support is available 24/7 to help tackle unique problems you face with your brother printer.

    ReplyDelete
  10. You could definitely see your skills in the article you write. The world hopes for even more passionate writers like you who aren’t afraid to say how they believe. All the time go after your heart.
    Factory Reset Computer

    ReplyDelete
  11. Are you looking for HP Printer Assistant. Visit Help Number USA to fix technical error. Get support from HP Printer Assistant!
    HP Printer Assistant download |
    HP Support Assistant download |
    How to change password in Outlook |
    How to reset apple id password on iPhone |

    ReplyDelete
  12. Thank for important information . I like your explanation of topic and ability to do work.I really found your post very interesting .
    Netflix Password Reset

    ReplyDelete
  13. It has been great to read this article it was quiet to be nice you every detail about the topic Thanks for sharing this article with us.
    How to reset mac computer

    ReplyDelete
  14. Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work!
    How to reset your Wireless Router successfully

    ReplyDelete
  15. To get protection, download, install and activate norton setup with 25-digit alphanumeric product key at norton.com setup. In case a new user, then create an account or log In by entering email address and password.

    ReplyDelete
  16. Download Or Install Office Setup Step 1. Go to www.office.com/setup - Sign in, 2nd. Enter product key, and 3rd. we can also help you with office.com/setup online.

    ReplyDelete
  17. www.trendmicro.com/downloadme
    For Trend Micro Download , you must create a Trend Micro account from trend micro that can help you in smooth Trend Micro installation. Protect your systems and online data from multiple threats, including viruses, spyware, identity theft, malware, rootkits, Trojans, phishing attacks, ransomware, Adware, Worms, Bots, Horses, and other threats.You can activate the Trend Micro software by installing the Trend Micro download

    ReplyDelete
  18. the user must purchase a license of Avg antivirus from the retail store or online. Though download AVG software is the easiest process, your system must match the essential prerequisites of Avg antivirus. Once you will get AVG activation code and will create an AVG account , then you can install AVG with license number. install-avg-with-license-number | www.avg.com/activation | www.avg.com/retail

    ReplyDelete
  19. You can purchase the McAfee Antivirus software online or from the local Retail Store as it is available on all the retail store available near you. www.mcafee.com/activate | mcafee.com/activate

    ReplyDelete
  20. Norton is a reputed and cost-effective antivirus suite
    company which offers protection so that no virus can damage
    your computer. It also provides many other products and
    services apart from antivirus.
    norton.com/setup

    ReplyDelete
  21. Norton setup provides you’re the highly secure antivirus software that protects your PC and
    Laptops from threats, viruses, and Malware. install the software on your
    Devices by visiting.
    norton.com/setup

    ReplyDelete
  22. Norton Antivirus protect your computer, mobile, and tablets against Viruses, Trojan, Malware and other online threats.

    To get support for installing, downloading Norton Setup in your device so click on the following link.
    Norton.com/setup

    ReplyDelete
  23. AVG is compatible with almost all the devices, including computers, windows, laptops, and smartphones.
    www.avg.com/retail |
    avg.com/retail

    ReplyDelete
  24. Hello Sir/mam This is a very helpful Blog articale thanks for sharing with us I like this Article.Thnak You so much.
    Mcafee.com/mis/retailcard | mcafee.com/activate

    ReplyDelete
  25. Very Unique article thanks for sharing with us. this is very knowledgeable for me.

    TomTom Home | office.com/setup | garmin.com/express | turbotax login | norton.com/setup

    ReplyDelete
  26. Please report to the porter of the airline’s check-in if you get any trouble while check-in. Make your journey easy and comfortable by calling at American Airlines Phone Number.

    ReplyDelete
  27. Our experts will guide you throughout the journey whenever you want to know about the lowest priced hotels, rental cars, and travel packages. You can also know about the best time to travel to a specific destination with Air China Customer Service helpline to enjoy the great deals as well as their special weather while beating the crowds.

    ReplyDelete
  28. Call us at Air China Phone Number and get an attractive service with offers and discounts from our customer service team. We have a team of inspiring and motivated professionals. They are so dedicated to their work that they help you with best deals and offers available in the market.

    ReplyDelete
  29. You want to book an air ticket, then visit American Airlines official site to make your vacations and meetings comfortable. Check out our online portal for American Airlines Reservations and get the best discount and offers on your bookings. If you want more concessions, then call on our support number.

    ReplyDelete
  30. Baggage has always been an issue for all travelers. There are few things which are must to carry, but due to a limited baggage policy, travelers had to leave the items. But now, you can get all the desired stuff with you while traveling. Make your United Airlines Reservations with us and get the additional baggage.

    ReplyDelete
  31. Out team at Southwest Airlines, Phone Number helpdesk now offers cheapest prices on flight tickets and on additional services. We aim at providing the best flight combination for your desired destination and that to be in your specified budget. Our core mission while operating Southwest Phone Number support desk is to provide the highest quality of customer service at the best price. With our motto being operating with sense professionalism and friendliness.

    ReplyDelete
  32. Trend Micro Internet Security subscription is the single way to download the software on multiple devices through www.trendmicro.com/downloadme . Trend micro has become a superior antivirus program over many antiviruses due to its advanced protection features. trend micro download process becomes easy when you purchase the subscription. But when the subscription expires, the user needs to renew it; otherwise, it won’t protect your device anymore. In this blog, we will discuss how you can renew your Trend Micro Internet Security subscription.

    ReplyDelete
  33. Dragon Naturally Speaking software is a speech recognition program that allows the user to speak into a microphone on a computer with the software translating the spoken words into text in a text program.
    dragon naturally speaking | dragon naturallyspeaking

    ReplyDelete
  34. Your blog is valuable us with significant information flight booking at,your new travel Eva Phone Number booking associate. Contact our pros. It was the key bearers to show Premium Economy Each and each tip of your post are astonishing. Much refreshing for sharing. Keep blogging.if you any issue you can interface authorities groups master bunch best deals of Eva Airlines Number.

    ReplyDelete
  35. Excellent thread, I have to thank for this. It helps me a lot to enhance my knowledge. I really like the way the writer presented his views.
    perdisco assignment help
    engineering assignments help

    ReplyDelete
  36. Nice Blog, I have get enough information from your blog and I appreciate your way of writing

    Visit: www.malwarebytes.com/install

    ReplyDelete
  37. Great post I would like to thank you for the efforts you have made in writing this

    Visit: www.trendmicro.com/bestbuypc

    ReplyDelete
  38. Thankyou for Sharing The Awesome Blog Post I Found This Article
    To Be Very Infromative and Helpfull, I am a Web Developer and
    Graphic Designer From Canada and I Love to read and Write Blog About
    New Techonology Trends.
    Some Of My Web Blogs
    Click to Process
    norton.com/setup
    www.norton.com/setup
    login.norton.com
    my.norton.com
    norton support
    norton com setup
    norton chat support

    ReplyDelete
  39. I really happy found this website eventually. Really informative and inoperative, Thanks for the post and effort! Please keep sharing more such blog.

    norton.com/setup

    spectrum email login

    kaspersky activation

    ReplyDelete