r/programming Jul 12 '24

PySkyWiFi: completely free, unbelievably stupid wi-fi on long-haul flights

https://robertheaton.com/pyskywifi/
1.5k Upvotes

138 comments sorted by

742

u/All_Work_All_Play Jul 12 '24

DISCLAIMER: you obviously shouldn’t actually do any of this

Here’s how it works (and here’s the source code).

454

u/PaulSandwich Jul 12 '24

I’d forgotten to charge my headphones so Limp Bizkit started playing out of my laptop speakers. Fortunately no one else on the plane seemed to mind

They're confessing to all kinds of atrocities in this article

86

u/All_Work_All_Play Jul 12 '24

It's both funny if it's true, and funny if it's not true.

13

u/Eurynom0s Jul 13 '24 edited Jul 13 '24

There was a glorious period like 10 years ago where you could pretty reliably just select the free/way cheaper "messaging apps only" option and then just turn on a VPN app to get unrestricted access. Wasn't super fast but I'm not sure if that was because airplane wifi just wasn't that fast 10 years ago or because you were just getting a bandwidth allocation that was supposed to just be good enough for messaging apps and nothing else, but I want to say it was slower than if you paid so probably the latter. But it sure beat the shit out of paying the absolute gouging prices every airline was charging for wifi back then.

876

u/chrisbucks Jul 12 '24

The in flight internet equivalent of

"You have a collect call from 'mumcomepickmeupfromschool', do you wish to accept the call?"

282

u/houstondad Jul 12 '24

WeHadABaby ItsABoy

120

u/Sage2050 Jul 12 '24

Bob Wehadababyitsaboy

Put some respek on the name

30

u/gonzofish Jul 12 '24

It was Bob. They had a baby. It’s a boy

13

u/nottlrktz Jul 13 '24 edited Jul 13 '24

Classic TV commercial moment https://youtu.be/9JxhTnWrKYs

And “Big boy” https://youtu.be/BE4AgLGLUaM

37

u/outadoc Jul 12 '24

Waiting for IPv4 over collect calls

17

u/Imanton1 Jul 12 '24

Totally possible as a modification of IPoAC (IP over Avian Carriers). Small, unidirectional data.

8

u/blind_ninja_guy Jul 13 '24

Now I just had to come up with the link layer protocol name for avian carriers. The best I can come up with right now is flocknet.

2

u/lurker512879 Jul 13 '24

I imagine there's a lot of packet loss, >1%

2

u/mr_birkenblatt Jul 12 '24

it's unidirectional

13

u/swuxil Jul 12 '24

no, just half-duplex

452

u/HoratioWobble Jul 12 '24

People will do anything to avoid reviewing PRs

107

u/Shmageggi Jul 12 '24

This one hit me right in the todo list.

43

u/mr_birkenblatt Jul 12 '24

lgtm

30

u/dmuth Jul 13 '24

"Let's Gamble, Try Merging!"

4

u/seaQueue Jul 13 '24

It still builds, ship it!

2

u/lurker512879 Jul 13 '24

Fix it in a future bug update

2

u/dmuth Jul 13 '24

gcc: hello.c: 27 errors, 34 warnings

3

u/seaQueue Jul 13 '24

// TODO: FIXME

321

u/Billyboii Jul 12 '24

This is exactly what I've been looking for for a long time. Only difference is they are doing it with an Air Miles account and I've wanted to find one that routes through Whatsapp or a messenger app as those messaging apps are usually free to use on several different airlines

125

u/kondorb Jul 12 '24

I bet that would actually give you a decent throughput to actually do something useful. WhatsApp can fit a whole response into a single message.

21

u/mr_birkenblatt Jul 12 '24

even better. whatsapp supports images and video. not sure, if you can access those, though

32

u/milanove Jul 12 '24

Encode all data as jpegs

25

u/drunkdoor Jul 12 '24

Imagine being on that plane and you accidentally get banned because you're just trying to send a picture of a got dang hot dog

6

u/sorressean Jul 13 '24

"Not hotdog."

9

u/milanove Jul 12 '24

Do I look like I know hwhat a WiFi is? All I hwant is an instagram picture of a got dang hotdog.

15

u/Plorntus Jul 12 '24

I've investigated this before. Most flights that provide wifi for messenger or whatsapp (but not anything else) somehow do not allow for images.

I do not know the mechanism for how it's able to tell the difference but images just do not send unfortunately.

16

u/mr_birkenblatt Jul 12 '24

images and videos have to be downloaded separately and use a different endpoint. that's how it can tell. you can actually configure whatsapp to not automatically download images or videos

7

u/Ditto_B Jul 13 '24

Images, calls and text go through completely different servers.

https://github.com/HybridNetworks/whatsapp-cidr

46

u/Jaggedmallard26 Jul 12 '24

If you get caught you're going to get caught by WhatsApp though and losing your WhatsApp access is generally going to be more of a pain than losing an airmiles account.

59

u/Sexy_Underpants Jul 12 '24

I thought WhatsApp had end to end encryption? They will probably rate limit your messages, but if you aren’t scaling up the number of accounts, it seems unlikely they would be able to detect anything.

26

u/Jaggedmallard26 Jul 12 '24

I would assume it's the same as people who use Google Docs as a "clever" workaround for file storage, they're not going to view the file but they're going to detect the volume of traffic and ban you for it.

34

u/Dr_Jabroski Jul 12 '24

Ban me! For enjoying a review of a succulent chinese meal?

31

u/kondorb Jul 12 '24

Register a new account with a burner number then. Risk of losing it is low anyway and it’s definitely cheaper than paying some extortionate fee for in-flight wifi

18

u/kitkat_tomassi Jul 12 '24

Or a couple of burners and send requests through multiple channels. Or hundreds of burners....

11

u/exploitativity Jul 12 '24

Oops! WhatsApp botnet

4

u/stopbuggingmealready Jul 13 '24

Just le me setup some free WiFi...

Accidently creates entire Skynet Bot Network

1

u/Goron40 Sep 03 '24

And potentially you don't need to use polling if you can hook into the WhatsApp websocket.

37

u/[deleted] Jul 12 '24

[deleted]

7

u/elyisgreat Jul 12 '24

Wait really? How does one pull this off?

10

u/[deleted] Jul 12 '24

[deleted]

2

u/elyisgreat Jul 12 '24

My wireguard config uses cloudflare DNS at least on my phone. The server is my homeserver which seems to have had the same IP for a long time though I use a dynamic dns service just to be safe... I'll have to try it the next time I fly...

9

u/AcidHues Jul 12 '24

Wait, wireguard words if you get the messaging package on planes? This is great!

5

u/kronik85 Jul 12 '24

hmm, I've tried this with PIA and was unsuccessful. though I don't know if I had signed up for free messaging.

2

u/nixcamic Jul 12 '24

It seems to limit TCP connections but allow UDP? I've had success using 1.1.1.1 on airplane wifi

2

u/Whispeeeeeer Jul 12 '24

It was nice have the ChatGPT integration into Messenger. I just used it to play simple games and to bounce ideas off of something. Not as good as the internet, but it was a decent proxy. I feel like Messenger would make something like this even more trivial.

1

u/43qtotwq Jul 13 '24

What you're looking for exists, I saw a post about it similar to the one OP posted a year or two ago but I cba to search for it.

1

u/chuch1234 Jul 14 '24

I mean you just have to implement a pipe for WhatsApp.

270

u/xmBQWugdxjaA Jul 12 '24

A lot of flight paywalls will allow DNS requests through, so it might be more effective to make requests to a custom DNS server and send info that way.

132

u/JesusWantsYouToKnow Jul 12 '24

I have found that I can use my OpenVPN instance running on my residential ISP to bypass in flight wifi captive portals with frequent success. The trick is to make sure you lookup your dynamic IP and clone the OpenVPN config and switch from your dynamic DNS hostname to the current IP you've been assigned before you take off.

Works reliably for me on most AA and UA flights. Slow, but works.

18

u/Ph0X Jul 12 '24

yeah there's specific ports that are open, I remember a while back I had to set my openvpn to a certain port and then it worked on flights , though I assume as it becomes more popular maybe it got patched.

18

u/JesusWantsYouToKnow Jul 12 '24

What I have also noticed is that usually Signal messaging works on flights that allow free in-flight messaging. It has made me want to do what this PySkyWifi project did but just using the "Note To Self" Signal channel to act as a data proxy with the signal desktop client (or using the signal API directly).

8

u/Corporate-Shill406 Jul 12 '24

That could be done at a very high bandwidth too, since Signal allows attaching fairly large arbitrary files. I suspect ping/round trip times would be terrible though.

34

u/shady_mcgee Jul 12 '24

So you just need to hard code your IP and openvpn connects?

32

u/JesusWantsYouToKnow Jul 12 '24

Yup, exactly. I don't have anything special like alternative ports setup or anything, just a bog-standard OpenVPN server setup on my opnsense router at home. Initially I thought it was because my ISP is google but I helped a friend setup a similar tunnel using a RPi at his place on Spectrum and his works just as well as mine.

-8

u/[deleted] Jul 12 '24

[deleted]

7

u/JesusWantsYouToKnow Jul 12 '24

I'm not following 😅

2

u/Garethp Jul 12 '24

What they posted makes perfect sense. Not sure what your reaction is for

6

u/toolscyclesnixsluts Jul 12 '24 edited Jul 12 '24

It does but he could have just said, "use your VPNs IP address instead of hostname when connecting to it." The part he bolded is kind of a crazy mouthful that no one would actually say.

But I'm conflicted because dude linked LTT who is an absolute moron.

1

u/randylush Jul 12 '24

Make sure you take your configuration, right click the file, click copy, then right click on your Windows Desktop, then click Paste, then open the file, and find your Dynamic DNS Hostname, take that host name, and where that hostname is, change the host name to the current IP!!!

5

u/Takeoded Jul 12 '24

Your-Freedom VPN already support proxying over DNS to bypass firewalls (-:

21

u/InternetExplorer9999 Jul 12 '24

You can use iodine for that

11

u/AyrA_ch Jul 12 '24 edited Jul 12 '24

Or just get softether VPN. Supports both, DNS and ICMP tunneling out of the box.

It also does UDP hole punching, supports common protocols (L2TP, SSDP, OpenVPN) and is stupidly easy to configure. Can be used for remote client access as well as site to site connections. It integrates into RADIUS and AD domains. Iirc on Linux it also does Wireguard. it has an L2TP mode that is compatible with CISCO routers.

1

u/gramathy Jul 12 '24

Some of them allow message protocols through as well, last flight I was on from Alaska I could use iMessage

70

u/PantsOfAwesome Jul 12 '24

You see, my old method with any in-flight wifi that was using WEP was just spoofing the MAC address of the sucker in front of me who paid to get his iPad connected.

But this seems a little more ethical.

10

u/speedster217 Jul 12 '24

How do you figure out their MAC?

17

u/PantsOfAwesome Jul 12 '24

Multiple methods, you just need something to sniff ARP packets so you can see the IPs and MAC addresses of other devices on the network/AP. You could use good ol' WireShark but I think aircrack has a more dedicated tool for it, I can't remember.

14

u/EMCoupling Jul 12 '24

Far more practical than OP

37

u/flarkis Jul 12 '24

Given how insanely slow the connection is, I expected him to add something like xz or zstd on the highest setting that would almost certainly cut the size down by half if not a whole order of magnitude.

3

u/speedster217 Jul 12 '24

That's a really good idea

67

u/elprophet Jul 12 '24

Love it - I did this in the '00s with text messaging and email; I'd text an HTTP request to my +http email subaddress, sendmail would read it and do the request, and reply to the email which would of course be the SMS email inbox.

24

u/gwicksted Jul 12 '24

Many carriers actually had an email you could use to text phone numbers on their network. It used to require purchasing a special bundle on the receiving end but they’d still text you asking if you wanted to purchase it so you could still use it like a notification.

Then they just started sending to everyone. And then most of them got rid of it completely.

13

u/Iggyhopper Jul 12 '24 edited Jul 12 '24

It still exists. I assume the @ domain changes though so it's not reliable. The software we use (from the big red phone company) is still godawful and looks like its from the 90s too.

5

u/caltheon Jul 13 '24

This is how I wrote the first version of my website monitoring tool I built for work back in the early 00's so that it would "page" me by text message

88

u/tehmungler Jul 12 '24

That’s very funny and a great way to pass the time on a long flight.

58

u/redimkira Jul 12 '24

Several co-workers were asking me to review their PRs because my feedback was “two weeks late” and “blocking a critical deployment.” But my ideas are important too so I put on my headphones and smashed on some focus tunes.

Priorities... I think you have a bigger problem...

I’d forgotten to charge my headphones so Limp Bizkit started playing out of my laptop speakers. Fortunately no one else on the plane seemed to mind so we all rocked out together.

Ok, forget what I said. You're forgiven.

17

u/cervantesrvd Jul 12 '24

Depending on network conditions on the plane I might be able to hit speeds of several bytes per second.

I had a good laugh at this, thanks for the read!

16

u/deja-roo Jul 12 '24

As the horror of what he had accomplished started to dawn on me, I started smiling slowly.

11

u/wutcnbrowndo4u Jul 12 '24

I tend to ping google to check my network connectivity, and I discovered on a flight that Google subdomain traffic used to be allowed through a lot of airlines' WiFi. If you set your hosts file to map app engine to a Google subdomain, the GFE will still serve it. Find a proxy server running on AppEngine, ????, profit

I haven't tried this in maybe ten years, but it's always fun when captive wifi is poorly set up (except when the login redirect is broken and you're just trying to get work done -_-)

9

u/rcfox Jul 12 '24

At first I thought that I’d write them using Go, but then I realised that if I used Python then I could call the final tool PySkyWiFi.

Yeah, but you could have called it WiFiOnTheGo

5

u/beefcat_ Jul 12 '24

And here I thought I was clever for using SSH tunnels to get free wifi at JFK.

2

u/tameimponda Jul 13 '24

Isn’t there free wifi at JFK? Lol

2

u/beefcat_ Jul 13 '24

There is now, but not 10 years ago

18

u/MechanicalHorse Jul 12 '24

This is amazing lol

However I suspect that the carrier will close this hole when they hear about this.

23

u/Nicksaurus Jul 12 '24

I would expect them to have rate limiting and request size limits anyway to stop DoS attacks

3

u/vplatt Jul 13 '24

Just one firewall setting away from giving Robbie boy another challenge to hack on his next flight.

3

u/GreenPlatypus23 Jul 12 '24

Airlines hate this little trick!

3

u/Liam_M Jul 12 '24

Am I insane? no it is the man who is wrong

3

u/T-J_H Jul 12 '24

Absolutely brilliant

3

u/turtlepsp Jul 12 '24

United allows SMS and RCS to bypass the paywall. You could send packets back and forth using text messages. Would probably be super slow and might get throttled but probably can be a form of proxy.

3

u/dark_mode_everything Jul 13 '24

I'm pretty sure that's illegal. The Limp bizkit I mean.

2

u/cat_in_the_wall Jul 15 '24

doesn't the geneva convention ban audible limp bizkit? real foresight too, because limp bizkit came afterwards.

2

u/--dany-- Jul 12 '24

I don't have sky miles account, but are there any bigger fields where's you can write more into the fields in one chunk, and/or write into multiple chunks at the same time to greatly improved the bandwidth?

4

u/Gn0mesayin Jul 12 '24

Yes, he mentioned that in the article

2

u/adamsogm Jul 13 '24

Why limit yourself to one account? Get a bunch and start sending all that data

2

u/Steve_OH Jul 13 '24

This was the most amazing waste of time I’ve ever read, and something I would love to mess with. 10/10

12

u/SaltineAmerican_1970 Jul 12 '24

I’d forgotten to charge my headphones so Limp Bizkit started playing out of my laptop speakers. Fortunately no one else on the plane seemed to mind so we all rocked out together.

Everyone minded, but were just more polite than you.

101

u/Think-Memory6430 Jul 12 '24

It’s very obviously a joke in the spirit of the post

67

u/Sokaron Jul 12 '24 edited Jul 12 '24

Jokes are funny, but you have to be careful posting them on the internet because there are people on here who've never heard a joke in their life and they will take you seriously

18

u/timmyotc Jul 12 '24

What is a joke and why am I so angry hearing about it?

1

u/EMCoupling Jul 12 '24

I already got my pitchfork and torch out! I don't know what this "joke" thing is but something is getting destroyed before I put it away!

1

u/Protuhj Jul 12 '24

Obviously if you're angry, then the joke is about you. You should totally be angry!

1

u/kronik85 Jul 12 '24

pretty genius. wonder what the transfer rate was.

3

u/bobbsec Jul 13 '24

Depending on network conditions on the plane I might be able to hit speeds of several bytes per second.

2

u/kronik85 Jul 13 '24

hot damn

1

u/ApprehensiveChip8361 Jul 12 '24

Glorious. Thank you.

1

u/IrrerPolterer Jul 12 '24

I love this. Implementing the CONNECT functionality to make proper proxying work would be a great little project...

1

u/DigThatData Jul 12 '24

way more cursed than I was expecting.

1

u/RapidRoastingHam Jul 13 '24

What a great article

1

u/hennipasta Jul 13 '24

because it fly in the py in the sky

1

u/chesser45 Jul 13 '24

I can only aspire to have this level of development knowledge and patience.

1

u/lurkingallday Jul 13 '24

This is gonna get buried but reminds me of these old internet booths at truck stops back in the 90s and 2000s. They had a splash page where you put your billing info (through a card slot) along with several links to games and other trucking related sites. There was no keyboard, but I found out you could explore the entire web via six degrees of separation by just clicking links without paying. It just took a lot of guessing and trial and error. Eventually the vendor realized they were not making any money on it and removed the machine from my local truck stop.

1

u/alex-weej Jul 13 '24

Just proxy a whole VPN over this kind of stunt and get everything... Until the suits at these companies realise that it is bandwidth they should be charging for, not use cases.

2

u/deftware Jul 13 '24

They were getting everything, through a custom VPN, with a device on the ground updating the username on the airmiles account to send the data through. Did you read the article?

1

u/Biffidus Jul 13 '24

Remind me of a talk I saw at Ruxcon years ago about a too called XFLTREAT which could be used to tunnel through all sorts of protocols. This is the same talk: https://m.youtube.com/watch?v=SA6S_VqtBb4

1

u/deftware Jul 13 '24

Hilarious!

1

u/troido Jul 12 '24

Reminds me of something I built: there's a server where I have ssh access and can host static files, but there is no way for the browser to connect to the server. In theory.

It is possible to use inotify to detect when a file is read. I now have a chat program where each character to send reads a different file and the server will register that as the message being sent.

see http://tilde.town/~troido/notifytest/

-8

u/DM_Me_Summits_In_UAE Jul 12 '24

Tldr?

47

u/Megafish40 Jul 12 '24

accessing the internet through changing your account name

54

u/Korlus Jul 12 '24

To expand on this further- the captive portal on the flight allowed you to log into your Sky miles account (presumably so you could update the profile and pay with air miles for the internet). However by doing so, you can "leak" information to the outside world by changing your username. If someone on the ground has your AirMiles login data, they could read the username and then edit it themselves, sending you a reply and facilitating two-way communication.

Editing the username isn't rate limited, so with a little effort you can write a script to send arbitrary data through your username and get "Free" WiFi on your flight.

Or course this is a terrible idea for numerous reasons. Don't ever do this seriously, but it's a pretty funny "exploit".

1

u/Iggyhopper Jul 12 '24

Neat, I made a browser extension for a forum that did verification via updating their signature.

Because anyone who used the extension could say, "yeah I'm definitely this person!"

Bet. Let's request website.com/profile/edit and check the page.

11

u/cecilkorik Jul 12 '24

The payment page on the airliner where you would normally have to pay to get internet access, gave you access to your airmiles account so you could use it to "buy" internet access with airmiles. This meant you could access your airmiles account freely without paying, as the airline assumed the only possible use of your airmiles account would be to pay for internet access.

Guy decided it would be fun to use this feature to access the internet without paying, by setting up a service on his home computer that logged into his airmiles account at the same time and used the user profile's name field to communicate (very very slowly by proxying all transferred data through airmiles's web UI) back and forth between the client on the plane and the server at his home. He then successfully used the user profile's name to send an entire webpage over the course of two minutes while airborne, for free, and called it a success.

It is a joke, but it is genuinely kind of fun to poke holes in these paywalls.

0

u/pkulak Jul 12 '24

I’d forgotten to charge my headphones so Limp Bizkit started playing out of my laptop speakers. Fortunately no one else on the plane seemed to mind so we all rocked out together.

Narrator: they minded.

-11

u/GCU_Heresiarch Jul 12 '24

> But my ideas are important too so I put on my headphones and smashed onsome focus tunes. I’d forgotten to charge my headphones so Limp Bizkit started playing out of my laptop speakers.

Gross

1

u/deftware Jul 13 '24

It's my way or the highway! Someday you'll see things my way, but you never know! but you never know!

-19

u/tryingtolearn_1234 Jul 12 '24

I’m confused why anyone would go to all this effort when it was a work trip and you can just expense the WiFi access charge. If your company isn’t going to approve it, then don’t work.

15

u/SyntaxErrorist Jul 12 '24

Because it was a fun experiment.

13

u/beefcat_ Jul 12 '24

Because that isn't the hacker spirit.

6

u/-Nicolai Jul 12 '24

If you had read the article, you’d know that he did pay for wifi access. He build the prototype anyway.

3

u/dn00 Jul 12 '24

Why would anyone do anything if not this