Why you probably shouldn’t be doing work on that in-flight Wi-Fi

There's a certain degree of doubt about whether it's possible to hack into an airplane's avionics from the in-flight Wi-Fi, as one security researcher claimed last year. But it's possible to do all sorts of things to fellow passengers—as USA Today columnist Steven Petrow recently found out. Following an American Airlines flight, Petrow was approached by a man who claimed to have gained access to the content of his e-mails, which showed communication with sources for a story Petrow was writing.

Petrow offered a bunch of advice on how to protect privacy on mobile devices (strong passwords, password managers, and encrypted communications apps). But none of these really addresses how he got "hacked"—the in-flight Wi-Fi provided a perfect environment for an attacker to undermine the security of other passengers' communications. It's something that could easily be fixed, but in-flight Internet providers are in no hurry to do so, because it's not in their interest.

When you're on any public Wi-Fi, you're bound to give up some personal information to anyone who might be watching the traffic (whether that be the company providing the service, for marketing purposes, or someone with more malicious intent). For example, in previous tests (such as the ones we conducted with NPR), we saw iPads and iPhones that identified themselves to the network by their owner's name, and Web requests to websites and mobile app traffic (some including personal data) were also visible. And as might have happened to Petrow, old-school POP/SMTP e-mail messages could be practically read off the wire.

In-flight Wi-Fi services like Gogo Wireless (the service Petrow used on his flight) and Global Eagle Entertainment (the service available on Southwest Airlines and some other carriers) are in many ways just like the public Wi-Fi available at any coffee shop, mall, hotel, or other location where access is granted through a "captive portal"—that login screen that pops up in a browser window requiring either payment or acknowledgement of terms of service before you can reach the Web. Since there's no password protection on the Wi-Fi connection, there's no privacy protection for the raw traffic that is carried on the Wi-Fi network's packets, and anyone listening in can intercept all of what gets passed through the wireless access point to and from the Internet.

But some in-flight networks break privacy even harder and introduce more potential ways to attack devices using them, because they either inadvertently or purposely block some of the most basic networking security tools: secure HTTP and some virtual private networks. And Gogo designed its network specifically with law enforcement needs in mind, as its executives explained in a 2012 letter to the Federal Communications Commission arguing against FCC-imposed monitoring requirements:

"In designing its existing network, Gogo worked closely with law enforcement to incorporate functionalities and protections that would serve public safety and national security interests. Gogo’s network is fully compliant with the Communications Assistance for Law Enforcement Act (“CALEA”). The Commission’s ATG rules do not require licensees to implement capabilities to support law enforcement beyond those outlined in CALEA. Nevertheless, Gogo worked with federal agencies to reach agreement regarding a set of additional capabilities to accommodate law enforcement interests. Gogo then implemented those functionalities into its system design."

Both Gogo and Global Eagle appear to block some commercial VPN traffic. Until last year, Gogo was also issuing its own certificates for some secure websites—including Google. That allowed them to perform content screening even in apparently secure Google searches. This may have been part of Gogo's effort to prevent passengers from accessing sites that are "objectionable." (A few years ago, Ars found that Gogo was blocking passengers from accessing our website.) But it would also allow the providers to give law enforcement greater insight into what passengers are doing aboard aircraft by stripping away Secure Socket Layer (SSL) encryption from Web browsing sessions.

Global Eagle's service on Southwest also injects HTML into unencrypted Web pages: a flight tracker ticker that sits at the top of the browser window, essentially adding an advertisement to every non-SSL Web connection. The injection breaks the stylesheet for Ars' homepage.

Ars reached out to Gogo and Global Eagle for comment on their network management and monitoring practices but did not receive any response.

Using SSL would, in theory, still protect people from others aboard an aircraft tapping into their sessions. But it wouldn't prevent an attacker from overcoming that protection. Someone could use their laptop with two Wi-Fi adapters (one masquerading as the in-flight Wi-Fi access point using malicious access point software and the other connected to the legitimate service) and essentially do the same thing that Gogo did—perform a man-in-the-middle attack by acting as an SSL proxy, issuing a fake certificate to Web connections that gives the evil laptop the ability to read everything that passes through before re-encrypting it and passing it on to the legitimate site. These sorts of attacks would likely trigger a warning from Chrome or Firefox that the sites are insecure; alternatively, the attacker could use a tool like SSL Strip to redirect to an insecure or "lookalike" version of an HTTPS site where login credentials could be stolen.

It's not like anyone would notice a slow-down. In-flight Wi-Fi depends either on satellite communications or the somewhat faster air-to-ground cellular radio communications. A man-in-the-middle attack wouldn't add much additional latency to Web sessions.

There's also the possibility that in-flight networks could be used to carry direct attacks on passengers' devices. Since the networks are essentially open wireless LANs, an attacker could probe the other devices on the network for vulnerabilities. The attacker wouldn't necessarily have to pay to play on the network to do this. Both Gogo and Global Eagle provide media streaming in-flight for free, and there are a number of ways to get past the paywall for short periods of time.

So how do you protect your privacy and still stay connected?

• If you can get a VPN connection to work, use it.
• Make sure you've enabled the firewall software for your computer and that you've turned off any sharing services.
• Check the certificate of secure websites. Chrome and Firefox will usually catch forged or proxy certificates. If you get a certificate warning, don't click through to continue—wait until you've landed and have a safer network to work from.

And if all else fails, just turn off Wi-Fi and work offline or enjoy the flight the way millions before you have—by staring into space or thumbing through that in-flight magazine.