(No Ratings Yet)

Loading...

• Facebook
• Twitter
• LinkedIn
• Mail

January 20, 2015 Comments closed

Airline Wi-Fi Provider Gogo Has Been Intercepting User Traffic

in ssl certificates

If you have ever flown on a US airline, chances are you have seen an advertisement for an in-flight Wi-Fi service provided by Gogo. While Gogo is certainly appealing to most travelers in this day and age, a revelation has come to light recently about this service that you should probably be aware of.

This past week, Adrienne Porter Felt, a security engineer at Google, discovered that Gogo was using a fraudulent certificate in place of Youtube.com’s real SSL certificate. The certificate was a self-signed certificate issued by Gogo, being used in combination with a proxy server. This was easy to spot because of SSL security measures in place that prevents connections from being established with a certificate issued by an untrusted provider.

The purpose of this behavior is to insert their own proxy server between the user and Youtube.com, known as a “man in the middle attack” (MITM). By performing a MITM attack, Gogo was able to view user’s data unencrypted, for the purpose of throttling or blocking connections to the bandwidth-intensive video streaming site.

Making sure users are not violating policy is fairly standard for Internet service providers. Because SSL encrypts internet traffic, it makes it harder for providers to monitor and restrict access on their networks. However by MITMing traffic to Youtube, Gogo has stepped far over the boundaries of acceptable behavior, especially given available alternatives which protect user privacy.

This is especially troubling given Gogo’s history. Neowin.com reports that “earlier this year, it was revealed through the FCC that Gogo partnered with government officials to produce ‘capabilities to accommodate law enforcement interests’ that go beyond those outlined under federal law.”³

We hope it goes without saying, but just to be clear, The SSL Store™ does not support this action, or any other action(s) which undermine SSL security and user perception of security.

For more on this story, please see this excellent write up by Rick Andrews of Symantec at CASecutiy.org.

 

 

---

3 https://www.neowin.net/news/gogo-inflight-internet-is-intentionally-issuing-fake-ssl-certificates