{"id":2406,"date":"2015-01-20T00:00:29","date_gmt":"2015-01-20T04:00:29","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=1753"},"modified":"2018-10-02T06:54:45","modified_gmt":"2018-10-02T10:54:45","slug":"airline-wi-fi-provider-gogo-intercepting-user-traffic","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/airline-wi-fi-provider-gogo-intercepting-user-traffic\/","title":{"rendered":"Airline Wi-Fi Provider Gogo Has Been Intercepting User Traffic"},"content":{"rendered":"

If you have ever flown on a US airline, chances are you have seen an advertisement for an in-flight Wi-Fi service provided by Gogo. While Gogo is certainly appealing to most travelers in this day and age, a revelation has come to light recently about this service that you should probably be aware of.<\/p>\n

\"gogo_inflight_internet\"<\/p>\n

This past week, Adrienne Porter Felt, a security engineer at Google, discovered that Gogo was using a fraudulent certificate in place of Youtube.com\u2019s real SSL certificate. The certificate was a self-signed certificate issued by Gogo, being used in combination with a proxy server. This was easy to spot because of SSL security measures in place that prevents connections from being established with a certificate issued by an untrusted provider.<\/p>\n

The purpose of this behavior is to insert their own proxy server between the user and Youtube.com, known as a \u201cman in the middle attack\u201d (MITM). By performing a MITM attack, Gogo was able to view user\u2019s data unencrypted, for the purpose of throttling or blocking connections to the bandwidth-intensive video streaming site.<\/p>\n

Making sure users are not violating policy is fairly standard for Internet service providers. Because SSL encrypts internet traffic, it makes it harder for providers to monitor and restrict access on their networks. However by MITMing traffic to Youtube, Gogo has stepped far over the boundaries of acceptable behavior, especially given available alternatives which protect user privacy.<\/p>\n

This is especially troubling given Gogo\u2019s history. Neowin.com reports that \u201cearlier this year, it was revealed through the FCC that Gogo partnered with government officials to produce \u2018capabilities to accommodate law enforcement interests\u2019 that go beyond those outlined under federal law.\u201d3<\/a><\/sup><\/p>\n

We hope it goes without saying, but just to be clear, The SSL Store™ does not support this action, or any other action(s) which undermine SSL security and user perception of security.<\/p>\n

For more on this story, please see this excellent write up by Rick Andrews of Symantec at CASecutiy.org<\/a>.<\/p>\n

 <\/p>\n

 <\/p>\n

\n

3 https:\/\/www.neowin.net\/news\/gogo-inflight-internet-is-intentionally-issuing-fake-ssl-certificates<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

If you have ever flown on a US airline, chances are you have seen an advertisement for an in-flight Wi-Fi service provided by Gogo. While Gogo is certainly appealing to…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[25],"tags":[],"class_list":["post-2406","post","type-post","status-publish","format-standard","hentry","category-ssl-certificates","post-without-tags"],"views":5798,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/2406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=2406"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/2406\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=2406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=2406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=2406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}