AT&T Accidentally Provides Free Wi-Fi To All
SecureThroughObscure writes tells us about a hack broken by MacOSRumors: you can get free Wi-Fi at Starbucks, Barnes & Noble, and other AT&T hotspots if you know how to set your browser's user agent string (trivial on Safari), and know a valid iPhone phone number. ZDNet blogger Nate McFeters gives some more details and links. This can't last.
This actually had some chance of working before it was revealed on /.
Afterall, you don't usually publish your iPhone number to strangers, and if they ever caught the same user agent showing upo at two hotspots it'd be trivial to shut them both down.
Not the best security idea... but it got the system up until they had to come up with better.
This can't last?! I've been doing this for two months now and by now I am sure this will never bCARRIER LOST
Even if every /.'er did this, it still would be a drop in a bucket compared to the number of folks who happily pay the fee.
For example, many pay wifi points can be circumvented just by connecting to a VPN over UDP (since they're only filtering TCP requests). I doubt they're going broke due to that issue though..
I was worried when it started showing up on lifehacker and a few other places. Now that's it's been on /. I think it's safe to say it will be ending shortly.
Oh well, good while it lasted.
A surefire way to ensure that this hack lasts as long as possible is to keep it super-secret and not let AT&T know they screwed up.
But I'm sure posting the story to slashdot is fine. Nobody reads this site, after all...
Every time I goto these places I never have trouble getting free WIFI. I dont see the big deal here.
Accidentally providing free wi-fi to everyone... IF they use this hack to work around... That's not providing ANYTHING. It's not having proper security in place.
Ask not what you can do for your country. Ask what your country did to you
I don't understand. I't been a good two years since I tried to use wi-fi at a Starbucks, but when I did, I didn't pay anything for it.
Is that no longer true, or what does an iPhone user get that I don't?
Maybe it's just me, but am I the only one who's sitting here thinking that using this hack is tantamount to stealing service? Hacks for stealing cable service have existed for decades now, and were very much illegal. And why shouldn't they be? Not everything has to be hacker proof. Sometimes it's just about putting a lock on the door and saying, "This doesn't belong to you."
To use a typical Slashdot analogy, the lock on my front door is pretty flimsy and could probably be picked or forced without much effort. Is that an invitation to walk into my house and use my computer?
This also differs from open WiFi points in that open WiFi points have no security. It's difficult for a passerby to tell the difference between an intentionally shared access point and an access point that has accidentally been misconfigured.
Which reminds me, WiFi security is not all that hard to crack. Does that give people a free license to crack their neighbor's WiFi and begin using it without permission?
Javascript + Nintendo DSi = DSiCade
2 - Take your laptop to Starbucks for a coffee.
3 - Profit!
I can see the fnords!
Frankly, Starbucks should provide WiFi free. It's a great tool for them. Many small shops are doing it and I'd go to one of them before Starbuck's, obviously.
Are you kidding me?! I'm not quite creative enough to know exactly what to do with it, but a phone number is like part of a person's identity. Using that as a form of identity in this instance can't be good.
Maybe its different (okay, it IS different) ... but it is very very very rare to see a café up here in canada that doesn't have free wifi. They limit the bandwidth per connection, and (attempt to) block non http / https requests, but I *never* pay for wifi when I'm at a café ...
It makes you wonder, what the world is coming to... or at least, what is going on in the USA.
Next you're gonna be telling us how to get free wifi from all those "Linksys" hotspots, aren't you?
This guy's the limit!
Here in Minneapolis we have two other chains competing with Starbucks, Dunn Bros. and Caribou, both starting out locally. Both of the competitors offer free Wifi. Caribou's is limited to an hour, but you can circumvent that pretty easily. I don't frequent Dunn Bros. often enough to know what kind of limit they might have.
Many other indie coffee shops, restaurants and other places offer free wifi.
I'm always amazed when I see people sitting in Starbucks using laptops (maybe they're not online) when they could go down the block or across the street and get free Wifi and probably better coffee.
4 - Drink bad coffee!
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Yeah, I was thinking the same thing. It may even be a violation of the law in some jurisdictions, but good luck finding a jury that will convict.
Morally speaking, if you know you aren't supposed to be getting free service, then going out of your way to get it is theft. Father PriestNeil says going rate for digital theft is 33h Hail Marys.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
2 - Take your laptop to Starbucks for a coffee.
It is free for two hours per day, but yes this is correct AT&T has partnered to provide free 2 hour access to Starbucks card holders when they make a purchase with their card.3 - Profit!
//me rushes to starbucks before this manna from heaven ends.
That and a 6000 calorie super-mocha-frappa-venti-chino for $12.00.
This sounds like a very simple and stupid way to run afoul of the federal anti-hacking laws. They prohibit you from using surreptitious means of gaining access to a network that you otherwise shouldn't have access to. That sounds like what you would be doing here. While the odds of you getting caught are pretty slim, it would probably be a pretty easy case for the government to take, and with prosecutors always looking for another notch in their belt, why risk it?
Why couldn't they have just used MAC address (a simple range) filtering? I would guess that there are a few ranges of addresses in use by the iPhones. Even if there was some overlap with other devices, I would think that possibly in addition to a user-agent check would be a lot more secure/efficient.
When I have a kid, I want to put him in one of those strollers for twins and then run around the mall looking frantic.
I have an iPhone and I even *gasp* pay for AT&T service.
So would it be all that bad if I used this to get access to my laptop instead of my iPhone? If anyone came by, I could just pull it out like a cross and say "back, foul wifi police, I'm an AT&T customer."
Why bother, you would have to be close to one of those locations to get a good signal plus they are highly insecure because you don't know who else is doing what on the network.... a little ARP spoofing maybe....
.... they got busted for stealing credit card numbers but COPs in the USA will cuff first and ask questions later....
If you are going to circumvent the security on an AP, you might as well brake a WEP secured AP.
It takes me now 2 minutes to crack an active WEP64 or 128bit encrypted AP. While I am doing it I will also know who else is on the same network and can look for any packet stealing types.
It is also less like that you get busted because the private individual will never know but some have been busted for sitting on the parking lot for too long
Notice: Breaking WEP is illegal but so is the above hack posted on ZDnet.
The real wtf is that the iPhone's number is in the user agent string. How long till that is used to justify an "existing business relationship"?
What is a Yuppie anyway? Someone who has a job and/or business that earns good money after spending a lot of time studing and/or working hard to become successful? Wow, what an awful person!
Oh right, this is Slashdot, where IT folks all work for free for the betterment of society.
Every coffee shop I go to has free wifi. So does McDonalds, truck stops, and a variety of odd places. I can't imagine paying for wifi hot-spot access at Starbucks.
http://blindscribblings.com - Tasty pop-culture in conceptual fashion.
I find it difficult to believe that you find all of Starbucks coffee to be "bad". They have dozens of types. Some of them suck, and some of them are really good. Which ones don't you like? Did you even realize that there was more than one type?
Well, it absolutely won't with all the idiots blabbing about it!
Dozens of types of coffee?! There's only one: Black, no sugar.
Your Starbucks only brews one variety of black regular coffee at a time? They should have at least two.
So people find a way to steal it, no matter how silly their security mechanism is, ATT is not giving this away, people are stealing it.
Yeah, they should make two for sure... Everytime I see Verona brewing I get an americano...
Throws off my barista...
wifi is free at Panera and Apple stores...
besides, i wouldn't step inside a Starbucks even if they were offering free Wifi...
Here in Japan all I do is pay about $3 more on top of my usual ADSL fee (which is about $50/mo for 51Mbps/3Mbps service) to get wi-fi access covering a very wide area. (Sit down just about anywhere in Tokyo and it's available, unless you're in the subway.) I wouldn't think twice about "stealing" service, considering how easy and cheap it is to get legitimate service.
This probably says more about the AT&T service and pricing than it does about those stealing the service I guess...
In many parts of the United States, a citation is a charge of a crime, albeit a minor one. If you get a speeding ticket and plead guilty, you have a criminal record in those states. If you plead no contest you may or may not have a criminal record depending on how that state does things.
This is why some job applications say "please list all felonies, and all misdemeanors committed in the last 10 years except minor traffic violations." If it weren't for the "except" you would have to list all your recent traffic tickets.
In some US states traffic citations are considered civil matters not criminal.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
This is not any more free than stealing a chocolate bar from the store is getting a free chocolate bar.
The fact that it's lame security is irrelevant. Theft is theft.
No iPhone needed, but you may need to be an AT&T customer as the wording is a bit dodgy. http://www.att.com/gen/general?pid=11375
Even Dunkin' has two types of roasts, decaf, and flavored beans. I understand that you were trying to make a joke, but you actually made an insightful comment. How can you bitch that you don't like something, yet refuse to make even a basic attempt to understand why?
Once the API arrives, I can imagine that all they have to do is write an 'enabler' app that does a magic handshake over the cellular interface to pass the phone's WiFi Ethernet interface address to the local hotspot. That would obviate the need to fill out their silly web form and everything.
Of course, if they're silly enough to write the app so that it enables the connection without performing a validation step (assuming that being able to run the app means it's running on an iPhone), then someone will rather quickly decompile it and they'll be in no better shape than they are now.
That's a different thing. AT&T DSL customers have been able to log in to Starbucks hot spots for a while now. I'm both an iPhone owner and an AT&T DSL customer and have actually been using my DSL login stuff on the iPhone while waiting for the native connectivity. Actually, at the moment I am using my MacBook in a Starbucks to type this reply, believe it or not.
I have a friend who owns a small restaurant, selling smoothies and sandwiches. He has internet access from the back office, and uses it to communicate with vendors.
He doubled his breakfast and lunch business over the last few months by putting up a wireless router and giving away wifi access. The sign says "with any purchase" but there is no easy way to implement that, so he just leaves it unsecured. Most people buy something anyway.
It costs him almost nothing, and helps to sell food by making the location more welcoming to his customers. It won't take very long for other small food and beverage businesses to catch on.
It's kind of like "air conditioned" businesses used to be. Fifty years ago, air conditioning was unusual. But customers liked it, so the businesses that had it got the customers. Now, every business has it. The only real difference is that wifi is a lot cheaper to provide.
Every Starbucks I've ever been to has atleast 2 or 3. I can always count on mild and bold flavours. (What their names are is beyond me; I drink Lattes.)
BD Phone Home!
Shameless plug. Like you weren't expecting it.
A mistype to further confuse!
At this point, I feel it important to caution against the conflation of two words 'citation'.
A "citation" as in a ticket and court summons can be made for an administrative citation, a misdemeanor, or a felony.
A citation when used by name in practice refers to the administrative citation, not the document itself as it appears you may be using it. In some places administrative citations are also called infractions, ordinance violations, or regulation offenses; in no place is it a crime. One does not generally refer to a misdemeanor or felony ticket as a "citation".
Errrr...
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Comment removed based on user account deletion
Comment removed based on user account deletion
In Seattle, I can get free wi-fi in the parks and even on certain buses! Now if only I owned a laptop...
Sigs are for suckers.
I'm not sure if that's still only Wayport/McDonalds or all AT&T hotspots as well. They allow DSes to connect for Nintendo games, not sure about web browsing or homebrew. Anyone know how they implement that?
Not that it really matters to me, apparently I get free access by having a DSL account with them. Of course, I no longer have a laptop to actually use the WiFi.
They could add a check to see if the MAC (not that Mac) address is in the valid range for an iPhone. Yes, you can change your MAC address, but it's one more step that makes it harder to steal access.
jailbait.
Seriously. I don't know for sure that someone could be successfully prosecuted for this, but I wouldn't be too surprised if AT&T could press charges for this. Whether their security system is 'lame' or not, if they have some kind of security on the system, and you take steps to gain unauthorized access, you are seriously putting yourself in a place of at least risking arrest. There are all kinds of computer security and unauthorized access laws out there just waiting to be tested by ambitious prosecutors with the backing of 'deep pockets'.
"Actually, at the moment I am using my MacBook in a Starbucks to type this reply, believe it or not."
An Apple user, using their Apple Laptop. . . In a Starbucks, of all places. I just *cannot* believe it.
Although this is offtopic, the last line of your post, to me at least, sums up everything important that differentiates geeks/nerds from non-geeks/nerds.
I like it.
...and avoid corporate coffee. www.anchorfree.com The locally-owned joints are usually cooler.
...Lorenzo / I'm into kinky crustaceans. I just discovered internet praWn.
...lists free wife-eye locations. Eschew corporate coffee!
...Lorenzo / I'm into kinky crustaceans. I just discovered internet praWn.
The last starbucks I was at had ATAT wifi for free... or at least it let me log on.
There are a good many places in my city advertising free Wi-Fi, but that's not bringing any customers with computers. However, many people go to the library with their laptops. Lots of reasons for the discrepancy: the lack of electrical outlets at the businessplaces, maybe people feel more private at the library, and the library's Internet is really quick.
If the Wi-Fi isn't supposed to be free, but is available for a fee, then there must be a fairly good demand! What makes people pay for their Internet outside the home, perhaps aside from not having Internet at home? I guess there are some places where the population density is so high, there's a signal even in the home from a pay-to-use hotspot.
Know your pads. One time pad: good for cryptography. Two timing pad: where to take your mistress.
Most coffee shops in my area offer free wi-fi to anyone, Starbucks is the exception. Once you have the connection and router purchased, there is no extra cost for more users. A lot of users might slow the connection down, but using bandwidth throttling would be a better solution. You could still be slowed down by one paying customer that was running bittorrent.
I guess I did just read that you can get two hours per day just for buying and using a Starbucks card for your coffee instead of cash, that's not too bad. It's about time the price went down though. It used to be $10 for a single day and $40 for a month, now I think it's cheaper. I wouldn't really know though because I rarely go to Starbucks since I can get absolutely free wi-fi (and better coffee) at my locally owned coffee shop, Friedrich's.
I'm at a Starbucks, and I just tried it. I set my user agent to Mobile Safari - iPhone, and all that got me was a iPhone formatted AT&T login page asking for my AT&T login and password. Changing my user agent back to default produced a similar page formatted for a desktop browser.
Here's the user agent that my iPhone sends:
User-Agent: Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420.1 (KHTML, like Gecko) Version/3.0 Mobile/4A102 Safari/419.3
I love the fact that I wrote my own web server to spit out the client's header to the console...
No, I will not work for your startup