Slashdot Mirror
Wi-Fi Hotspot Blocking Persists Despite FCC Crackdown (networkworld.com)
An anonymous reader writes: An examination of consumer complaints to the FCC over the past year and a half shows that the practice of Wi-Fi hotspot device blocking continues even though the agency has slapped organizations such as Marriott and Hilton more than $2 million in total for doing this. Venues argue they need to block hotspots for security reasons, but the FCC and consumers say the organizations are doing this to force people to pay for pricey Internet access.
"Consumers who purchase cellular data plans should be able to use them without fear that their personal Internet connection will be blocked by their hotel or conference center," FCC Enforcement Bureau chief Travis LeBlanc said in a statement. "It is unacceptable for any hotel to intentionally disable personal hotspots while also charging consumers and small businesses high fees to use the hotel's own Wi-Fi network. This practice puts consumers in the untenable position of either paying twice for the same service or forgoing Internet access altogether." Consumers have filed many complaints about Wi-Fi hotspot blocking to the FCC.
"Consumers who purchase cellular data plans should be able to use them without fear that their personal Internet connection will be blocked by their hotel or conference center," FCC Enforcement Bureau chief Travis LeBlanc said in a statement. "It is unacceptable for any hotel to intentionally disable personal hotspots while also charging consumers and small businesses high fees to use the hotel's own Wi-Fi network. This practice puts consumers in the untenable position of either paying twice for the same service or forgoing Internet access altogether." Consumers have filed many complaints about Wi-Fi hotspot blocking to the FCC.
In recent years, I have rarely stayed at a first class hotel that did not have free guest w-fi. People expect it and will bail for the local coffee shop if it's not free in the hotel.
My guess is a lot of the offenders are in tourist traps where everything costs a lot.
If you want news from today, you have to come back tomorrow.
First offense, $5 million. Second, $50 million and jailtime for those responsible for the policy. Third offense, $500 million, and so on.
A government is a body of people notably ungoverned - AC
Make offending organizations pay $25+ million. Make them hurt. Better yet, jail some of the executive staff. Organizations are people and the board and C level suite are the head. Works for me!
So If they block all wifi any force you to use a ethernet connection in you room for an extra $25 that's ok then?
Minimum threshold fixed. Thanks!
But wi-fi "blocking" gets a free pass? Have the FCC throw the book at them.
Venues argue they need to block hotspots for security reasons
Due to security reasons we are preventing people from running their own closed network between their devices and their telecom companies and instead forcing them all into our own network joined up with hundreds of other strangers ....
Experiments have found that unsecured hotspots in airports will be connected to by hundreds of strangers, running Firesheep etc. they can be easily MITMed. I'm sure the same is true in hotels, people don't bother to find out what the hotel's Wifi ID is. Blocking other hotspots prevents people from connecting to any attempts to MITM them.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Cisco calls it containment. Centrally managed access points will send deauth or deassociation frames to clients connected to "rogue" APs.
We use it at my job, but only for our SSIDs ie., if you set up an AP or hotspot with the same SSID as ours, the containment feature will attempt to stop clients from associating. Our company name is part of the SSID, so it's not like you can innocently or accidentally have your connections to your hotspot blocked.
That said, there have been times when I wished we simply banned the use of hotspots (we provide free, fast wi-fi) due to the RF interferences. At one point, 90 hotspots were operating in a ballroom competing for a limited number of 5ghz channels and everyone's experience suffered. When we asked people to disable their hotspots and connect to our unfiltered, unthrottled, free connection, about 70 did and the performance for everyone was (reported by them to be) better.
Probbably something like this:
https://github.com/DanMcInerne...
Using wifi deauth packets.
Minimum threshold fixed. Thanks!
I am a startup that sets up electronic visual attractions at large venues at facilities like these. For configuration purposes, the units contain APs which are supposed to be connected to via the organizer's phone in order to allow them to control the attractions.
Twice I ran into cases where I was simply unable to connect to any of the units and I had no idea why. Eventually to debug this pulled up wireshark and found someone was performing a de-authentication attack! This was at two different events, but at large hotel chains. Had I not had a wired backup, I could have easily been out some several thousand dollar paychecks.
Doctor evil doesn't care about 'Two Million'. Seriously, why not try to fine them a amount that will make it unprofitable.
So...... would disabling SSID broadcast stop the devices from getting the info for a successful deauth attack? I don't know... I'm asking... I know it'd be able to see the macid of the ap, but is that enough to do a deauth?
Cisco calls it containment. Centrally managed access points will send deauth or deassociation frames to clients connected to "rogue" APs.
We use it at my job
What is your job, so that I can complain to the FCC?
I don't think there would be an FCC enforcement action over something like this. So long as you're allowing other wireless hotspots if they aren't trying to impersonate you, that should be fine.
In the FCC enforcement advisory put out after Marriott, one of the things they mentioned was that Marriott "admitted that the customers it blocked did not pose a security threat to the Marriott network..." If there is a security threat, that does change the situation. You can see that advisory here: https://apps.fcc.gov/edocs_public/attachmatch/DA-15-113A1_Rcd.pdf
In fact, I would argue that by trying to put up a wireless network with the same or a similar name, that would constitute an attempt at interference by them. Either way, the FCC is indicating it would consider valid security concerns.
But wi-fi "blocking" gets a free pass?
How is getting a $2 million fine a "free pass"? That guy who got arrested for using a phone jammer had already been caught once before doing the same thing and yet continued the illegal activity, just the same as the hotels. There is no double standard going on (yet).
Up the ante a bit, and have someone with a ham radio license file a complaint, not about WiFi blocking but about an unlicensed operator's (the hotel) interference with a licensed operator's transmissions. The rules about that, IIRC, apply even on the unlicensed bands and give the FCC well-established grounds to shut down the hotel's WiFi completely until it modifies the equipment to eliminate the interference.
I was going to post the same thing. With the added comment that IIRCC most private hotspots are actually just cell phones with a "data only" type 3g connection and an standard 802.11x AP.
The only way I can see those getting jammed is either something is jamming every other wi-fi channel or they jam the 3G connection.
In both cases they are willfully interfering with a commercial radio device. I seem to recall there are laws about jamming ANY commercial radio signal.
Could someone with more knowledge about this please clarify?
1 to certify your location as requiring CELL PHONE JAMMERS you need to file with the FCC/FTC actual valid proof of this requirement (in detail and each floor /1000 foot area must have a separate listed reason). there will be a $20K per area fee and this must be filed yearly (twiddle the form each year to prevent simple copy/paste).
or
2 provide free uncapped wifi to all clients/guests (give them the credentials when they check in)
oh and if you get "caught" then your CXO rack has to pay out of pocket to refund all fees collected and they are personally liable for any lawsuits. (oh and then you get fined as a business)
So.... you are saying that it would not stop the deauth attack? not exactly clear on your answer.