Abstract:

This technical blog post details a successful method for circumventing the "Messaging Only" free WiFi restrictions on a British Airways flight. The author identifies that the system uses Server Name Indication (SNI) filtering to whitelist traffic to domains associated with messaging apps. By manipulating the SNI field in the TLS handshake to mimic a whitelisted domain (wa.me), the author establishes a TLS tunnel to a personal server. This tunnel is then used to route traffic through a self-hosted HTTPS proxy, enabling general web browsing on the otherwise restricted network. The post notes that while the bypass works, the connection is still subject to heavy bandwidth throttling. A more advanced technique using Encrypted Client Hello (ECH) is also demonstrated, achieving the same result without triggering certificate errors. The author concludes that relying on SNI for access control is an insecure practice, as the field can be easily spoofed.

Bypassing British Airways' "Messaging Only" In-Flight WiFi

• Identifying the Restriction Mechanism: The author first discovered that British Airways offers free in-flight WiFi limited to messaging apps. Initial tests showed that general web browsing was blocked, leading to the hypothesis that the system uses SNI filtering—inspecting the domain name in the TLS handshake to allow traffic only to whitelisted messaging services.
• The Exploit Concept: The core of the bypass involves domain fronting. The author planned to connect to their own server but "spoof" the SNI to make the request look like it was going to a whitelisted domain (e.g., wa.me for WhatsApp), thereby tricking the firewall into allowing the connection.
• Technical Setup: To implement this, the author set up an HTTPS proxy on a personal VPS using tinyproxy and wrapped it in a TLS layer with stunnel. On their laptop, they configured their system to resolve the whitelisted domain (wa.me) to their VPS's IP address, ensuring the correct SNI was sent during the TLS handshake.
• Successful In-Flight Test: During the flight, the author connected to their custom HTTPS proxy. The firewall saw the whitelisted wa.me SNI and allowed the connection, which established an unrestricted tunnel to the author's server, enabling them to browse text-heavy websites like Hacker News.
• Key Limitation: Despite bypassing the domain filter, the connection speed was very slow, with images on simple websites loading line-by-line. This suggests the airline also implements heavy bandwidth throttling on the free "messaging" plan.
• Advanced Bypass with ECH: The author also successfully tested a more sophisticated method using Encrypted Client Hello (ECH). This technique hid the true destination domain within an encrypted layer while presenting wa.me as the public SNI, allowing a successful connection without the need to ignore self-signed certificate errors.
• Key Takeaway: The experiment serves as a practical demonstration that SNI should not be trusted for access control or threat detection. Since a user who controls both the client and a server can set the SNI to any value, it is not a reliable security measure.