Google, Microsoft, Wireless Carriers Form Rare Alliance To Battle Marriott's Dumb Wi-Fi 'Jamming'

from the a-fight-you're-just-not-going-to-win dept

Back in October we noted how the FCC had fined Marriott $600,000 for the company's decision to block cellular signals in the company's Gaylord Opryland Hotel and Convention Center in Nashville. The move was pretty clearly intended to prevent people from using their tethered modems and cellular hotspots, instead forcing convention attendees to use Marriott's absurdly pricey (and frequently awful) Wi-Fi service. While Marriott agreed to pay the fine, the company tried to feebly defend itself by proclaiming it was only looking out for the security and safety of their customers (what a sweetheart):
"Marriott has a strong interest in ensuring that when our guests use our Wi-Fi service, they will be protected from rogue wireless hot spots that can cause degraded service, insidious cyber-attacks and identity theft," the statement said. "Like many other institutions and companies in a wide variety of industries, including hospitals and universities, the Gaylord Opryland protected its Wi-Fi network by using FCC-authorized equipment provided by well-known, reputable manufacturers."
While Marriott is bullshitting their way around what's clearly a transparent ploy to make money, both Marriott and some observers have argued that what Marriott's actually doing may not technically be illegal under anti-jamming provisions of section 333 of the Communications Act. That's because Marriott isn't technically jamming cellular signal, it's using a deauthentication attack -- or sending packets that misleadingly disrupt communications between a client and router, making using your mobile hotspot or tethered modem impossible. Hardware vendors commonly sell gear that can accomplish this, and the practice is very common at hospitals, some corporate campuses, and events like Defcon.

Of course even if Marriott were able to successfully legally argue this defense, it doesn't mean it isn't behaving badly. The FCC also seems unlikely to listen as some very heavy hitters this week entered the conversation. In a rare show of solidarity for companies often on very different sides of key tech issues, Microsoft, Google and wireless carriers have joined forces to yell at Marriott in new filings with the FCC. All of the filings argue that yes, Marriott's behavior does violate Section 333, and yes -- it's really just about Marriott being uncompetitive to make money:
"The Commission’s authority to prohibit the interference described by Petitioners is found in the plain language of Section 333 and supported by general grants of power in Section 303, as well as other provisions of the Communications Act. Contrary to Petitioners’ allegations, moreover, the Commission’s Rule 15.5(b) does not exempt unlicensed devices from protection against intentional, harmful interference. Under its statutory authority, and consistent with its Part 15 rules, the Commission has categorically warned against the use of equipment that blocks or jams authorized communications and recently found against the exact practices described in the petition."
Given the Sisyphean feat of battling the government, public perception, and some of the most wealthy and politically powerful technology companies in the world just so you can sell some over-priced Wi-Fi, the path of least resistance for Marriott would probably be to just stop behaving like a jackass.

Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    Anonymous Coward, 23 Dec 2014 @ 11:51am

    You underestimate their absolute need to be a jackass.

    And desire for money. But in this case, I really think it's the jackass portion that's going to stick out.

    reply to this | link to this | view in chronology ]

  • icon
    Berenerd (profile), 23 Dec 2014 @ 11:56am

    If I were to go there for a conference or some such I would be suing for them risking my safety. What if a terrorist were to take hostages of little children? Then I couldn't get out my twitter pic of the guy #OMGIAMAHOSTAGETWEETER

    reply to this | link to this | view in chronology ]

  • identicon
    RR, 23 Dec 2014 @ 12:00pm

    Which?

    Was it cellular they blocked, or wifi? The first paragraph says both. I find it hard to believe they would block 911 calls.

    We block wifi at work. Supposedly the range doesn't extend out of our building (which is surrounded by parking lots) and the vendor claims secret sauce that will only kill unauthorized WAPs plugged into our network. I have my doubts.

    reply to this | link to this | view in chronology ]

    • icon
      ltlw0lf (profile), 23 Dec 2014 @ 12:14pm

      Re: Which?

      Was it cellular they blocked, or wifi? The first paragraph says both. I find it hard to believe they would block 911 calls.

      From what I've read, they only blocked wifi. There was nothing preventing folks from using USB to tether. The problem with this is that it requires someone to connect a hard-wired network device to a USB connected hotspot and then run the connections via ethernet to the computers they wanted. Wifi is just a hell-of-a-lot easier and more efficient for connecting systems to the internet.

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 24 Dec 2014 @ 5:17am

        Re: Re: Which?

        No need for Ethernet cables.

        If you have and Android phone, you may be able to just plug in a USB OTG cable to your phone and an open USB port on your laptop.

        Turn on "USB tethering" in the "Settings > More... > Tethering & portable hotspot" settings, and you're good to go. No wifi needed.

        This will also charge your phone using the laptop's battery or power supply if plugged in.

        reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 23 Dec 2014 @ 12:01pm

    This is scum bag behavior for profit, nothing else.

    reply to this | link to this | view in chronology ]

  • icon
    ltlw0lf (profile), 23 Dec 2014 @ 12:08pm

    DEFCON Wifi Jamming

    events like Defcon

    DEFCON does not officially jam wifi during the conference. They jam wifi access points that use the name DefCon (or whatever SSID they are using) to prevent rogue access points. They don't prevent folks from setting up rogue access points, just rogue access points that are obviously rogue. DEFCON attendees may jam wifi, but they aren't doing so in any official capacity.

    However, anyone using wifi at DEFCON, or for that matter, any electronic device, should be using a throw-away device that will never be used in any setting other than DEFCON. The old adage goes, turn off anything electronic when entering Las Vegas during DEFCON, and don't turn it back on until you leave.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 23 Dec 2014 @ 12:08pm

    FCC-authorized equipment , I think we need to get our hands on it and set up outside of Marriotts nation wide , if it legal .

    reply to this | link to this | view in chronology ]

  • icon
    z! (profile), 23 Dec 2014 @ 12:17pm

    I suppose Marriott would probably complain loudly if someone else set up a 'deauth' box in their facility.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 23 Dec 2014 @ 12:21pm

    Assuming they didn't interfere with a licensed 2.4GHz user IE federal or HAM radio then they didn't do anything illegal. Rather, they exploited a piece of the protocol in the ISM / unlicenced band where basically anything goes... As long as you don't dick with a licensed user.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 23 Dec 2014 @ 12:23pm

      Re:

      Microwave oven's running could just as easily "JAM" wifi, but GE isn't being sued for selling jamming devices. This is why ISM exists

      reply to this | link to this | view in chronology ]

      • icon
        ltlw0lf (profile), 23 Dec 2014 @ 12:51pm

        Re: Re:

        Microwave oven's running could just as easily "JAM" wifi, but GE isn't being sued for selling jamming devices. This is why ISM exists

        WiFi, and other applications that use the ISM band (2.4 gHz) are specifically designed not to be jammed by broken Microwave oven's, and are specifically licensed by the FCC to operate in the ISM band (it is illegal to use a device that is not licensed by the FCC, which is why my cantenna doesn't come out when the FCC is around.)

        GE gets away with it partly because they attempt to shield their devices so that they don't inject a lot of interference. All microwave ovens have to have an FCC-issued Equipment Authorization (as does any other device that emits radio noise.) If you took a microwave apart and built a device using the magnatron from the microwave to specifically jam wifi, I suspect the FCC van would be arriving at your house shortly to make life miserable for you.

        reply to this | link to this | view in chronology ]

        • icon
          nasch (profile), 29 Dec 2014 @ 9:32am

          Re: Re: Re:

          (it is illegal to use a device that is not licensed by the FCC, which is why my cantenna doesn't come out when the FCC is around.)

          Just curious, when is the FCC around?

          reply to this | link to this | view in chronology ]

          • icon
            ltlw0lf (profile), 1 Jan 2015 @ 9:33am

            Re: Re: Re: Re:

            Just curious, when is the FCC around?

            I occasionally see an FCC SURVEILLANCE VAN SSID appear in my war-driving logs...

            I see a lot more FBI SURVEILLANCE VAN and NSA SURVEILLANCE VAN SSIDs lately, so I think they are more active.

            ;-)

            Seriously though, I don't even bring my cantenna with me to the airport any more...the TSA guys get really excited when they see a Pringles can with wires and metal rods in it going through their checkpoints.

            reply to this | link to this | view in chronology ]

            • icon
              nasch (profile), 1 Jan 2015 @ 12:11pm

              Re: Re: Re: Re: Re:

              Seriously though, I don't even bring my cantenna with me to the airport any more...the TSA guys get really excited when they see a Pringles can with wires and metal rods in it going through their checkpoints.

              Well, it doesn't take much to get those guys going.

              reply to this | link to this | view in chronology ]

    • icon
      AH2014 (profile), 23 Dec 2014 @ 12:47pm

      Re:

      Hasn't the government already decided they did something illegal by fining them and getting them to sign the consent decree?

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 23 Dec 2014 @ 2:31pm

        Re: Re:

        Hasn't the government already decided they did something illegal by fining them and getting them to sign the consent decree?
        No, the government decided they had done something which could be argued in court. The consent decree says that Marriott decided that settling was cheaper and/or safer than pursuing the fight in court. They might have won, or might not have won, depending both on the clarity of the law and the quality of the lawyers used. When the government is one party to the suit, even winning can be costly, since you often cannot get the government to pay attorney's fees. Settling may have been cheaper than winning, if winning was even a realistic option.

        reply to this | link to this | view in chronology ]

  • icon
    TKnarr (profile), 23 Dec 2014 @ 12:36pm

    I wonder what'd happen if a properly-licensed ham operator set up an access point? Normally unlicensed users have to give way and avoid interfering with a licensed operator in bands the operator's licensed to use, and when last I looked the higher grades of ham license allowed operation in the 2.4GHz and 5GHz WiFi bands.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 23 Dec 2014 @ 1:29pm

    The denial of service attack Marriott is using, is a deauthentication attack exploiting a security weakness in the IEEE 802.11 wifi standard.

    The deauthentication attack works because the 802.11 standard doesn't encrypt deauthentication packets being sent between the wireless router and the clients connected to it.

    So all an attacker needs to do, in this case Marriott, is look for any wireless routers broadcasting in their hotel. Spoof that routers MAC address. Then broadcast deauthentication radio messages that pretend to be coming from the wireless router attempting to be blocked.

    Wifi clients will believe this spoofed deauthentication message was really sent from the legitimate router, because the MAC address matches. There's no encryption or strong authentication standards for deauthentication messages in the 802.11 standard. Only MAC address authentication, which is easily spoofable. WEP, WPA, and WPA2 don't encrypt deauthentication messages.

    There's two ways to prevent such attacks. Either manually patch your open source wifi adapters firmware and/or drivers so they ignore deauthentication flooding.


    if(deauth_req_count > 2 && last_time_deauth < (10 * SECONDS)) ignore_deauth_req(10 * MINUTES);

    http://hackaday.com/2011/10/04/wifi-jamming-via-deauthentication-packets/#comment-471998


    Or simply tether your laptop to your smartphone using a USB tether cable.

    reply to this | link to this | view in chronology ]

  • icon
    Andrew Norton (profile), 23 Dec 2014 @ 1:57pm

    I got hit with a bunch of questions over this, because I work the EFForums track at Dragoncon, which uses the Marriott Marquis, Hyatt Regency, Hilton Atlanta, Westin and Sheraton in downtown Atlanta. 60,000+ attendees all after wifi. Even SMS failed half the time in 2013, but the cellphone companies brought in a whole bunch of extra capacity for this year.

    We run our own hotspots (including a wall-o-sheep, sponsored by DC404; and one based on a rasperry pi. Plus a connection for the space track to run their late-night live astronomy in Chile) and not noticed any issues. You can bet we'll be on the lookout for any issues.

    reply to this | link to this | view in chronology ]

  • icon
    tom (profile), 23 Dec 2014 @ 6:47pm

    I stayed at the Fairfield Inn by Marriott in Atlanta for Dragoncon 2013 and 2014 and they include wifi with the room. A friend's hot spot worked fine via wifi as well.

    It may be Marriott corporate wanting to squeeze a little extra profit out of hotels actually owned by Marriott.

    Of course, with the room and parking rates the hotels charge during Dragoncon, they don't need to charge for wifi...

    reply to this | link to this | view in chronology ]

    • icon
      nasch (profile), 29 Dec 2014 @ 9:35am

      Re:

      I stayed at the Fairfield Inn by Marriott in Atlanta for Dragoncon 2013 and 2014 and they include wifi with the room.

      Other Mariott-owned chains do include wifi, it's just the hotels actually called Mariott that charge for it (IIRC).

      reply to this | link to this | view in chronology ]

  • identicon
    Lawrence D’Oliveiro, 23 Dec 2014 @ 7:48pm

    What Is A “Rogue Access Point” Anyway?

    People do realize that on the Internet, security is enforced at the endpoints, right?

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 24 Dec 2014 @ 1:59am

    In Europe, customers usually leave or do not book a hotel if there is NO FREE WIFI. Free wifi as a selling point - I suggest Marriot execs look at theur EU branch...

    reply to this | link to this | view in chronology ]

    • icon
      R.H. (profile), 24 Dec 2014 @ 7:14am

      Re:

      That's the thing, at the Marriotts in question, the WiFi isn't free. There's a fee to use it. Which, in my opinion, makes this that much worse. They're blocking competition to increase revenue.

      reply to this | link to this | view in chronology ]

  • identicon
    Lawrence D’Oliveiro, 25 Dec 2014 @ 12:31pm

    Can The FCC Regulate Above The Physical Layer?

    Wi-fi runs on “unlicensed” bands. That means you are allowed to do pretty much what you like, so long as you don’t exceed certain power limits.

    As I understand it, Marriott is not actually jamming the signals (which would require transmitting signals beyond the legal power limits), merely sending spoof packets that cause the connections to drop.

    Does the FCC have the power to regulate this sort of thing? It seems to me it would have no say on what protocols (or perversions of protocols) people use on these bands, just so long as everybody stays within the power limits.

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Insider Shop - Show Your Support!

Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.