Mile-high Web provider Gogo appears to be running man-in-the-middle attacks on its own customers.
Based on a report by Google engineer Adrienne Porter Felt, Gogo Inflight Internet is serving SSL certificates from Gogo instead of site providers—a big no-no in online security.
The move could mean that passwords and other sensitive information entered while logged into the Gogo service could have been compromised.
A member of the Google Chrome security team, Porter Felt last week tweeted a screenshot of her computer during a flight.
hey @Gogo, why are you issuing *.google.com certificates on your planes? pic.twitter.com/UmpIQ2pDaU
— Adrienne Porter Felt (@__apf__) January 2, 2015
The image clearly shows that Gogo signed the certificate, not Google, thus misleading customers and opening the door to malware on users' devices. It also serves as a way to throttle data and limit traffic on its networks.
"Gogo takes our customer's privacy very seriously and we are committed to bringing the best Internet experience to the sky," CTO Anand Chari said in a Monday statement.
"Right now, Gogo is working on many ways to bring more bandwidth to an aircraft," he continued. "Until then, we have stated that we don't support various streaming video sites and utilize several techniques to limit/block video streaming."
According to Chari, also the company's executive vice president, Gogo recently implemented an off-the-shelf solution that proxies secure video traffic to block it.
"Whatever technique we use to shape bandwidth, it impacts only some secure video streaming sites and does not affect general secure Internet traffic," he continued. "These techniques are used to assure that everyone who wants to access the Internet on a Gogo-equipped plan will have a consistent browsing experience."
The aircraft communications service provider in April announced new technology, expected to launch on commercial flights in mid-2015, which will provide in-flight Internet speeds of more than 70 Mbps.
The 2Ku Wi-Fi service uses the same low-profile antennas as Gogo's Ground to Orbit (GTO) tech, but also relies on two low-profile, high-efficiency Ku-band satellite antennas.
"We can assure customers that no user information is being collected when any of these techniques are being used," Chari said. "They are simply ways of making sure all passengers who want to access the Internet in flight have a good experience."
In September, Virgin Atlantic added Gogo Web connectivity to its flights, marking the first European airline to partner with the company.