Free T-Mobile Hotspot Access with Windows Vista… or maybe free for all.
I just got back from my local QFC/Starbucks and sadly that free Vista/T-Mobile Hotspot access wasn’t working today though according to the Vista blog it should’ve been. I’m going to go back tomorrow and again on the 30th to test for sure. But apparently whatever new access site that should’ve gone live hasn’t as the gateway page didn’t look any different and there was nothing special that said, “hey look you’re using Vista here’s some free wifi”. To verify things I logged in using another account and checked skysurprise.com. Nothing really special other than that very fine print that says starting from the 30th. So either the Vista blog is lying or T-Mobile are just getting lazy and waiting till the 30th.
So why bother walking the 400 yards or so to the Starbucks when I’ve got perfectly good WiFi at home. Well, Dom, Jon, and I all thought that they’re probably be lazy and determine the Vistaness of any given laptop by just checking the user-agent. So I went with my Vista PC in hand with the user-agent set to spoof MSIE 6.0 and NT 5.1 thinking that even though I was running Vista it should think I’m running XP. If it worked then obviously running a XP machine and spoofing your user-agent to something like this:
Mozilla/4.0+(compatible;+ MSIE+7.0;+Windows+NT+6.0; +SLCC1;+.NET+CLR+2.0.50727;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+InfoPath.2;+.NET+CLR+1.1.4322)
Should also work to get you free acess on a XP machine because they’ve got no other way (other than to use some ActiveX control or client-side app) to determine whether the client is XP or Vista. I kinda doubt their hardware is going to be determining it. That would be too much work.
So anyway if any of you get bored just pop open regedt32 and go for it:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent]
“Version”=”MSIE 7.0″
“Platform”=”Windows NT 6.0″
I’m also curious if they’ll be good and let Firefox on Vista users in for their free WiFi or if they’ll have to spoof their user-agent as well.
UPDATE: Looks like Engadget got the same idea. However contrary to the earlier idea and what Engadget claim, just changing your user-agent doesn’t get you free WiFi. It seems that a key is generated after you install the required tmobile.cab ActiveX control. When viewing the properties for this add-on you find that it’s actually netdiag Class. Here’s a little code snip from the accountLogon page:
<body onload=”checkit()”>
<object classid=”clsid:A448E34F-EC78-4277-BDC5-DFA68C83C401″ id=”tmvista” codebase=”https://service1.hotspot.t-mobile.com/vista/pages/tmobile.cab” ></object><script language=”javascript”>
<!–
function checkit() {
var result = tmvista.CheckSpeed(’hardcd’);
window.location.replace(”checkVista.jsp?ticket=” + result);
}
–>
</script>
I’m a bit surprised they actually thought of the user-agent hack. But using an ActiveX control is a bit predictable. I’ve not had a chance to see what the tmobile.dll actually does.
All that being said. When you have your user-agent set to NT 5.1 (XP) it does indeed redirect you from the /vista page to an awareness page. If you switch to NT 6.0 and IE 7.0 you instead get redirected to this page to create your trial account. Once your trial account has been created you’re then redirected back to the login page. After you login it sends you to a page to install the ActiveX control above. Once that is done it creates a ticket which is then passed to whatever proxy gateway they have which enables your untethered access to the Internet whether that be in Firefox or IE7. If you do not install the ActiveX control (say for example by spoofing in Firefox) you get a message like the following: “You are trying to log in with an operating system that is incompatible with your account. Please try again with the Windows Vista operating system installed on your laptop.”
Now I’m going to guess that it’s probably pretty easy to see what’s going on with that ActiveX control and just pass your own ticket. But I’ll leave that to someone else.
If you want to download the 655KB ActiveX control click here and have fun.
UPDATE: Again people this DOES NOT WORK. It’s not a question of just downloading the ActiveX control it has to run and it has to pass on a Vista machine before T-Mobile allow you fully onto the Internet. Even if you switch your user-agent and create the trial account (which you can do on a Mac, PC, or Linux, and in IE or Firefox or whatever) by changing your user-agent to NT 6.0 and IE7.0 you still won’t get onto the Internet until you validate your Vista install by installing the ActiveX control. Think of the Windows Genuine Advantage stuff on downloads.microsoft.com.
UPDATE: After talking to Jon and someone else who has far greater will than I (wtbw) for all things related to debugging and disassembling there are some more details to provide. From what can be seen it looks like the ActiveX control is simply using the value of _time64 which is the number of seconds since midnight 1/1/1970 dividing that by 300 prefixing that string with hardcdPadded then making it a nice hex MD5 token for the /vista/pages/checkVista.jsp page.
It’s possible that the ActiveX control is looking for the referral from TMO’s own servers but it would be worth a shot to write a standalone app to do the above then send the request and token over to this page. You could do this from a web page however you’d have to host that locally since well, you can’t really get to the net until you bypass the ActiveX control anyway. So a quick non-complete example in one line of semi C# would be:
System.Cryptography.Thingy.MD5Hash.HashThisThing(”hardcdPadded” + (DateTime.Now.ToSeconds/300).ToString())
Obviously you’d want this to be cross platform or whatever. But I’ll leave that to the reader… 
