On Monday, Delta flight 591 traveling from Las Vegas to Atlanta became the site of a suspected cyber incident when passengers allegedly spoofed the onboard Wi-Fi. The event occurred just one day after the DEF CON security conference concluded in Las Vegas.
The Nature of the Incident
The incident was first highlighted via ACARS (air-to-ground) messages sent by the pilots. According to records, the flight crew reported: "WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFERENCE IN LAS THEY WERE ABLE TO JAM OUR WIFI AND BROADCAST THEIR SIGNAL."
Reports from social media and Reddit suggest the perpetrators utilized an "evil twin" attack. This involved setting up a fraudulent hotspot named "Delta WiFi Fast," featuring a phishing landing page designed to harvest passengers' personal login credentials and data.
Official Response and Investigation
Delta spokesperson Morgan Durrant confirmed to Ars Technica that an unauthorized Wi-Fi network was present onboard for a short duration. In response, the actual onboard Wi-Fi was disabled for approximately 30 minutes.
- Flight safety was never in question.
- No aircraft operating systems were affected.
- No emergency was declared during the flight.
The FBI's Atlanta field office is currently looking into the matter. While agents did not meet the flight at the gate and no arrests have been made, spokesperson Tony Thomas stated they are in contact with local and corporate partners regarding the potential incident.
