FBI probes suspected Wi-Fi spoofing attack on Delta flight by DEF CON attendees

The FBI Atlanta is investigating a suspected cyber security incident aboard Delta Flight 591, where passengers allegedly used an "evil twin" technique to spoof the aircraft's Wi-Fi network. The attack, which occurred shortly after the conclusion of the DEF CON security conference in Las Vegas, involved the creation of a fake hotspot designed to harvest personal credentials from other travellers.

The incident was first brought to light through social media accounts that monitor ACARS, or air-to-ground messages. According to the "ACARS Drama" account, a message sent by the pilots stated: "NO INFO AS OF NOW WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFERENCE IN LAS THEY WERE ABLE TO JAM OUR WIFI AND BROADCAST THEIR SIGNAL."

Further details emerged from a Reddit description of the event, which alleged that passengers created a fake network named "Delta WiFi Fast" and directed users to a phishing landing page. This method, known in the IT security community as an "evil twin" attack, involves setting up a rogue access point to capture login credentials and other sensitive data.

Delta Air Lines confirmed the presence of the unauthorized network but emphasised that the aircraft's safety was never compromised. Morgan Durrant, a Delta spokesperson, told Ars Technica that the network was not provided, operated, or supplied by the airline. The carrier noted that the actual onboard Wi-Fi was disabled for 30 minutes, but no emergency was declared and no aircraft operating systems were affected.

The Atlanta Police Department referred all inquiries regarding the matter to the FBI. Tony Thomas, a spokesperson for FBI Atlanta, confirmed the bureau is in contact with local and corporate partners but stated that no arrests have been made and agents did not meet the flight at the gate. "We have no additional information to provide at this time," Thomas said.