Delta Flight Passengers Suspected of “Evil Twin” Attack After DEF CON

On Monday, aboard Delta Flight 591 en route from Las Vegas to Atlanta, one of the passengers apparently spoofed the plane's onboard Wi-Fi network — or so preliminary reports suggest. The story caught the attention of federal law enforcement, and it happened exactly one day after the DEF CON security conference wrapped up in Las Vegas, a coincidence that on its own looks too convenient to go unnoticed.

The first accounts of the incident came from social media accounts that monitor open air-to-ground radio traffic (ACARS). According to the “ACARS Drama” account, the pilots sent a message that ran roughly as follows: no information yet, but there's a group of passengers on board who attended a cyber conference in Las Vegas and managed to jam the onboard Wi-Fi and broadcast a signal of their own.

A classic “evil twin”

The details surfaced on Reddit: the passengers allegedly stood up a bogus access point called “Delta WiFi Fast” with a phishing landing page that harvested credentials and personal information. The technique has long been familiar to the infosec community and goes by the name “evil twin”: a counterfeit network is set up to mimic the real one, and through it the logins, passwords, and other data of trusting users who connect get intercepted.

Delta spokesperson Morgan Durrant confirmed the key details to Ars. According to him, one of the first things established was that, for a short time, an outside Wi-Fi network really was present on board — one the airline did not create, operate, or provide.

At the same time, Delta stresses that flight safety “was never for a moment in question,” the aircraft's onboard systems were unaffected, and no emergency was declared. The genuine onboard Wi-Fi was switched off for 30 minutes.

What the authorities say

Atlanta police referred all questions to the FBI. The bureau's local field office told Ars that it is looking into what happened, but there were no arrests, and agents did not meet the plane at the airport gate.

“The FBI in Atlanta is aware of reports of a potential Wi-Fi-related incident on Delta Flight 591,” said bureau spokesperson Tony Thomas. “We are in contact with our local and corporate partners. We have no additional information at this time.”

For now the story looks more like a reckless demonstration of a long-known technique in an extremely poor location than a serious threat. But the choice of audience — a plane packed with people who had just returned from a hacking conference — is unlikely to improve the perpetrators' chances of staying unidentified.

Source: Ars Technica