Full Report
Delta Air Lines is investigating an unauthorized Wi-Fi network that appeared aboard a flight from Las Vegas to Atlanta carrying passengers who had attended the DEF CON hacker convention. [...]
Analysis Summary
# Incident Report: Unauthorized In-Flight Wireless Network and Deauthentication Attack
## Executive Summary
During a flight from Las Vegas to Atlanta, unauthorized individuals allegedly launched a Wi-Fi deauthentication attack to disrupt the legitimate in-flight network. This was followed by the broadcast of a rogue "Evil Twin" access point designed to phish for passenger credentials. Delta Air Lines responded by deactivating onboard Wi-Fi and coordinating with federal law enforcement upon arrival.
## Incident Details
- **Discovery Date:** August 10, 2026
- **Incident Date:** August 10, 2026
- **Affected Organization:** Delta Air Lines (Flight 591)
- **Sector:** Aviation / Transportation
- **Geography:** En route from Las Vegas (LAS) to Atlanta (ATL), USA
## Timeline of Events
### Initial Access
- **Date/Time:** August 10, 2026, Mid-flight
- **Vector:** Proximity-based wireless exploitation (802.11 deauthentication)
- **Details:** Attackers targeted the aircraft's legitimate wireless infrastructure using forged management frames.
### Lateral Movement
- **Movement:** Not applicable in the traditional network sense; the attackers moved "horizontally" across the passenger pool by forcing them off the legitimate AP and toward a rogue AP.
### Data Exfiltration/Impact
- **Impact:** Disruption of authorized Wi-Fi services for 199 passengers. Reports indicate the creation of a phishing page to harvest Google login data and other personal credentials.
### Detection & Response
- **Detection:** Crew became aware of the disruption and unauthorized network; ACARS messages confirmed the presence of a "scam Wi-Fi."
- **Response Actions:** Cabin crew deactivated all onboard Wi-Fi for approximately 30 minutes to mitigate the attack. Federal agents and airport police met the aircraft upon landing to seize hardware and question suspects.
## Attack Methodology
- **Initial Access:** Wi-Fi Deauthentication (802.11 denial-of-service).
- **Persistence:** Continuous transmission of forged deauthentication frames to prevent reconnection to the legitimate AP.
- **Privilege Escalation:** N/A (Focused on user-level credential harvesting).
- **Defense Evasion:** Use of a legitimate-sounding SSID ("Delta WiFi Fast") to trick users.
- **Credential Access:** Phishing pages designed to mimic login portals.
- **Discovery:** Identification of the legitimate AP’s MAC address via wireless sniffing.
- **Lateral Movement:** N/A.
- **Collection:** Harvesting of submitted form data (credentials) on the rogue AP.
- **Exfiltration:** Capture of credentials onto the attackers' portable hardware.
- **Impact:** Denial of Service (DoS) for legitimate Wi-Fi; compromise of passenger accounts.
## Impact Assessment
- **Financial:** Undisclosed; potential loss of Wi-Fi revenue for the flight duration and investigative costs.
- **Data Breach:** Potential theft of Google logins and personal credentials from passengers who connected to the rogue network.
- **Operational:** 30-minute shutdown of non-essential aircraft communication systems (Wi-Fi).
- **Reputational:** High-profile incident involving the cybersecurity community (DEF CON attendees).
## Indicators of Compromise
- **Network:** Unauthorized SSID "Delta WiFi Fast".
- **File:** N/A (Hardware-based attack).
- **Behavioral:** High volume of 802.11 deauthentication frames; presence of an unauthorized captive portal asking for third-party (Google) credentials.
## Response Actions
- **Containment:** Intentional shutdown of the aircraft's Wi-Fi systems by the crew.
- **Eradication:** Physical seizure of portable Wi-Fi broadcasting hardware by law enforcement upon landing.
- **Recovery:** Resumption of standard flight operations and handover to federal investigators.
## Lessons Learned
- **Management Frame Protection:** The aircraft's Wi-Fi infrastructure may not have been utilizing Protected Management Frames (PMF), which allows for easy deauthentication spoofing.
- **Crew Training:** The crew’s ability to recognize a "scam Wi-Fi" and use ACARS to report it was critical for a law enforcement response.
- **User Education:** Passengers should be reminded that legitimate in-flight Wi-Fi rarely, if ever, requires a third-party social media or email login (e.g., Google).
## Recommendations
- **Technical:** Implement 802.11w (Protected Management Frames) on all aircraft access points to prevent deauthentication attacks.
- **Policy:** Enhance pre-flight announcements to include warnings about verifying the correct SSID for in-flight internet.
- **Monitoring:** Deploy automated wireless intrusion detection systems (WIDS) on aircraft to alert crew of rogue access points or jamming attempts in real-time.