Delta flight declares emergency after rogue Wi-Fi network appears onboard

A Delta Air Lines flight from Las Vegas to Atlanta was forced to declare an in-flight emergency this week after an unauthorized Wi-Fi network appeared on the aircraft, prompting a federal investigation.

The incident unfolded on a flight carrying 199 passengers, notably including attendees returning from the DEF CON cybersecurity convention in Las Vegas. During the flight, passengers noticed an unauthorized network named “Delta WiFi Fast” broadcasting inside the cabin.

Delta confirmed that its core operating systems and official in-flight Wi-Fi network were never hacked or compromised. However, out of an abundance of caution, cabin crew disabled the aircraft’s Wi-Fi functionality for approximately 30 minutes while the rogue signal was active.

Upon landing in Atlanta, law enforcement and aviation authorities met the aircraft to question passengers and investigate the equipment used to broadcast the network.

According to cybersecurity experts, the incident involved an “evil twin” attack, where a small, battery-powered device is used to broadcast a fake Wi-Fi network mimicking a legitimate service.

Aras Nazarovas, a Senior Information Security Researcher at Cybernews, explained the mechanisms and risks associated with such attacks.

“An evil twin attack is when hackers create fake Wi-Fi networks with the goal of stealing sensitive information from people, or exploiting known vulnerabilities present on victim devices,” Nazarovas said. “Once a person connects to the hacker’s Wi-Fi network, the hacker may be able to see what the victim is doing online and what data they transfer.”

Nazarovas noted that while modern HTTPS encryption protects much of a user’s web traffic, the primary danger stems from phishing pages, such as fake login portals designed to harvest credentials, email addresses, or financial data.

Regarding passenger safety, Nazarovas advised that individuals who merely connected and disconnected from the unauthorized network without entering information or clicking suspicious links are likely unaffected.

However, anyone who inputted credentials, downloaded files, or shared payment details on an unfamiliar page should immediately change passwords, run malware scans, and secure affected bank accounts.

Delta stated that it is cooperating fully with federal law enforcement and aviation regulators to complete a thorough investigation into the source of the unauthorized network.