Delta Flight Disrupted by WiFi Mishap

AnotherAviationGeek

AnotherAviationGeek

Pre-Flight
Joined
Jun 25, 2026
Messages
73
Location
Spencer, IN
Display Name
AnotherAviationGeek
Home Airfield
KGPC
On Monday, a Delta flight from Las Vegas to Atlanta was disrupted by an "unusual WiFi alert". A rogue WiFi network, titled "Delta WiFi Fast", was shown on device's WiFi connection screen. The aircraft did not declare an emergency.

The WiFi network was probably made using some sort of ESP-32 running a WiFi network to try to trick people into connecting to the WiFi to hack them.

Article here: https://www.msn.com/en-us/news/other/delta-flight-disrupted-by-unusual-wifi-alert/
 
Was that the flight carrying a bunch of DEFCON attendees?
 
Like, it's so difficult to create an ad hoc wifi network. I suspect the extent of the disruption was that people saw something "cleverly" named in the list of available networks like "Boeing 737 Critical Flight Network" or the like.

While I'd never do that in the air, when I lived in a townhouse where there were lots of WIFI SSIDs being beaconed all over the place. I found one called "ItHurtsWhenIP" and I countered it by renaming my network "TryCranberryJuice."
 
Lindberg said:
Or just the hotspot on their phone. I'm having a lot of trouble figuring out why this is news or interesting.
Click to expand...
If you create a hotspot, wouldn’t that just show as an additional network SSID in addition to the valid Delta wifi SSID? News reports seem to imply there was “jamming” of the valid Delta wifi, which goes beyond a hotspot/ad-hoc network.
 
AquaLand said:
If you create a hotspot, wouldn’t that just show as an additional network SSID in addition to the valid Delta wifi SSID? News reports seem to imply there was “jamming” of the valid Delta wifi, which goes beyond a hotspot/ad-hoc network.
Click to expand...
Sounds more like a phishing "spoof".
 
AquaLand said:
If you create a hotspot, wouldn’t that just show as an additional network SSID in addition to the valid Delta wifi SSID?
Click to expand...
Yes.
AquaLand said:
News reports seem to imply there was “jamming” of the valid Delta wifi, which goes beyond a hotspot/ad-hoc network.
Click to expand...
Where'd you get that? I don't infer that from anything in the linked story.

It does say they "shut down the wifi" for about 30 minutes, but I have no idea why. I might speculate that some non-tech-savvy FA could be confused by the situation and decide that turning off the plane's wifi might be helpful, and then after doing so realize that there was no effect on the other observed wifi signal, so they turned the plane's wifi back on again. But that's just speculation. :dunno:
 
Jim_R said:
Where'd you get that? I don't infer that from anything in the linked story.
Click to expand...
PC Mag article reported ACARS message from aircraft:

NO INFO AS OF NOW WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFRENCE IN LAS THE WERE ABLE TO JAM OUR WIFI AND BRODCAST THERE SIGNIAL
Click to expand...

Tom’s Hardware article also referenced jamming.
 
AquaLand said:
If you create a hotspot, wouldn’t that just show as an additional network SSID in addition to the valid Delta wifi SSID? News reports seem to imply there was “jamming” of the valid Delta wifi, which goes beyond a hotspot/ad-hoc network.
Click to expand...

I don't know if you can name a hotspot with a leading space. Some computers will list the wifi networks alphabetically, so maybe one could push the legitmate wifi networks down the list by making one or more wifi networks with a leading space in the SSID...
 
It wasn't just an extra SSID from an adhoc network. It was a little more concerning than that for the flight crew.

cybersecuritynews.com

DEF CON Attendees Allegedly Jammed Plane Wi-Fi and Broadcast Fake ‘Delta WiFi Fast’ Network

A Delta Air Lines flight carrying passengers home from the world’s largest hacking conference became the center of a rapidly unfolding cybersecurity scare on Monday, after crew members reported that someone onboard had jammed the aircraft’s official Wi-Fi and stood up a convincing fake network...
cybersecuritynews.com cybersecuritynews.com
 
'Some social-media accounts and private flyer-group posts further claimed the operators used a portable auditing device such as a Wi-Fi Pineapple to deauthenticate devices from the legitimate cabin network colloquially described by the crew as “jamming" before presenting their own phishing page.'
 
Jim_R said:
Yes.

Where'd you get that? I don't infer that from anything in the linked story.

It does say they "shut down the wifi" for about 30 minutes, but I have no idea why. I might speculate that some non-tech-savvy FA could be confused by the situation and decide that turning off the plane's wifi might be helpful, and then after doing so realize that there was no effect on the other observed wifi signal, so they turned the plane's wifi back on again. But that's just speculation. :dunno:
Click to expand...
Did they try shutdown engines and restart? Isn't that what good Pakistan tech support would recommend?
 
Bob Noel said:
I don't know if you can name a hotspot with a leading space. Some computers will list the wifi networks alphabetically, so maybe one could push the legitmate wifi networks down the list by making one or more wifi networks with a leading space in the SSID...
Click to expand...
You can have multiple APs with the same SSID. Most networks do. The endpoint should connect to the one with the strongest signal, and if properly configured, roam between APs.

Spoofing uses rogue APs that are on that SSID but not connected to the real network, or connected on the backend in order to do man-in-the-middle attacks.

Some Wifi systems can detect and report spoofing, but I have no idea whether the onboard systems do this.
 
Just some showing off by one of the convention attendees. The perpetrator and his seatmates got a good laugh from the stunt.

I'm pretty sure the airplane wasn't in danger of falling out of the sky.
 
BTW, this can happen anywhere you use wifi. Zero Trust. Best practice is to always use a VPN. And never type your credentials into a random wi-fi portal.
 
I've heard that the SSID in question was "Delta Fast WiFi".

And turning off the plane's WiFi was a great way to get everyone else trying to connect to the spoofed one. :rolleyes:
 
3393RP said:
Just some showing off by one of the convention attendees. The perpetrator and his seatmates got a good laugh from the stunt.

I'm pretty sure the airplane wasn't in danger of falling out of the sky.
Click to expand...
I'm pretty sure that intercepting a wifi signal is illegal. Because it is. Even if done for "street cred".
 
I think we have a higher than average tech IQ in this group who discounts (correctly) the risk associated with this incident. I suspect an average, likely less tech savvy, flight crew saw something that seemed like hacking was happening to an on-board system, they'd be taking it seriously and shutting down what they could.
Is the on-board wifi and what it is and isn't connected to documented in the POH?
 
Hang 4 said:
Is the on-board wifi and what it is and isn't connected to documented in the POH?
Click to expand...

It’s mostly connected to pax headsets and PEDs…

Flight attendants know little about it. Pilots know VERY little about it.

It’s THAT unimportant…

There’s “click click, click click”, kills the auto pilot and auto throttles. Pretty sure there’s not a third “click click” to disengage inflight entertainment from ANYTHING.
 
Hang 4 said:
I think we have a higher than average tech IQ in this group who discounts (correctly) the risk associated with this incident. I suspect an average, likely less tech savvy, flight crew saw something that seemed like hacking was happening to an on-board system, they'd be taking it seriously and shutting down what they could.
Is the on-board wifi and what it is and isn't connected to documented in the POH?
Click to expand...
I don't take issue with them shutting it off and warning passengers off the pirate signal. But it isn't remotely newsworthy.
 
It's possible they just used their own AdHoc with the the SSID that the airline IFE uses and it picked up some of the people connecting to it.
 
Long time network and security geek here.. And I almost went to that conference :) I suspect they don't mean jamming in the RF sense--broadcasting a signal to interfere directly with the wifi band. Wifi signals are in the 2.4 GHz and 5.8 GHz range, far away from anything aviation cares about, so RF jamming still shouldn't affect flight safety.

The reason we caution people against using public wifi is it's pretty easy to create a wifi network that appears to be legitimate. If the plane's wifi network is called 'Delta WiFi', a bad guy or conference geek, would create another network called 'Delta WiFi'. Some newly-connected devices would simply choose the attacker's network. It looks a phone or tablet like the bad network is just another Delta wifi access point, similar to what you'd see in a campus environment: multiple access points broadcasting the same network. Once connected to the fake 'Delta WiFi', the attacker passes the traffic through their device then along to the legitimate 'Delta WiFi', giving the attacker a view of the client's traffic.

But most devices are already connected to the legitimate 'Delta WiFi' network, especially if that one came online and started broadcasting first. The bad guy can see which clients are connected to the legitimate network. That's all transmitted in the clear, even on wifi networks running encryption. The attacker can make a list of those clients and spoof a 'deauthentication frame'. That's a standard message from an access point to a client telling them that the access point is closing the connection. That happens when, for instance, a wifi access point is restarted--it tells the client to find another access point. That deauth frame is not encrypted, even on encrypted wifi. So the attacker spoofs the deauth frame from the legitimate Delta network to the client, the client still wants to find a 'Delta WiFi' access point, and it finds the only other 'Delta WiFi' available, which is the attacker's.

I suspect that's exactly what happened, and the media is confusing the 'deauth frame' with 'jamming'. If the attacker's fake access point was misconfigured, clients would have experienced connection problems after switching over, and that may have prompted the flight crew to restart the wifi system and given credence to the 'jamming' reports.
 
Last edited:
They don't even need to pick a different SSID. Multiple SSIDs show up with the same name all the time (my house has eight). The client picks whichever one appears to be strongest.
 
Kenny Phillips said:
I'm pretty sure that intercepting a wifi signal is illegal. Because it is. Even if done for "street cred".
Click to expand...
Uh, no.

Delta has confirmed that an unauthorized Wi-Fi network was briefly active onboard but stressed that no Delta system, including the in-flight Wi-Fi infrastructure itself, was hacked.
 
AnotherAviationGeek said:
The aircraft did not declare an emergency.
Click to expand...
Really?!?!?!? Why would you add a comment like that?

Maybe they were trying to be malicious, but more likely some idiot created a WiFi network on his phone as a joke. If you didn't know, you can rename the SSID (that's the name of your WiFi network) on your phone to WHATEVER you want. Then when you turn on your Hotspot everyone will see that name. Not rocket science, more or a Jr High level prank. And it really must have been a slow news day for the Daily Beast... or just look'n for those clicks! :D
 
3393RP said:
Uh, no.

Delta has confirmed that an unauthorized Wi-Fi network was briefly active onboard but stressed that no Delta system, including the in-flight Wi-Fi infrastructure itself, was hacked.
Click to expand...
The Delta statement does not refute the quoted post so don't know where you're getting this "uh, no" from. They are orthogonal statements.
 
AV8R_87 said:
FBI Surveillance Van
Click to expand...

I live in a rural area with a lot of deer hunting tourism/outfitters around. I have a big high-gain wifi antenna on my roof to get me as much range across my property as I can. Sometimes during hunting season I change the SSID to "Game Warden"
 
You must log in or register to reply here.
Back
Top