The Evil Twin That Flew Coach
Monday morning, Delta flight 591 from Las Vegas to Atlanta. DEF CON wrapped the day before, and that plane was apparently full of people who’d just spent a week learning how to break things. Somebody decided to show off at 35,000 feet.
The pilot’s ACARS message, via ACARS Drama, reads like a dispatch from a bad comedy: “WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFERENCE IN LAS THEY WERE ABLE TO JAM OUR WIFI AND BROADCAST THEIR SIGNAL.”
Translation: an evil twin. A fake hotspot named “Delta WiFi Fast” with a landing page reportedly built to harvest credentials — the long-known trick every security person has warned about for a decade. Ars Technica confirmed an unauthorized network was onboard, the real Wi-Fi died for 30 minutes, and the FBI is looking into it. No arrests. Yet.
The people who pulled this spend all year warning us that evil twins are how you lose your credentials in an airport. They know the exact second a passenger types their SkyMiles password — or worse, their email password, since everyone reuses those — into that fake page, their identity starts leaking. They knew. They did it anyway, as a bit.
The defense: it’s a prank, it’s DEF CON, lighten up, and the FBI showing up is the real overreaction — this is how research gets killed. Half-right. Yes, feds circling a conference stunt chills legitimate work; I don’t want anyone prosecuted over a splash page. But “demonstration” has a consent requirement, and nobody on that plane signed up to be the demo. That’s why DEF CON’s hacking villages are opt-in — you hack the things they hand you, not the plane you flew in on. Run your attack on a captive audience with nowhere to walk away and you’re not demonstrating. You’re attacking. The only difference between you and a criminal is your LinkedIn bio.
And the credential-harvesting page is where “prank” dies entirely. A joke is a fake network that says “you got hacked, nerd.” A harvester says “I want your passwords.” Statistically, someone on that flight typed into it. That’s identity theft with extra steps.
Here’s what actually pisses me off. The security community has spent decades fighting the hoodie-criminal stereotype — every CVE, every responsible disclosure is a battle to prove that knowing how to break things and wanting to are different. Then a plane full of us pulls an evil twin on non-consenting passengers, reportedly with a credential harvester, and hands the “hackers are the enemy” crowd a gift-wrapped headline: hackers phish plane passengers. That headline does more damage to security research than any FBI inquiry ever could. One idiot with a laptop undid a lot of careful reputation-building in 30 minutes.
The fair counter: maybe the page was a joke splash and “credential harvesting” is Reddit inflation. I hope so. But the story is out, the feds are asking questions, and the community absorbs the damage either way. You don’t get to control the headline after you’ve put up the fake hotspot.
The rule isn’t complicated: demo an attack on a box you own, a lab you built, or a network that invited you. Not on a plane full of people who just want to watch a movie and land in Atlanta. The people who can’t tell an evil twin from real Wi-Fi aren’t your audience. They’re your victims.
Write the paper. Give the talk. Hack the village. Don’t take 150 strangers’ credentials on a field trip to prove you can.
A prank at 35,000 feet is still a prank — right up until somebody types their password. Then it’s a crime with a punchline.
Sources: Ars Technica, ACARS Drama, r/delta, Okta on evil twin attacks