Fortune recently published an article listing the airlines with the best in-flight wifi service. Coming in at the top of the list with the most onboard wifi connections globally were 3 American carriers : Delta, United, and American Airlines, respectively. But what defines best? Security is clearly not part of the equation, as one journalist famously discovered last week on a domestic American Airlines flight. But then again, if we’re talking about wifi and commercial aircraft, all airlines get a failing grade.
The incident poses some long overdue questions regarding wifi and air travel, specifically — what will it take to secure the giant, passenger-carrying wifi hotspots that are today’s modern commercial aircraft? We’ve discussed the dangers of in-flight wifi previously in The Ongoing Perils of In-flight Wifi, but primarily in the context of hijacking planes. As you may recall, security researcher Chris Roberts was detained by the FBI and subsequently banned from all United flights last year for the following in-flight tweet:
The issue of in-flight wifi and entertainment systems intermingling with mission-critical avionics systems has been discussed in-depth since then. But what about the security of passengers using in-flight wifi to simply check email or surf the web? This question came to light prominently a few days ago when journalist Steve Petrow was hacked in mid-air while — interestingly enough — working on a story covering the Apple/FBI data privacy showdown. He recounts his experience to USA Today, detailing how a hacker on the same flight intercepted the data of virtually everyone using the in-flight wifi service. For those intent on stealing data transmitted over in-flight wifi, commercial airline flights are rife with opportunity.
In fairness, all airlines offering in-flight hotspots get a failing grade for wifi security, not just the aforementioned triumvirate of U.S. air carriers. This has less to do with the specifics of in-flight data security, per se, and more with the fact that wifi was never designed for security. We discussed this topic in-depth with long time wifi/networking expert and father of Apple’s Airport Extreme Phil Kearney in Episode 006 of The Gig.
But what makes the dangers of in-flight wifi different than those of a Starbucks hotspot? Wifi/avionics co-mingling aside, the unique qualities of mass transit and commercial air travel give hackers a plethora of high-value, low-hanging fruit. Despite delineations per seating area, first/business/economy class passengers share the same in-flight wifi connection. So while it’s highly unlikely that you’d find yourself sharing a wifi hotspot with Tim Cook at the local Peet’s Coffee, it’s entirely possible that you could be sharing a wifi connection with a CEO/board member/insert-dignitary-here seated in first class — including Mr. Cook, on any given flight.
So until in-flight wifi (and wifi technology at large) becomes more secure, the best defense is still personal vigilance. When connecting to a public hotspot — midair or otherwise — use VPN to encrypt the data channel. Avoid connecting to unknown networks and always be on the alert for fake hotspot “honeypots” set up by hackers. Last but not least, plan/prepare accordingly for security compromises that are bound to happen. Here at UpGuard, we’re staunch proponents of digital resilience. It’s likely that you’ll suffer a data breach at some point, whether it be on a flight, at home, or in your office. The key is, therefore, managing the risks/rewards of digitization to both survive inevitable data breaches and thrive in an increasingly harsh cyber threat landscape.
Source(s):
