Latest / Tech Talks With Kinsoft / Aviation Under Siege: Qantas and Hawaiian Cyberattacks

Transcript

Aviation Under Siege: Qantas and Hawaiian Cyberattacks · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. We're here
• 0:02
  to unpack some recent, really critical information
• 0:04
  from a stack of sources, stuff that impacts you,
• 0:07
  the listener, especially if you're tracking how
• 0:10
  tech shapes our world, and importantly, its security.
• 0:14
  Today, we're looking at something that's, well,
• 0:16
  it's been all over the headlines, and frankly,
• 0:18
  sending a few shivers through the travel industry.
• 0:20
  Yeah, major cyber attacks targeting airlines.
• 0:23
  Exactly. We've got some fascinating, maybe a
• 0:25
  bit concerning insights from reports about Qantas
• 0:28
  and Hawaiian Airlines. That's right. And our
• 0:32
  goal today is really to cut through the noise,
• 0:33
  look at the specifics of what happened in these
• 0:36
  incidents. OK. And understand why they signal
• 0:39
  a pretty significant step up in cybersecurity
• 0:41
  threats for the whole aviation sector. We'll
• 0:44
  look at, you know, not just what happened, but
• 0:46
  the bigger picture. What does this mean for how
• 0:48
  organizations, especially airlines, need to adapt?
• 0:51
  Because the landscape is changing fast. Right.
• 0:53
  So let's start with Qantas. That breach you mentioned
• 0:56
  from July 2nd, they called it significant. What
• 0:58
  exactly got exposed there? And how does an airline
• 1:01
  that big even get hit like that? Yeah, it was
• 1:03
  serious. Qantas confirmed it, called it significant.
• 1:05
  Like you said, it affected up to six million
• 1:08
  customers. Six million. Wow. Huge number. The
• 1:12
  compromised data. It included personal details,
• 1:15
  names, emails, phone numbers, dates of birth,
• 1:17
  even frequent flyer numbers. Okay. Now, crucially,
• 1:21
  Qantas was quick to point out that no financial
• 1:23
  data or passport info was taken. That's obviously
• 1:27
  a relief. But still, the sheer amount of personal
• 1:30
  information, PII as it's called. Makes this one
• 1:34
  of the most serious breaches in Australian aviation
• 1:36
  history. I mean, for a customer, just knowing
• 1:39
  your basic details and travel history might be
• 1:41
  out there, even without the financial stuff,
• 1:43
  that's really unsettling. Yeah, absolutely. And
• 1:45
  how did it happen? Was it like a direct assault
• 1:47
  on their main systems? Yeah. Or something? Well,
• 1:50
  something sneakier. Well, this is what's really
• 1:52
  eye -opening. The breach didn't actually happen
• 1:54
  through Qantas' main internal systems. No, it
• 1:57
  came through a third -party platform, one used
• 1:59
  by their call center. Ah, the vendor risk. Exactly.
• 2:03
  It highlights this persistent, maybe underestimated
• 2:06
  vulnerability relying on outside vendors. And
• 2:10
  in aviation, it's not just about any vendor.
• 2:12
  The supply chain has this unique fragility. You
• 2:15
  know, imagine a tiny software patch in some third
• 2:18
  party flight planning tool. And that one vulnerability
• 2:22
  could potentially ground an entire fleet. That's
• 2:25
  the kind of risk we're looking at now. So what
• 2:28
  did Qantas do? Well, they acted fast. Shut down
• 2:31
  the affected systems. Started notifying customers.
• 2:34
  They even put in place extra ID checks for frequent
• 2:37
  flyer account changes. Right. And then there
• 2:39
  was this other twist, wasn't there? Yeah. Just
• 2:40
  last week, Conda said they were contacted by
• 2:42
  someone claiming responsibility. A potential
• 2:45
  cyber criminal. That seems unusual. It is. unusual
• 2:48
  definitely adds another layer to their response
• 2:50
  the source material doesn't spell out if they
• 2:52
  demanded ransom or what the contact was about
• 2:55
  exactly but you know direct contact like that
• 2:57
  it could be for ransom could be for publicity
• 2:59
  maybe even to prove they can do it for future
• 3:01
  extortion it's a bold move anyway shows the attackers
• 3:04
  want to be seen and qantas is working with the
• 3:06
  police on that yeah the australian federal police
• 3:09
  the afp they're trying to verify the contact
• 3:11
  and help with the ongoing investigation okay
• 3:13
  and The public reaction, the CEO apologized,
• 3:16
  right? Yes. Vanessa Hudson issued a public apology,
• 3:19
  emphasizing taking it seriously, aiming for transparency.
• 3:23
  Understandably, it's caused a lot of stress for.
• 3:26
  millions of customers. I bet. They've apparently
• 3:28
  had over 5 ,000 customer inquiries already. And
• 3:32
  there's even murmurs of a potential class action
• 3:34
  lawsuit. People are drawing parallels to other
• 3:37
  big Australian breaches like Optus and Medibang.
• 3:41
  Right, where there were significant compensation
• 3:43
  claims. Exactly. So it's clear this isn't just
• 3:45
  some IT glitch. It's a massive issue of customer
• 3:49
  trust. And it's unsettling because, as you said,
• 3:51
  Qantas wasn't alone. Just days before that news
• 3:54
  broke, there was another Another big warning,
• 3:56
  this time from the FBI. Yeah, that's right. Naming
• 3:58
  Hawaiian Airlines specifically, talking about
• 4:01
  a coordinated cybercrime campaign. How does that
• 4:04
  fit in? It fits perfectly, unfortunately. It
• 4:07
  shows a clear pattern, a worrying trend of escalating
• 4:12
  ransomware attacks hitting airlines globally.
• 4:14
  Now, Orion Airlines didn't confirm they were
• 4:16
  actually breached successfully, but the FBI advisory
• 4:20
  was crystal clear. They described the attackers
• 4:23
  as persistent and technically advanced. This
• 4:26
  isn't just random hacking. It feels like a strategic,
• 4:29
  coordinated effort. They're looking for weak
• 4:31
  spots across the whole aviation ecosystem. What
• 4:34
  kind of weak spots? Often things like gaps in
• 4:37
  employee training, maybe outdated I .T. systems
• 4:39
  and crucially, those third party access controls
• 4:42
  we just talked about with Qantas. It really drives
• 4:45
  home that this isn't just bad luck for one airline.
• 4:47
  It's part of a bigger, evolving threat. And when
• 4:50
  the FBI says sophisticated methods. What are
• 4:53
  we actually talking about? It's not just phishing
• 4:55
  emails anymore, is it? Oh, far from it. The FBI
• 4:58
  warning detailed tactics that show a real shift
• 5:00
  towards, well, psychological manipulation and
• 5:03
  pretty advanced deception. They mentioned the
• 5:05
  ransomware group using social engineering tactics,
• 5:08
  basically tricking people, but also deep fake
• 5:11
  technology and even insider impersonation to
• 5:14
  try and get into sensitive systems. Deep fakes.
• 5:17
  Wow. Yeah. And connecting this back, it really
• 5:19
  confirms that even, say, regional carriers like
• 5:22
  Hawaii and airlines aren't safe anymore. They're
• 5:24
  not off the radar. The threat landscape is just
• 5:26
  expanding so fast. No airline, big or small,
• 5:30
  seems immune. You mentioned a ransomware group.
• 5:33
  Our sources suggest a group called Scattered
• 5:35
  Spider might be behind at least one of these,
• 5:38
  maybe Qantas, given the methods. Who are they?
• 5:40
  What makes them different? Oh, Scattered Spider.
• 5:43
  Yes. They really burst onto the scene, gained
• 5:45
  notoriety in 2023. They hit some big names in
• 5:48
  hospitality and entertainment, MGM resorts, Caesars
• 5:51
  Entertainment. I remember that. Right. And their
• 5:53
  defining trait is, well, they're unconventional
• 5:56
  and deceptive methods. They're not primarily
• 5:58
  trying to break through firewalls in the classic
• 6:01
  set. So what are they doing? They're masters
• 6:02
  of social engineering. They use things like SIM
• 6:05
  swapping, getting control of someone's phone
• 6:07
  number to intercept texts or calls, and help
• 6:11
  desk impersonation pretending to be IT support
• 6:13
  to trick employees into giving up their passwords
• 6:16
  or credentials. So it's less about the tech vulnerabilities
• 6:18
  and more about exploiting people, weaponizing
• 6:21
  trust itself. Precisely. They go after the human
• 6:24
  element, the weakest link. So traditional defenses
• 6:27
  like firewalls, they're becoming less effective
• 6:30
  against groups like this that's concerning and
• 6:32
  it gets worse what's truly unsettling is how
• 6:35
  they're using deepfake video calls. You mentioned
• 6:38
  that. How does that work? Imagine getting a video
• 6:39
  call. It looks and sounds like your CEO or maybe
• 6:42
  the head of IT asking you to do something urgent.
• 6:45
  Transfer funds, grant access. But it's not them.
• 6:48
  Exactly. It's a sophisticated deepfake. They
• 6:51
  also do these multi -factor authentication fatigue
• 6:54
  attacks or MFA fatigue. What's that? They basically
• 6:58
  spam an employee's phone with login approval
• 7:00
  requests over and over again until the employee
• 7:03
  just hits approve by mistake. just to make the
• 7:06
  notification stop. I could see how that would
• 7:08
  work. Right. Combine that with stolen credentials,
• 7:11
  maybe bought off the dark web or phished earlier,
• 7:13
  and they can get initial access pretty quickly.
• 7:15
  And it's incredibly hard to spot. They really
• 7:18
  prioritize stealth and psychological tricks over
• 7:20
  brute force hacking. It's a tough defense challenge
• 7:23
  when your own people are, you know, unknowingly
• 7:26
  helping the attackers. That shift towards the
• 7:28
  psychological targeting people. It sounds incredibly
• 7:33
  difficult to defend against. So what does all
• 7:34
  this mean for the wider aviation industry, especially
• 7:37
  with groups like Scattered Spider out there?
• 7:39
  Well, these incidents, Qantas, the FBI warning,
• 7:42
  they're really symptoms of a much bigger systemic
• 7:46
  issue. Airlines are just such high value targets.
• 7:49
  Why specifically airlines? Several reasons. First,
• 7:52
  they handle massive amounts of personal data,
• 7:54
  PII, from millions of people. Right. Names, travel
• 7:57
  plans. More than that. Travel patterns, meal
• 8:00
  preferences, loyalty points, sometimes even medical
• 8:02
  needs. That data is gold for identity thieves,
• 8:06
  for crafting targeted phishing attacks, even
• 8:08
  for intelligence gathering by other bad actors.
• 8:11
  Second, airlines often rely heavily on legacy
• 8:13
  systems. Think about reservation platforms, flight
• 8:16
  ops software, maybe even air traffic control
• 8:18
  interfaces that could be decades old. Running
• 8:21
  on old code. Potentially. Yeah. And updating
• 8:23
  them isn't simple. It's not just a software patch.
• 8:26
  It's often a massive, multi -year, multi -million
• 8:29
  dollar project. You have to plan meticulously
• 8:32
  to avoid disrupting flights. Yeah, you can't
• 8:34
  just turn it off and on again. Exactly. So it
• 8:37
  leaves these systems hard to secure against modern,
• 8:39
  agile threats without causing chaos. And third,
• 8:43
  like we saw so clearly with Qantas, they use
• 8:45
  tons of third -party vendors. This creates this
• 8:48
  huge digital supply chain of vulnerability in
• 8:51
  one small vendor. could be the entry point for
• 8:53
  attackers to get into the airline's main network.
• 8:56
  It sounds like a perfect storm, really. Valuable
• 8:58
  data, complex old systems, tangled supply chains.
• 9:01
  It is. It's not just these vulnerabilities alone.
• 9:03
  It's how they all connect. Airlines are like
• 9:06
  these digital cities in the sky. Everything from
• 9:09
  baggage handling to navigation relies on these
• 9:12
  complex, sometimes ancient digital links. A breach
• 9:16
  somewhere isn't just a data leak. It can ripple
• 9:18
  through operations, safety. even national infrastructure.
• 9:23
  That paints a pretty stark picture and does it
• 9:25
  vary globally. Are airlines in some regions better
• 9:27
  prepared than others? Absolutely, there are differences.
• 9:30
  The sources point to inconsistent cybersecurity
• 9:33
  regulations and enforcement across regions like
• 9:36
  Southeast Asia, EMEA, Latin America. How so?
• 9:39
  Well, you have the EU's GDPR, which is quite
• 9:42
  strict. Clear rules, big potential fines. But
• 9:45
  other regions say Thailand with its PDPA or Brazil
• 9:48
  with LGPD. They're improving data protection,
• 9:51
  definitely, but they often still lack aviation
• 9:53
  -specific enforcement mechanisms. So the rules
• 9:56
  aren't tailored? Not always, or the enforcement
• 9:58
  isn't as robust. And the problem is a breach
• 10:01
  often hits passengers from many different countries,
• 10:03
  so the airline has to navigate this patchwork
• 10:05
  of laws. GDPR might demand quick, strict action.
• 10:09
  But if an airline operates mainly where data
• 10:11
  laws are newer or less mature, they might face
• 10:13
  fewer immediate penalties or have less clear
• 10:16
  obligations. This creates different incentives
• 10:19
  for investing in security and how they respond
• 10:21
  to breaches globally. It leads to fragmented
• 10:24
  security levels and a confusing legal mess when
• 10:27
  things go wrong. OK, so given this escalating
• 10:30
  threat, these sophisticated tactics from groups
• 10:32
  like Scattered Spider. What's the urgent advice
• 10:36
  for airlines? How do they protect themselves
• 10:38
  and us, their customers, from what sounds almost
• 10:41
  inevitable? Well, cybersecurity experts are really
• 10:44
  urging immediate proactive steps. Top of the
• 10:46
  list is investing in things like managed detection
• 10:49
  and response or MDR services. MDR. What's that?
• 10:52
  Practically. Think of it like having an expert
• 10:54
  security team watching your digital footprint
• 10:56
  24 -7. They're constantly looking for threats,
• 10:59
  ready to jump in the moment something suspicious
• 11:01
  pops up, not just reacting after you know you've
• 11:03
  been breached. Okay, proactive monitoring. Exactly.
• 11:06
  Also, doing regular thorough security audits,
• 11:10
  finding and fixing vulnerabilities before the
• 11:12
  attackers do, and crucially, implementing really
• 11:15
  strict vendor risk assessments, locking down
• 11:18
  those third party doors. Makes sense. Because
• 11:20
  the cost of not doing this, it could be truly
• 11:22
  catastrophic. We're talking grounded fleets,
• 11:25
  reputation shattered for years, massive customer
• 11:29
  distrust, which for an airline, that can be fatal.
• 11:33
  Yeah, it's clearly not just an IT department
• 11:35
  problem anymore, is it? It's fundamental to operations,
• 11:38
  to safety, to the bottom line. I mean, imagine
• 11:40
  your flights delayed for hours, not because of
• 11:43
  weather, but because the airline's booking system
• 11:44
  is locked down by ransomware. That's the real
• 11:47
  world impact. So these Qantas and Hawaiian Airlines
• 11:50
  incidents, they really are a wake up call, aren't
• 11:52
  they, for the whole global aviation industry?
• 11:54
  Absolutely. Whether it's through those vulnerable
• 11:55
  third party systems or this incredibly clever
• 11:58
  social engineering, the message seems undeniable.
• 12:01
  The threat is real and it's evolving fast. And
• 12:04
  it raises a big question really for all businesses,
• 12:06
  not just airlines. How proactive are you in preparing
• 12:10
  for threats like Scattered Spider? It just underscores
• 12:14
  this critical need for organizations to see cybersecurity
• 12:17
  not as some IT cost center, but as a core operational
• 12:22
  priority. Meaning what specifically? Meaning
• 12:25
  investing in ongoing employee education, having
• 12:27
  real -time threat detection like MDR, and really
• 12:30
  robust controls over third -party access. Because
• 12:33
  this isn't just an aviation issue. The supply
• 12:36
  chain weaknesses we're seeing here, that's a
• 12:38
  blueprint for attacks on almost any industry
• 12:40
  that relies on complex digital connections. It
• 12:43
  is a complex landscape, no doubt. But hopefully,
• 12:46
  understanding these trends like we've tried to
• 12:47
  do today is that first step towards building
• 12:50
  stronger defenses. And that brings us to the
• 12:52
  end of Tech Talks with Kinsoft for today. We
• 12:55
  hope this exploration into aviation cybersecurity
• 12:57
  has given you some valuable insights, maybe help
• 12:59
  connect some dots on this really critical topic.
• 13:02
  Yeah. And if these kinds of discussions make
• 13:04
  you think about your own organization's security
• 13:06
  posture, your IT needs, whether you're in aviation
• 13:09
  or any sector facing these digital challenges,
• 13:12
  we really encourage you to visit www .kinsoft
• 13:14
  .com .au. That's www .kinsoft .com .au. Their
• 13:20
  team is ready to help you navigate these complex
• 13:22
  issues and work towards securing your digital
• 13:24
  future. Great advice. Thanks everyone for tuning
• 13:26
  in, and we'll catch you next time on Tech Talks
• 13:28
  with Kinsoft.