A Vietnamese man has been jailed after hacking Perth Airport and stealing building plans and sensitive security protocols.
The perpetrator, whom the Australian Federal Police (AFP) identified as Le Duc Hoang Hai, used a third-party contractor’s credentials to access the airport’s systems. The AFP shared its information with Vietnamese police, leading to his arrest.
The 31-year-old was convicted in a military court last week and sentenced to four years in prison.
Alastair MacGibbon, a cyber security advisor to Australian Prime Minister Malcolm Turnbull, told the Western Australian that “a significant amount of data” was taken in the attack, although the attacker didn’t access radars or other systems linked to aircraft operations.
Nonetheless, MacGibbon described the attack as a “near miss”, admitting that it could have been a lot worse.
He praised the staff at Perth Airport for detecting the attack quickly and alerting authorities in Canberra.
Kevin Brown, the chief executive of Perth Airport, said: “Based on evidence gathered by the Australian Federal Police, it appears that credit card theft was the motivation for the illegal accessing of our system.
“No personal data of members of the public, such as details of credit card numbers, was accessed but other Perth Airport documents were taken.”
Brown said the airport has completed a full risk assessment of the data stolen, concluding that, “[a]t no time was the safety or security of the airport, its staff, passengers or partners compromised”.
As well as attacking Perth Airport, Le Duc Hoang Hai is also believed to have hacked a number of organisations in Vietnam, including banks, telecoms companies and a military newspaper’s website.
Mitigate the risk of data breaches
Perth Airport didn’t reveal how the attacker got hold of the third-party contractor’s login credentials, but it was probably by hacking a weak password (using a brute-force attack) or targeting the contractor with a spear phishing email.
To mitigate the risk of employees being exploited like this, organisations should enrol their staff on a security awareness course.
Our Information Security & ISO27001 Staff Awareness E- learning Course helps employees gain a better understanding of the risks they face and their requirements to comply with ISO 27001.
ISO 27001 is the international standard that describes best practice for an information security management system (ISMS). It specifies that organisations must address security issues at the employee level.
This course is designed for anyone who processes information, uses information technology in their daily jobs or uses the Internet to conduct business.
Find out more about our Information Security & ISO27001 Staff Awareness E-learning Course >>
