Airport Wi-Fi can be a security nightmare. Here's what you can do to stop cyber criminals
Airport Wi-Fi can be a security nightmare. Here's what
you can do to stop cyber criminals
By CATHARINE HAMM DEC 03, 2018 | 7:30 AM
You may find an evil twin out there — not your own but
one that still can do great harm. That nasty double often awaits you at your
airport, ready to attack when you least expect it.
That’s just one of the findings in a report that assesses
the vulnerability of airport Wi-Fi, done not to bust the airports’ chops,but to
make airports and travelers aware of the problems they could encounter.
Of the 45 airports reviewed, the report by Coronet said,
two we might use could pose a special risk: San Diego and Orange County’s John
Wayne, which rated No. 1 and No. 2, respectively, on the “Top 10 Most
Vulnerable Airports.”
Airports, said Dror Liwer, chief security officer for
Coronet, a cyber-security firm, are a fertile field because there’s a
concentration of “high-value assets,” which include business travelers who may
unwittingly open themselves up to an attack, he said.
That’s where the evil twin comes in. Let’s say you’re
sitting in an airport lounge or maybe right outside the lounge. You see a Wi-Fi
network that says, “FreeAirportWiFi.” Great, you think. Most airports do have
free Wi-Fi. They may make you watch a couple of commercials (or you may pay a
bit to skip those), but otherwise, the connectivity is there for you.
“I always say that in the balance between convenience and
security, convenience always wins,” Liwer said.ch
And you lose. Because if you take the bait and log in,
that evil twin posing as the airport Wi-Fi then has access to your closely held
secrets.
In some cases, Liwer said, the person creating this trap
may be sitting next to you, which means the signal is strong and attractive. It
takes only some inexpensive equipment and know-how for a thief to succeed, and
presto, you’re in the cyber-security soup.
“Most attackers … are trying to get your credentials, and
if they have those, they have the keys to the kingdom,” Liwer said. “If I know
your password, I own your life.”
Chilling.
It is as sinister as it sounds. Liwer said. For theives,
“it’s a business,” he said. “What they are looking for is something that will
make them money.”
What makes it worse: You’re getting on a plane and won’t
be checking your bank balance any time soon.
The sites that will do you harm are hard to detect with
the naked, inexperienced eye. How do you protect yourself?
Here are ways to keep your data safe, with help from
Liwer; Vyas Sekar, an assistant professor of electrical and computer
engineering at Carnegie Mellon’s College of Engineering; Jake Lehmann, managing
director of Friedman CyZen, a cyber-security consulting service; and Michael
Tanenbaum, executive vice president North America cyber practice for Chubb
Ltd.:
Remember, criminals are lazy. If they weren’t, they’d be
going to a real job every day. So part of the solution is to make things
difficult. If they are lazy, the more difficult you make things, the quicker
they’ll move on to the next potential victim.
►Create
a strong password. Um, duh. Who doesn’t know that? But is it practical to
figure out something unique for each place you do business? No, it’s not.
That’s why you may want to create the most difficult passwords you can and pay
for a service that will store them for you. Check personal computing
publications for recommendations.
►Make
sure the website begins with https and displays a little “lock” symbol to the
left of the URL, especially if you are doing a financial transaction.
►Check
for misspellings or bad grammar on the website, always a clue that a site isn’t
legit. Because, really, is your bank going to misspell stuff? (If it is, get a
new bank.)
►Use
your own hot spot. Many smartphones offer a “personal hot spot” service, which
you’ll probably find under “settings.” Use that instead of the free Wi-Fi; also
make sure you follow steps one and two above.
►Make
sure your devices are current. When Microsoft releases updates (often on
Tuesdays) or your phone has a software update, they often are patching
weaknesses.
►Consider
a VPN, or virtual private network. This is like an online bodyguard who stands
between you and bad guys or gals and keeps them at bay by wearing the cyber
equivalent of false glasses, a nose and mustache, disguising your true
information and identity. Many people use a VPN to connect to their office
computers; sometimes people use them to conceal their real location. I have
used different flavors, and although they usually slow me down, life is a
series of trade-offs and this is one of them.
►Back
up your device, whether it’s a phone or a laptop. Malware can infiltrate your
system and take it down faster than you can say, “Gracious, this is not good.”
(I’m pretty sure I said that the last time a warning flashed on my computer
screen and I clicked the link that would save me. It didn’t save me. It took
down my system. Fortunately, I did have a backup that was fairly current. I
didn’t recover everything, but I also didn’t lose everything.)
You cannot eliminate risk. A criminal is an expert at
finding weak spots and letting in himself or herself. But you need not throw
open the door wide either. About the only person we should let into our private
space is the present-toting guy in a red suit who hangs out with arctic
animals. Cyber criminals give you gifts too, but they’re the kind that keep on
giving — and not in a good way.
Comments
Post a Comment