Airport WiFi may be free, but you might pay dearly

You may find an evil twin out there – not your own but one that still can do great harm. That nasty double often awaits you at your airport, ready to attack when you least expect it.

That’s just one of the findings in a report that assesses the vulnerability of airport WiFi, done not to bust the airports’ chops, but to make airports and travellers aware of the problems they could encounter.

Of the 45 US airports reviewed, the report by Coronet said, two Southern Californians might use could pose a special risk: San Diego and Orange County’s John Wayne, which rated No 1 and No 2, respectively, on the “Top 10 Most Vulnerable Airports”.

Airports, said Dror Liwer, chief security officer for Coronet, a cybersecurity company, are a fertile field because there’s a concentration of “high-value assets”, which include business travellers who may unwittingly open themselves up to an attack, he said.

“I always say that in the balance between convenience and security, convenience always wins,” Liwer said.

And you lose. Because if you take the bait and log in, that evil twin posing as the airport WiFi then has access to your closely held secrets.

In some cases, Liwer said, the person creating this trap may be sitting next to you, which means the signal is strong and attractive. It takes only some inexpensive equipment and know-how for a thief to succeed, and presto, you’re in the cybersecurity soup.

“Most attackers … are trying to get your credentials, and if they have those, they have the keys to the kingdom,” Liwer said. “If I know your password, I own your life.”

Chilling.

It is as sinister as it sounds, Liwer said. For thieves, “it’s a business”, he said. “What they are looking for is something that will make them money.”

What makes it worse: You’re getting on a plane and won’t be checking your bank balance any time soon.

The sites that will do you harm are hard to detect with the naked, inexperienced eye. How do you protect yourself?

Here are ways to keep your data safe, with help from Liwer; Vyas Sekar, an assistant professor of electrical and computer engineering at Carnegie Mellon’s College of Engineering; Jake Lehmann, managing director of Friedman CyZen, a cyber-security consulting service; and Michael Tanenbaum, executive vice president North America cyber practice for Chubb Ltd.:

Remember, criminals are lazy. If they weren’t, they’d be going to a real job every day. So part of the solution is to make things difficult. If they are lazy, the more difficult you make things, the quicker they’ll move on to the next potential victim.

Create a strong password. Um, duh. Who doesn’t know that? But is it practical to figure out something unique for each place you do business? No, it’s not. That’s why you may want to create the most difficult passwords you can and pay for a service that will store them for you. Check personal computing publications for recommendations.

Make sure the website begins with “https” and displays a little “lock” symbol to the left of the URL, especially if you are doing a financial transaction.

Check for misspellings or bad grammar on the website, always a clue that a site isn’t legit. Because, really, is your bank going to misspell stuff? (If it is, get a new bank.)

Use your own hot spot. Many smartphones offer a “personal hot spot” service, which you’ll probably find under “settings”. Use that instead of the free WiFi; also make sure you follow steps one and two above.

Make sure your devices are current. When Microsoft releases updates (often on Tuesdays) or your phone has a software update, they often are patching weaknesses.

Consider a VPN, or virtual private network. This is like an online bodyguard who stands between you and bad guys or gals and keeps them at bay by wearing the cyber equivalent of false glasses, a nose and moustache, disguising your true information and identity. Many people use a VPN to connect to their office computers; sometimes people use them to conceal their real location. I have used different flavours, and although they usually slow me down, life is a series of trade-offs and this is one of them.

Back up your device, whether it’s a phone or a laptop. Malware can infiltrate your system and take it down faster than you can say, “Gracious, this is not good.” (I’m pretty sure I said that the last time a warning flashed on my computer screen and I clicked the link that would save me. It didn’t save me. It took down my system. Fortunately, I did have a backup that was fairly current. I didn’t recover everything, but I also didn’t lose everything.)

You cannot eliminate risk. A criminal is an expert at finding weak spots and letting in himself or herself. But you need not throw open the door wide either. About the only person we should let into our private space is the present-toting guy in a red suit who hangs out with arctic animals. Cybercriminals give you gifts too, but they’re the kind that keep on giving – and not in a good way. – Los Angeles Times/Tribune News Service

Source: TheStar