With peak summer travel season coming, a Virginia Tech cybersecurity expert wants to remind travelers that they are swimming in a tank full of hacking sharks at the airport. And they’re vulnerable.
“There are lots of other things to focus on. Delays, other legs of the trip and what you’re going to do when you get there. But also, it is a kind of congregation of unsuspecting people, which is an environment that attackers often seek out,” said Matthew Hicks, associate professor of computer science at Virginia Tech’s College of Engineering.
Hicks’ research focuses on securing computer hardware and software — and airports are a particular challenge.
Unlike a coffee shop or a doctor’s office, there are thousands of travelers all sharing the same WiFi networks. Airports do a good job of securing the WiFi they provide, but they are still public networks, most of which don’t require a password.
And even choosing the WiFi you think is the safe and official airport network can trip you up. Hackers will mimic WiFi network names, sometimes just misspelling a word — like “Dulles.”
“You might easily just glance over and click the one with one L, and think you’re connected to the official airport WiFi at Washington Dulles, and instead you are connected to the attackers,” Hicks said.
There is a safer option, and one that’s probably just as fast as the overworked airport network, and it’s probably in your pocket. If your wireless carrier provides you with a personal hot spot option on your phone, use that.
“It is kind of like bringing your home network with you,” Hicks said. “You are actually creating a personal network that uses encryption on the spot in the airport. It goes from your device to your cellphone, and your cellphone transports that information over the cellular network.”
The same risks apply once you’ve boarded the plane. Airlines provide WiFi connections that are also public networks with no password protection. A hacker could be anywhere on the plane with dozens of vulnerable live connections to breach. And while still at the gate, those attackers may not even be on the plane, but just in very close proximity to it.
Hicks says the best way to protect yourself is not to give any potential hacker access to information they could exploit. If there is no urgency to check your bank account or open a work spreadsheet, limit your airport and airline WiFi use to harmless data, such as catching up on the news.
“We call it in my class that I teach at Virginia Tech ‘rational paranoia,'” Hicks said. “You don’t have to be afraid that the sky is falling and everything is a threat. But reading USA Today is a perfect use case, because there is nothing a hacker is going to gain other than (knowing) you are well-read on current events.”