Airport Wi-Fi can be a security nightmare. Here’s what you can do to stop cyber criminals

You may find an evil twin out there — not your own but one that still can do great harm. That nasty double often awaits you at your airport, ready to attack when you least expect it.

That’s just one of the findings in a report that assesses the vulnerability of airport Wi-Fi, done not to bust the airports’ chops,but to make airports and travelers aware of the problems they could encounter.

Of the 45 airports reviewed, the report by Coronet said, two we might use could pose a special risk: San Diego and Orange County’s John Wayne, which rated No. 1 and No. 2, respectively, on the “Top 10 Most Vulnerable Airports.”

Airports, said Dror Liwer, chief security officer for Coronet, a cyber-security firm, are a fertile field because there’s a concentration of “high-value assets,” which include business travelers who may unwittingly open themselves up to an attack, he said.

That’s where the evil twin comes in. Let’s say you’re sitting in an airport lounge or maybe right outside the lounge. You see a Wi-Fi network that says, “FreeAirportWiFi.” Great, you think. Most airports do have free Wi-Fi. They may make you watch a couple of commercials (or you may pay a bit to skip those), but otherwise, the connectivity is there for you.

“I always say that in the balance between convenience and security, convenience always wins,” Liwer said.ch

And you lose. Because if you take the bait and log in, that evil twin posing as the airport Wi-Fi then has access to your closely held secrets.

In some cases, Liwer said, the person creating this trap may be sitting next to you, which means the signal is strong and attractive. It takes only some inexpensive equipment and know-how for a thief to succeed, and presto, you’re in the cyber-security soup.

“Most attackers … are trying to get your credentials, and if they have those, they have the keys to the kingdom,” Liwer said. “If I know your password, I own your life.”

Chilling.

It is as sinister as it sounds. Liwer said. For thieves, “it’s a business,” he said. “What they are looking for is something that will make them money.”

What makes it worse: You’re getting on a plane and won’t be checking your bank balance any time soon.

The sites that will do you harm are hard to detect with the naked, inexperienced eye. How do you protect yourself?

Here are ways to keep your data safe, with help from Liwer; Vyas Sekar, an assistant professor of electrical and computer engineering at Carnegie Mellon’s College of Engineering; Jake Lehmann, managing director of Friedman CyZen, a cyber-security consulting service; and Michael Tanenbaum, executive vice president North America cyber practice for Chubb Ltd.:

Remember, criminals are lazy. If they weren’t, they’d be going to a real job every day. So part of the solution is to make things difficult. If they are lazy, the more difficult you make things, the quicker they’ll move on to the next potential victim.

►Create a strong password. Um, duh. Who doesn’t know that? But is it practical to figure out something unique for each place you do business? No, it’s not. That’s why you may want to create the most difficult passwords you can and pay for a service that will store them for you. Check personal computing publications for recommendations.

►Make sure the website begins with https and displays a little “lock” symbol to the left of the URL, especially if you are doing a financial transaction.

►Check for misspellings or bad grammar on the website, always a clue that a site isn’t legit. Because, really, is your bank going to misspell stuff? (If it is, get a new bank.)

►Use your own hot spot. Many smartphones offer a “personal hot spot” service, which you’ll probably find under “settings.” Use that instead of the free Wi-Fi; also make sure you follow steps one and two above.

►Make sure your devices are current. When Microsoft releases updates (often on Tuesdays) or your phone has a software update, they often are patching weaknesses.

►Consider a VPN, or virtual private network. This is like an online bodyguard who stands between you and bad guys or gals and keeps them at bay by wearing the cyber equivalent of false glasses, a nose and mustache, disguising your true information and identity. Many people use a VPN to connect to their office computers; sometimes people use them to conceal their real location. I have used different flavors, and although they usually slow me down, life is a series of trade-offs and this is one of them.

►Back up your device, whether it’s a phone or a laptop. Malware can infiltrate your system and take it down faster than you can say, “Gracious, this is not good.” (I’m pretty sure I said that the last time a warning flashed on my computer screen and I clicked the link that would save me. It didn’t save me. It took down my system. Fortunately, I did have a backup that was fairly current. I didn’t recover everything, but I also didn’t lose everything.)

You cannot eliminate risk. A criminal is an expert at finding weak spots and letting in himself or herself. But you need not throw open the door wide either. About the only person we should let into our private space is the present-toting guy in a red suit who hangs out with arctic animals. Cyber criminals give you gifts too, but they’re the kind that keep on giving — and not in a good way.

Have a travel dilemma or question? Write to travel@latimes.com. We regret we cannot answer every inquiry.

travel@latimes.com

@latimestravel