When traveling – whether for business or pleasure – it’s easy to overlook the security measures you take at home. According to Kaspersky Lab experts, there are specific and simple things everyone can do to make sure they’re safe when accessing a hotel’s Wi-Fi or buying tickets online.
Furthermore, there are simple solutions even in the event that your device is lost or stolen.
Some hotels, restaurants or business centers sometimes offer free tablets to their guests. While working on these devices, users tend to leave a lot of private information, which could potentially be used by cybercriminals. No one can know if a keylogger or other malware is installed on these devices and intercepts keystrokes, such as login details.
These devices, according to Kaspersky, should only be used for visiting informational websites and never for online shopping or business purposes, such as editing documents or connecting to websites that require a password.
In 2014, Kaspersky Lab published information about the targeted Dark Hotel campaign, which used a range of effective tactics to infiltrate hotel networks, even systems that were considered private and secure.
Cybercriminals waited until their victims were connected to the hotel's Wi-Fi network. They then tricked potential targets into downloading and installing a backdoor, which was supposed to be an updated version of legitimate software.
Once the backdoor entered the system, according to Kaspersky, it would in turn "download" more advanced tools for data collection, intercept all keystrokes, and search for temporarily stored passwords in browsers and other personal information.
In any case, the software should always be up to date. However, if the update needs to be done during a trip, the updated versions should be downloaded directly from the providers' official sites.
If your computer displays messages informing you that a software update is required, users should not click a random button to "download" and install an updated version, as the "update" could turn out to be malware.
If sensitive information must be used, users should use a secure connection. In general, it is a good idea to avoid using public Wi-Fi networks, especially if the network is not password-protected, as hackers can set up Wi-Fi hotspots in public places (e.g. airports) to intercept data.
Often, these hotspots have a name that appears to belong to an official entity, according to Kaspersky. For this reason, it is useful to always confirm the exact name of the legitimate Wi-Fi service.
Additionally, it is recommended to use password-protected networks. Even if the Wi-Fi password is freely available to everyone, it still provides protection. This is because this shared password is used to generate unique keys for each user, so that the users' data cannot be decrypted by anyone else, even if they know the Wi-Fi password.
In the case of online purchases according to Kaspersky (e.g. tickets for a show or a hotel reservation), it is advisable for every user to:
- Make sure that the service you are going to use is secure (see green padlock, encrypted HTTPS connection).
- Have a powerful antivirus program active, with a built-in function for protecting money (safe money)
- Have a unique password for each of your accounts and implement some form of two-factor authentication on any website you use. That is, you should confirm any logins via SMS or an email based on the security code. If a user receives a two-factor authentication notification when they are not trying to log in to a system, this is a very good indication that the computer should be scanned for security and a new password should be entered (because this probably means that someone has their password and is trying to get into the account).
- Use some type of transaction guarantor (e.g. 3D Secure or Verified-by-Visa) that requires the entry of a one-time code before completing a transaction.
Beyond that, attention should also be paid to physical security, as data can be put at risk whenever someone leaves their computer unattended while traveling.
Devices can be lost or stolen, so sensible precautions include setting a passcode if one doesn't already exist – although this only offers a low level of protection, as it requires a passcode to be entered every time after a relatively short period of inactivity.
It is also a good idea to disable booting from CD or USB drive in BIOS to prevent hackers from bypassing the password. After that, users should set a BIOS password to prevent possible changes to BIOS settings.
It is also a good idea for users to take preventive measures and familiarize themselves with anti-theft features and solutions.
For example, the free Kaspersky Phound! app for smartphones or tablets, as well as Kaspersky Lab's consumer products, such as Kaspersky Internet Security – Multi-Device, can contribute with a number of functions, such as locating the device on a map using GPS, GSM or Wi-Fi networks, activating the Alarm function that continues until the owner enters a secret code, or even removing all personal data.
“Many people travel today with smartphones, laptops and tabletsor using equipment provided for them on the trip. When you’re quickly packing for a trip, when you’re in a hotel or at an airport, it’s easy to overlook even the simplest security measures, like backing up or encrypting vital business data.
Then there are threats such as losing passwords or being infected by cybercriminals via untrusted public charging stations using a USB connection. You should take precautions when traveling, just as you would at home,” commented Stefan Tanase, Senior Security Researcher at Kaspersky Lab’s Global Research and Analysis Team.
