Airport Networks Are Putting Your
Devices & Cloud Apps at Severe Risk

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKTABLE OF
CONTENTS
Executive Summary

3

The Cyber Risk to All Passengers

4

Methodology

5

Most Vulerable Airports

6-7

Least Vulnerable Regions

8

Complete Rankings

9-10

About Coronet

11

PAGE // 2

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKEXECUTIVESUMMARY
According to the Bureau of Transportation Statistics, U.S.-based airlines transported
more than 746 million passengers to and from airports across the country in 2017.
When combined with international-based carriers, close to one billion people
made their way through one or more of America’s 5,000 airports designated forcommercial flights during a single calendar year.
In an attempt to maximize the traveler experience, the vast majority of airports now
provide free or low-cost Wi-Fi for passengers to connect to for work, entertainment
or a combination thereof.
Unfortunately, Wi-Fi security is often sacrificed by airport operators in exchange for
consumer convenience, leaving networks unencrypted, unsecured or improperly
configured. After all, it wasn’t until February 2018 that Americans finally started torank cybersecurity as more important than expediency (according to an IBM study).
Even for those airports that do prioritize security, attack techniques such as the Key
Reinstallation Attack (KRACK), which can break the WPA2 protocol to capture and/or expose information shared over public and private Wi-Fi, presents significant risk
to passengers in transit.
This report identifies the current cyber risk landscape at the top *45 busiest U.S.
airports. Its purpose is to help educate all travelers on:
Specific airport risk level based on network threats and device 		vulnerabilities.
How insecure or deceptive airport networks can drive the exploitation ofvulnerable endpoint devices, subsequently compromising the systems,
files and cloud apps that devices connect to.
How Coronet’s FREE SecureCloud platform can help business travelers
automatically identify network threats at airports, thereby protecting theircloud apps and data from compromise, unauthorized access and malware
and ransomware spread.

*Data for Honolulu’s Inouye International Airport and Oakland International Airport was notavailable.

PAGE // 3

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKTHE CYBER RISK TO
BUSINESS TRAVELERS
For attackers, it is infinitely easier to access and exploit data from devices
connected to Wi-Fi in an airport than it is to do so within the confines of a wellprotected office. In fact, the lax cybersecurity posture at most airports has createdan environment in which adversaries can utilize insecure public Wi-Fi as the attack
vector to introduce a plethora of advanced network vulnerabilities, such as captive
portals (AKA Wireless phishing), Evil Twins, ARP poisoning, VPN Gaps, Honeypots
and compromised routers. Any one of these network vulnerabilities can empower
an attacker to obtain access credentials to Microsoft Office 365, G-Suite, Dropbox
and other popular cloud apps; deliver malware to the device and the cloud, andsnoop and sniff device communications.
In many instances, business travelers connected to risky airport networks
unintentionally share important information about their cloud-based-apps withadversaries. Such compromise can trickle down through entire organizations,leading to operational disruption, financial losses and even reputational harm,
among other damages. While large enterprises are equipped to recover from such
events, many mid-market and small businesses are ill prepared to remediate andregain business continuity with any haste. In fact, six out of ten small businesses hit
with a cyberattack go out of business within six months of the breach.

PAGE // 4

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKMETHODOLOGY

To identify the airports with the greatest cyber risk, Coronet collected datafrom more than 250,000 consumer and corporate endpoints that traveledthrough America’s 45 busiest airports over the course of five months. Coronet
then analyzed the data, which consisted of both device vulnerabilities and WiFi network risks captured from our threat protection platform. Following thecompleted analysis, the data was combined and standardized to compile theCoronet Threat Index for each airport.
Device Vulnerabilities – Coronet assigned each endpoint device a vulnerability
score based on weighting its security posture factors, including:
••
•••••

Active and updated anti-malware
Active and updated firewalls
Password protection for device/OS access
Trusted OS (i.e. from legit source and not rooted/jailbroken)
Trusted apps
Disk/storage encryption
Privileged user account and permissions

The greater the vulnerabilities that a device had, the higher the vulnerability score
it was assigned. For each airport, we averaged the device vulnerability score forall devices within one kilometer. The Airport Device Vulnerability Score has a risk
range of 1 to 5 (the higher the score the higher the risk) that reflects the averagevulnerability level of endpoint devices in the airport.
Network Risk Score - Coronet SecureCloud scanned connected and neighboring
Wi-Fi networks, using proprietary algorithms to assess network risk score,denoting the probability of an attacker on these networks. This risk score was used
for conditional access to corporate services. The Airport Network Risk Score has arisk range of 1 to 5 (the higher the score the higher the risk) and takes into accountthe chance of connecting to a risky Wi-Fi networks in the immediate vicinity of andthe individual risk within each specific network.
Based on our analysis, it is our opinion that an acceptable risk level is below 6.5,
and any score higher represents unacceptable exposure.

PAGE // 5ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKTOP 10 MOST
VULNERABLE AIRPORTS
DMA

CODE

CITY

THREAT INDEX SCORESan Diego International
AirportSAN

San Diego10John Wayne Airport-Orange
County Airport

SNASanta Ana8.7

William P Hobby Airport

HOU

Houston7.5

Southwest Florida
International Airport

RSWFort Myers

7.1

Newark Liberty International
AirportEWRNewark

7.1

Dallas Love Field

DALDallas

6.8

Phoenix Sky Harbor
International Airport

PHX

Phoenix

6.5Charlotte Douglas
International Airport

CLTCharlotte

6.4

Detroit Metropolitan Wayne
County Airport

DTW

Detroit

6.4

General Edward Lawrence
Logan International Airport

BOS

Boston6.4

NATIONAL AIRPORT WI-FI NETWORK OVERVIEW• Probability of connecting to medium risk network: 1%• Probability of connecting to high risk network: 0.6%

PAGE // 65

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKNEWARK LIBERTY INTERNATIONAL AIRPORT•

Probability of connecting to medium risk network: 1%•Probability of connecting to high risk network: 0.6%

4

SOUTHWEST FLORIDA INTERNATIONAL AIRPORT (FT. MYERS)

3

HOUSTON WILLIAM HOBBY INTERNATIONAL AIRPORT21•

Probability of connecting to a medium risk network: 19%•Probability of connecting to high risk network: 6%•An attacker on a Wi-Fi network named “SouthwestWiFi”
performed an attack on SSL/HTTPS traffic.

•Probability of connecting to medium risk network: 21%•

Probability of connecting to high risk network: 6%

JOHN WAYNE AIRPORT-ORANGE COUNTY AIRPORT•

Probability of connecting to a medium risk network: 26%•

Probability of connecting to high risk network: 7%

SAN DIEGO INTERNATIONAL AIRPORT•An Evil Twin Wi-Fi access point with the name “#SANfreewifi”
was used at the San Diego international airport, running an
ARP Poisoning attack.

•Probability of connecting to a medium risk network – 30%•

Probability of connecting to a high-risk network – 11%

PAGE // 7

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKTOP 10 LEASTVULNERABLE AIRPORTS
DMACODECITY

THREAT INDEX SCORE

Tampa International Airport

TPA

Tampa

5.3

Miami International Airport

MIA

Miami

5.3

Lambert St LouisInternational Airport

STL

St. Louis

5.3

Kansas City International
Airport

MCI

Kansas City

5.2

Louis Armstrong New
Orleans International Airport

MSY

New Orleans

5.2

San Antonio International
AirportSAT

San Antonio

5.2

Washington Dulles
International Airport

IAD

Washington

5.1

Nashville International
AirportBNA

Nashville

5.1

Raleigh Durham International
AirportRDU

Raleigh-Durham

4.9

Chicago MidwayInternational Airport

MDWChicago

4.5

PAGE // 8

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKCOMPLETE RANKINGS (WORST TO BEST)TAKING ACTION
RED: Above 5.9 – Never connect without proper protection for your devices. Use a security
solution that can identify both malicious networks and attackers and can offer full protection, foryour cloud services, devices and cloud apps are at severe risk.
ORANGE: Between 5.4 and 5.9 – Download device protection that can identify malicious networks
and attackers for personal use, and connect only to networks that you identify and know.
YELLOW: Below 5.4 – Connect carefully only to a networks that you can identify and know.

THREAT INDEX
SCORE

DMA

CODE

CITY

San Diego International Airport

SAN

San Diego

10John Wayne Airport-Orange CountyAirport

SNA

Santa Ana

8.7

William P Hobby Airport

HOU

Houston

7.5

Southwest Florida International Airport

RSW

Fort Myers

7.1

Newark Liberty International Airport

EWR

Newark

7.1

Dallas Love Field

DAL

Dallas

6.8

Phoenix Sky Harbor International Airport PHX

Phoenix

6.5Charlotte Douglas International Airport

CLTCharlotte

6.4Detroit Metropolitan Wayne County
AirportDTWDetroit

6.4

General Edward Lawrence Logan
International Airport

BOSBoston

6.4

Orlando International Airport

MCOOrlando

6.3

Portland International Airport

PDX

Portland

6.3

McCarran International AirportLAS

Las Vegas

6.2

Sacramento International Airport

SMF

Sacramento

6.2

La Guardia AirportLGA

New York

6.2

Austin Bergstrom International Airport

AUS

Austin6.1

George Bush Intercontinental Houston
Airport

IAH

Houston

6.1

Seattle Tacoma International Airport

SEA

Seattle6

PAGE // 9

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKCOMPLETE RANKINGS (WORST TO BEST)THREAT INDEX
SCORE

DMA

CODE

CITY

Chicago O'Hare International Airport

ORD

Chicago5.9

San Francisco International Airport

SFO

San Francisco

5.8

Indianapolis International Airport

IND

Indianapolis

5.7

Cleveland Hopkins International Airport

CLE

Cleveland

5.7

John F Kennedy International Airport

JFKNew York

5.7

Fort Lauderdale Hollywood
International Airport

FLL

Fort Lauderdale

5.7

Dallas Fort Worth International Airport

DFW

Dallas-Fort Worth

5.7

Hartsfield Jackson Atlanta International
AirportATL

Atlanta

5.6

Norman Y. Mineta San Jose International
SJC
AirportSan Jose

5.6

Denver International Airport

DEN

Denver

5.6

Baltimore/Washington International
Thurgood Marshall Airport

BWIBaltimore

5.5

Los Angeles International Airport

LAX

Los Angeles

5.4

Salt Lake City International Airport

SLC

Salt Lake City

5.4

Philadelphia International Airport

PHL

Philadelphia

5.4

Tampa International Airport

TPATampa

5.3

Miami International Airport

MIA

Miami

5.3

Lambert St Louis International Airport

STL

St. Louis

5.3

Kansas City International Airport

MCI

Kansas City

5.2

Louis Armstrong New OrleansInternational Airport

MSY

New Orleans

5.2

San Antonio International Airport

SATSan Antonio

5.2

Washington Dulles International Airport

IAD

Washington

5.1

Nashville International Airport

BNA

Nashville

5.1

Raleigh Durham International Airport

RDU

Raleigh-Durham4.9Chicago Midway International Airport

MDWChicago

4.5

PAGE // 10

ATTENTION ALL PASSENGERS: AIRPORT NETWORKS ARE PUTTING YOUR DEVICES & CLOUD APPS AT SEVERE RISKLIMIT CYBER RISK AT AIRPORTS
WITH CORONET SECURECLOUD– ITS FREE, FOREVER
Coronet’s FREE SecureCloud platform empowers business travelers withenterprise-grade cloud security, enabling them to prevent the inherent risks ofairport Wi-Fi and the subsequent threats from impacting their company’s cloudapps and devices. With Coronet, all travelers can safely access any cloud service,through any device and connect to any network and seamlessly be secured.
All Coronet SecureCloud users benefit from:•Access Control - Now that users can work from anywhere, using anydevice, Coronet ensures only authorized users using safe devices connected
through safe networks from allowed locations have access to cloud
applications and data•

Cloud Control – Once access is granted, Coronet controls who shares
what with whom, prevents data leakage, malware and ransomware spread,suspicious activities, and regulatory violations (PCI-DDS, HIPAA, GDPR, etc.)

TO GET STARTED WITH CORONET, SIGN UP HERE:

www.coro.net/signup

www.linkedin.com/company/coronet/@coronetworks
www.facebook.com/coronetworks/