New research finds that 97 out of 100 the world's largest airports have security risks related to vulnerable web and mobile applications, misconfigured public cloud, Dark Web exposure or code repositories leaks.

The report from web security company ImmuniWeb is based on its analysis of cybersecurity, compliance and privacy of the world's largest airports.

During the research, ImmuniWeb identified three international airports that successfully passed all the tests without a single major issue being detected:

  1. Amsterdam Airport Schiphol (EU)
  2. Helsinki-Vantaa Airport (EU)
  3. Dublin Airport (EU)

Main Website Security

According to the research only 3 main (“www.”) websites of the airports received the best possible “A+” grade, 15 got an “A” grade, the report says.

As many as 24 of the main websites had a failing “F” grade, it says, meaning that they had outdated software with known and exploitable security vulnerabilities in CMS (e.g. WordPress) and/or web component (e.g. jQuery). Some of the websites even had several vulnerable components, such as:

  • 97% of the websites contain outdated web software
  • 24% of the websites contain known and exploitable vulnerabilities
  • 76% and 73% of the websites are not compliant with GDPR and PCI DSS respectively
  • 24% of the websites have no SSL encryption or use obsolete SSLv3
  • 55% of the websites are protected by a WAF

Mobile Application Security

The research found and tested 36 official mobile applications belonging to the airports. In total, 530 security and privacy issues were identified, including 288 mobile security flaws (15 per application on average). It found that:

  • 100% of the mobile apps contain at least 5 external software frameworks
  • 100% of the mobile apps contain at least 2 vulnerabilities
  • 15 security or privacy issues are detected per app on average
  • 33.7% of the mobile apps outgoing traffic has no encryption

Dark Web Exposure, Code Repositories and Cloud

After purification of the results, the research team found that 66 out of the 100 airports are exposed on the Dark Web in one way or another. 13 airports have leaks or exposures of a critical risk:

  • 66% of the airports are exposed on the Dark Web
  • 72 out of 325 exposures are of a critical or high risk indicating a serious breach
  • 87% of the airports have data leaks on public code repositories
  • 503 out of 3184 leaks are of a critical or high risk potentially enabling a breach
  • 3% of the airports have unprotected public cloud with sensitive data

Ilia Kolochenko, CEO & Founder of ImmuniWeb, says: “Given how many people and organizations entrust their data and lives to international airports every day, these findings are quite alarming. Being a frequent flyer, I frankly prefer to travel via the airports that do care about their cybersecurity. Cybercriminals may well consider attacking the unwitting air hubs to conduct chain attacks of travelers or cargo traffic, as well as aiming attacks at the airports directly to disrupt critical national infrastructure. Today, when our digital infrastructure is extremely intricate and intertwined with numerous third-parties,  holistic visibility of your digital assets and attack surface is pivotal to ensure the success of your cybersecurity program. Without it, all your efforts and spending are unfortunately vain.”

Kolochenko recommends that enterprises:

  • Implement a continuous security monitoring system with anomaly detection to spot intrusions, phishing and password re-use attacks.
  • Run a continuous discovery and inventory of your digital assets, visualize your external attack surface and risk exposure with a solution that is enhanced with Dark Web and code repositories monitoring.
  • Implement a holistic, DevSecOps-enabled application security program to test and remediate web and mobile applications, APIs and OSS in a timely manner.
  • Implement a third-party risk management program encompassing continuous monitoring of vendors and suppliers, going beyond a paper-based questionnaire.
  • Invest in security awareness of personnel, explain the risks of using professional emails on third-party resources, gamify anti-phishing training and reward the best learners.