At the annual Black Hat cybersecurity conference, which took place last week in Las Vegas, Nevada, IBM’s X-Force Red presented in front of more than 19,000 security professionals from roughly 90 countries a new attack technique they’ve nicknamed “warshipping.”
Similar to wardriving, when you cruise a neighborhood scouting for Wi-Fi networks, warshipping allows a hacker to remotely infiltrate corporate networks by simply hiding inside a package a remote-controlled scanning device designed to penetrate the wireless network—of a company or the CEO's home—and report back to the sender.
“The U.S. Postal Service processes and delivers 484.8 million mailpieces of first-class mail a day—roughly one-and-a-half mailpieces for every person in the U.S.—in a single day,” said Charles Henderson, the head of Big Blue's offensive security team. “What most people don’t realize is that some packages they receive may be looking to steal personal or confidential information. And the proliferation of e-commerce-related package deliveries is exactly what cybercriminals can exploit with a tactic IBM X-Force Red is calling ‘warshipping’.”
With this in mind, IBM X-Force Red—an autonomous team of veteran hackers within IBM Security hired to break into organizations and uncover security vulnerabilities that criminal attackers may use—investigated how cybercriminals might seek to exploit package deliveries to hack into corporate or personal home networks right from the office mailroom or from someone’s front door.
“Our aim in doing so was to help educate our customers about security blind spots and modern ways adversaries can disrupt their business operations or steal sensitive data,” said Henderson.
For that purpose, Henderson's team built a cheap (less than $100) 3G-enabled 'warship device' which is a single-board computer with a Wi-Fi chip, antenna components, and a battery that is small enough that it can be hidden in a package element.
“Applying some clever hacks, we were able to turn these devices into low-power gadgets when active and power them off completely when dormant. Using an internet-of-things (IoT) modem, we were also able to keep these devices connected while in transit and communicate with them every time they powered on,” said Henderson.