Warshipping – A New Attack Type to Hack into Corporate or Personal Networks

Warshipping is a new form of attack that counters the limitations with wardialing and wardriving techniques and improves the accuracy dramatically.

An attacker could gain access to the system remotely from anywhere all they need is to ship a tiny device in the package to their victims to get access to their network.

“IBM X-Force Red investigated how cybercriminals might seek to exploit package deliveries to hack into corporate or personal home networks right from the office mailroom or someone’s front door.”

The Warshipping device is the cheap and small single-board computer (SBC) that can run on run cell phone battery level.

“The device, a 3G-enabled, remotely controlled system, can be tucked into the bottom of a packaging box or stuffed in a child’s teddy bear and delivered right into the hands or desk of an intended victim.”

X-Force team built these warshipping devices, those devices are not only cheap, but it can also be easily built by an average level cybercriminal.

“Using a command-and-control (C&C) server we created for the task, the devices we had set up securely checked for a specific file on the server to determine if they should stay on or go back to sleep. With off-the-shelf components, this do-it-yourself (DIY) “hacks and crafts” project can cost a cybercriminal under $100.”

With the warship device, attackers can launch wireless attacks by just being shipped by someone at the doorstep. the device also transmits it’s GPS coordinates to the C&C server.

Once the warship device placed in the target environment. the attackers can able to remotely control the system and attempts to hack the wireless networks.

“With our warship device, we could also launch other active wireless attacks, such as a deauthentication attack or “evil twin” Wi-Fi attack. By launching an evil twin Wi-Fi network, we could then set up a rogue Wi-Fi network with the warship device and coax our target to join our new decoy network,” reads the IBM X-Force report.