Warshipping: infiltrate corporate networks using postal service

In the beginning it was the wardialing: the scan a block of numbers (dialed with specific software and a modem) often related to a company, in order to find out a fax or a modem response.

With the advent of Wi-Fi, wardriving was born: the technique of walking, usually by car, near a target company with a laptop equipped with software that searches for open Wi-Fi networks and records the names and coordinates.

Now comes a new term: warshipping.
It was invented by the hacking group IBM X-Force during the last Black Hat.

Why?

The wardriving has a specific problem: the scan is done walking around the target, and this can be spotted by phisycal security that also does not allowing a stranger to enter the buildings to discover vulnerable internal Wi-Fi not reacheable from outside.

Solution? Use the postal mail!

The warshipping consists in staying comfortably at home (maybe in another country) but send by postal mail to the target company a package containing everything needed to scan the internal Wi-Fi networks: a little object composed of a mobile phone battery, a small processor and a Wi-Fi and 3G transmitter, which costs less than a hundred dollars.


How it works?

The warshipping device, being sent by post to the attention of some employee whose name was discovered with search on LinkedIn, is welcomed into the company and remains there a few hours before being delivered.

Furthermore, if the device is then hidden in a double bottom of the delivery box, the box can remain in the company for a long time before being disposed of.

During these hours the device can detect all internal Wi-Fi networks, listen to their traffic and sending data to the attacker via the cellular network.

The device can also create a fake access point with a SID identical to the actual corporate network and convince employees to connect to the fake network by giving them their access passwords.


How to mitigate this risk?

SecurityIntelligence, in seven points, suggest (when applicable) to not accept that employees receive packages in the office.
Optionally, keep each package arriving in a secure area of the company, treating it as if it were an outside visitor.
Finally, educate employees to not connect to Wi-Fi networks that behave abnormally, and start using preshared keys in corporate wifi.


References


Related posts

Comments

This site uses Akismet to reduce spam. Learn how your comment data is processed.