In this digital age where cases of cyberattacks are more and more frequent, we find that hackers constantly create new techniques every day to break into the systems of their targets. One of these techniques is to deliver targets, small devices of low power and disposable, which are able to hack a wireless network, whether personal or business. This technique was recently named Warshipping.

Security researchers at IBM X-Force Red say this is an innovative and effective way for an attacker to gain a foothold on a target’s network. They also shed light on the mechanism of this hacking technique by creating a device no bigger than the palm of the hand, which could be hidden inside a teddy bear and sent to the target by mail.

This device used a small 3G modem, cost about $ 100 for its manufacture and once configured, it periodically searched for nearby networks to track the package shipped. Charles Henderson, Head of IBM’s Offensive Operations Division, said: “Once the package has arrived at the target door or mailroom, we are able to remotely control the system and execute tools to attack passively or actively wireless access to the target.

Once a network has been compromised, the device then looks for data that it can then retrieve and send back to a more powerful system so that it can be hacked later. Henderson has also indicated that thanks to this, they have been able to decipher the pre-shared key of a user who tried to connect to the attacked network and thus to have wifi access. With this access, the hacker can navigate the network looking for vulnerable systems and data exposed, and all this without anyone noticing until the package has been opened.

Henderson also noted that the device could also be used to create an unreliable wireless network to entice a victim to join him and open up to further attacks. While some recommend as a means of protection against this type of attack, to pass all packets x-rays, Henderson recommends instead to avoid them to enter sensitive areas of a company. On the other hand there are some who think that it is not possible to be safe from this type of attack, because this device could be placed in a ceiling of the company by a person cleaning service and nobody will discover anything.