Warshipping


In computer network security, warshipping is using a physical package delivery service to deliver an attack vector to a target. This concept was first described in 2008 at the DEF CON hacking convention by Robert Graham and David Maynor as part of a talk entitled “Bringing Sexy Back: Breaking in with Style”, that included various penetration testing methods. In their implementation, an iPhone box was modified to include a larger battery, which powered a jailbroken iPhone. A first-generation iPhone was chosen for this attack based on the reported run-time of 5 days when coupled with an external battery, whereas newer 3G iPhones of the era would reportedly run for 1½ days. A social engineering pretext was described that would trick the recipient into believing they had won an iPhone, in order to explain the shipment.
The advancement of low-power electronics, thanks in part to maker culture, has greatly increased the effectiveness of this methodology as a credible method of attacking networks. In 2019, IBM X-Force Red coined the name “Warshipping” and described an attack platform that included several low-cost components that could be combined, shipped to targets, and controlled remotely for 2–3 weeks. A solar component was also described to allow the devices to run indefinitely.
Aspects of a modern warshipping attack include the following:
The increasing use of large, online retailers contributes to the relevancy of this attack. In 2019, the United States Postal Service reports that they deliver 484.8 million mailpieces per day. The name is by analogy with wardriving and wardialling.