Your building has a door policy. Visitors sign in, badges get checked, tailgating gets challenged. Then a courier drops forty parcels at reception and nobody checks any of them, because a parcel is not a person. Warshipping is the attack that lives in that gap: a small wireless device, posted in a box, that attacks your network from inside your own mailroom.
It is not a theoretical attack. It was demonstrated publicly by IBM's X-Force Red team in 2019, using a device assembled from commodity parts for a trivial sum. The technique has been in the public domain ever since, and the components have only become cheaper and smaller.
What a "warship" actually is
The device is unremarkable, and that is the point. A single-board computer roughly the size of a phone, a wireless adapter, a cellular modem for command and control, a GPS receiver, and a battery. It costs less than a decent office chair and fits inside the packaging of almost anything you might legitimately order.
Two design details make it work as a weapon rather than a gadget:
- It sleeps. The device spends most of its life powered down, waking periodically to check where it is and whether it is worth doing anything. That duty cycling is what turns a few hours of battery into days or weeks of loiter time — long enough to survive a slow courier and a long weekend in a post room.
- It knows where it is. With GPS on board, the attacker can have it stay dormant in transit and only begin work once it reaches the delivery address. A device that starts attacking networks in a sorting office is a device that gets found; one that waits until it is on your premises is one that does its job.
Because it carries its own cellular link, it never needs your network to report home. The attacker can sit anywhere in the world and interact with it in real time, which means this is not a "collect and retrieve" attack. Nobody has to come back for the box.
What it does once it arrives
The first job is listening. The device sits passively and captures wireless traffic around it, looking for the handshake exchanged when a legitimate device joins a network. On a pre-shared-key network, that handshake is enough to attempt an offline password crack — and crucially, the cracking happens on the attacker's hardware, not on the battery-powered thing in your post room.
If it does not hear a handshake soon enough, it does not have to wait. A deauthentication attack knocks nearby clients off the network; they reconnect automatically, and the handshake the attacker wanted is captured on the way back in. To a user this is a Wi-Fi glitch of the kind that happens several times a week and nobody reports.
Once a key falls, the device is on the network — and the attack stops being a wireless problem and becomes an ordinary intrusion, with one important difference: it starts from inside. There is no perimeter to cross, no phishing email to get past a filter, no credential to steal first. Whatever your internal network trusts, it now trusts the parcel.
There is a second path that does not need a password at all. The device can impersonate a network your staff already trust, and devices configured to reconnect to known SSIDs will do so automatically. That yields intercepted traffic and, depending on what is being run, an opportunity to harvest credentials directly.
Why the mailroom is the gap
Physical security is usually designed around people. The controls answer the question "should this person be inside the building?" — and they answer it fairly well.
A parcel is never asked that question. It arrives pre-authorised, because somebody somewhere in the organisation orders things and receiving them is the mailroom's entire job. It then does something no visitor is ever allowed to do: it sits unattended, often for days, frequently in a back-of-house room that happens to be close to the comms cabinet, on a floor where staff are connecting to wireless all day.
Warshipping does not defeat your physical security. It declines to engage with it.
How worried should you actually be?
Honest answer: this is a targeted technique, not a volume one. Nobody is warshipping small businesses at scale, because it costs an attacker time, hardware and a delivery address, and it only pays off against a target worth that effort. If your threat model is commodity ransomware arriving by email, this is not the thing to fix first.
It matters more if you are the kind of organisation somebody would plan against — if you hold something specific that a competitor, a nation state or an organised group actually wants, or if your wireless network is the soft middle of an otherwise well-defended estate. It is also worth understanding because the defences against it are, almost entirely, things you should be doing anyway.
What actually stops it
Fix the wireless, not the mailroom
The single most effective control is removing the thing warshipping attacks. A pre-shared key is a password that every device in the building knows and nobody ever changes, and it is the target of the whole exercise.
- Move corporate wireless to 802.1X with per-user or per-device authentication. There is no shared key to capture, so the handshake the device is waiting for is worth nothing to it.
- Use WPA3 where your estate supports it. Its handshake is specifically designed to resist the offline cracking this attack depends on.
- If a PSK is unavoidable — and on guest and some IoT networks it often is — make it long and genuinely random, and treat it as a credential with a rotation schedule rather than a sticker on the wall.
- Turn WPS off. It is a shortcut past everything above.
Assume something will get on, and make that boring
The second half of the defence is accepting that a device might succeed and making the result useless. Guest wireless that reaches nothing but the internet. Building systems, printers and IoT on their own segments rather than flat alongside finance. Internal services that require authentication rather than assuming the network is the boundary. None of this is warshipping-specific advice, which is rather the point — segmentation that stops a parcel also stops a compromised laptop.
Watch for the noise it makes
The attack is quiet, but it is not silent. Deauthentication floods, an access point broadcasting an SSID that should only exist on your own hardware, a new device authenticating from a part of the building where nobody works, a first-time join followed immediately by internal scanning — each of these is visible if something is watching for it, and each is the sort of signal that gets dismissed as a glitch if nothing is.
And yes, do something about the mailroom
The process controls are unglamorous and cheap. Unexpected or unattributable deliveries get questioned rather than stacked. Parcels do not get stored in comms rooms because that is where there happens to be space. Post is opened and moved on rather than left to sit for a week. None of that stops a determined attacker on its own, but it shortens the window the device is relying on.
Where this fits in testing
If you want to know whether this would work against you, the useful exercise is not a discussion — it is a wireless assessment that answers three questions: what authentication your corporate wireless actually uses, what an attacker gets if they obtain a key, and how far a device on your guest or IoT segment can reach. We run wireless testing in house as part of our penetration testing practice, and that is the short version of the scope.
The broader version belongs in a red team exercise, where physical delivery is one of several routes in and the question is not "is this one gap open" but "what happens after any of them opens".
Where we stand
Warshipping is a good story, and good stories get overstated. It is not the most likely way your organisation will be attacked this year, and any vendor who tells you otherwise is selling something.
What it is, is a clean illustration of an uncomfortable principle: attackers go around controls rather than through them, and the control you have not thought about is the one that gets used. The reason this technique works is not that mailrooms are badly run. It is that the wireless network treats "physically nearby" as a proxy for "trusted", and a parcel is an extremely cheap way to become physically nearby.
Fix that assumption and warshipping stops being interesting — along with a good number of attacks that arrive by less imaginative routes.