Dhaka:Kaspersky Security Services researchers have identified a vulnerability in a barcode scanner model from a major manufacturer that could be exploited as a cyberattack vector. This vulnerability has significant implications for sectors such as warehousing and retail.
According to Bangladesh Sangbad Sangstha, the researchers discovered that the lack of authentication between handheld scanners and base stations could allow attackers within wireless range to inject keystrokes. This flaw could potentially lead to remote code execution without user interaction. The vulnerability was found to be present in devices from multiple vendors.
Handheld scanners typically communicate with a base station connected to a workstation or business system. In a potential attack scenario, an attacker could obtain the base station's Bluetooth address through passive eavesdropping and send a malicious payload simulating keyboard inputs. The base station then forwards these inputs to a connected PC, which may execute unauthorized commands, providing an initial foothold within the warehouse network. This could expose critical operational systems to threats.
Similar vulnerabilities may also affect Portable Data Terminals and thermal printers, enabling access to Warehouse Management Systems. The complexity of modern warehouses, driven by technological advancements and the doubling of global e-commerce sales to over $6 trillion since 2019, underscores the potential impact of such vulnerabilities.
Sergey Sidorov, Head of Industrial Security Services at Kaspersky, emphasized the importance of cybersecurity in retail and logistics sectors. He stated that pervasive connectivity in these industries means that any technological device could become an entry point for a cyberattack, capable of destabilizing the entire ecosystem.
Kaspersky advises companies to verify devices before connecting them to networks, disable unused Bluetooth interfaces, enforce strong authentication measures, segment networks, apply security updates promptly, restrict account permissions, and conduct regular attack-path exercises, including insider-threat scenarios.
The Kaspersky ICS Security Assessment identifies vulnerabilities in industrial control systems, operational technology, and networked devices, ensuring safety without disrupting operations. Additionally, Kaspersky Industrial Cyber Security further enhances infrastructure visibility and protection for industrial organizations, including logistics companies, while maintaining system availability.