As promised, we are about to share details of our talks at the SAS 2026 conference.
In an paper titled “The journey of a paper unicorn: adventures inside a modern warehouse” our experts share some results of research into the security posture of a large logistics center. The authors trace the full path of a single order through a warehouse, build a threat model, examine possible paths of intrusion into the infrastructure, and discuss the practical consequences of compromising a warehouse management system (WMS). And, of course, we provide recommendations for protection.
For example, one of the attack vectors is portable data terminals (PDTs), ordinary Android devices with an embedded barcode scanner, carried by workers to scan items; each scan is passed to a dedicated application that forwards it to a remote server over an API. To keep workers on task, the devices usually run in kiosk mode, locking the user to that single application and preventing interaction with the rest of the Android system.
Our research revealed that these restrictions were not difficult to bypass even for an ordinary warehouse employee. This turns the terminal into an initial access vector: escaping the kiosk can expose the Wi-Fi password of the network the terminal is connected to, or allow malicious software to be installed that gives the attacker remote access to the warehouse network over the internet.
A handheld terminal carries authenticated WMS API access as a matter of course, and anyone who gains control of that terminal inherits it (by escaping the kiosk, for example). Depending on the device’s permissions, that might mean confirming picks that never occurred, falsifying receiving operations, adjusting stock counts, or marking orders complete — something warehouse employees themselves could use to avoid their assigned duties.
That’s why personnel security should form an additional layer of the warehouse security architecture. In most industrial and ICS environments, getting inside means clearing background checks, holding relevant qualifications, or proving prior experience; the hiring process itself acts as a filter. A warehouse is different. Roles in sorting, packing, and courier work are hired quickly and in volume, and they typically require no prior expertise, certification, or specialized background at all. An ordinary person can walk in off the street, be hired within days, and immediately hold legitimate physical access to the facility.
Therefore, a more restrictive and risk-based approach to hiring should be considered, particularly for roles that provide access to sensitive areas, operational systems, network infrastructure, or customer assets.
Read more in the full research article.
