IN A typical set-up, handheld scanners communicate with a base station connected to a workstation or business system. Kaspersky claims there is not always authentication between the base station and the scanners.

An attacker within Bluetooth range could obtain the base station’s address, for example by passively eavesdropping on Bluetooth traffic, and send a malicious payload that simulates keyboard keystrokes. The base station forwards these to the connected PC, where they are treated as legitimate user input and could be used to run unauthorised commands without any user interaction. Kaspersky said it had observed this attack pattern across devices from multiple vendors.

The scanner serves only as the entry point. The risk lies in the trusted position of the compromised computer and its connections to critical systems. Researchers believe the same approach could be used with portable data terminals or thermal printers to reach systems such as the WMS.

Kaspersky recommends that operators verify every new device before it connects to the network, disable unused Bluetooth interfaces and enforce strong authentication. It also advises segmenting warehouse networks so only essential connections are permitted, promptly updating both devices and the WMS, keeping account permissions to the minimum required, and regularly running full-scale attack-path exercises, including scenarios involving insiders with legitimate credentials.

While users acknowledge the strong technical malware-detection capabilities of Kaspersky, many advise against using it due to political and data-privacy concerns. For example, the USA has banned the sale, distribution, and software updates of Kaspersky products due to its Russian roots and alleged ties to Russian intelligence agencies.