>> Today's episode is brought to you by Squarespace.
>> Head on over to squarespace.com/rogue,
use promo code rogue at checkout, get 10% off,
make us look good, and you become a champion in my heart.
>> What's the most hackery thing you've ever done?
... That you can admit on camera?
[Brian and Shannon laugh]
Dot, dot, dot, that you can admit on camera?
>> Man, that was a hairpin turn right there.
[Brian and Jason laugh]
>> Yup.
♪ [mellow music] ♪
>> robot voice: The many uses of the Bash Bunny.
>> And we are back again with Shannon Morse
of Hak5 and TekThing. >> Hey.
>> One of my favorite things we did on the TV show
was show off the Rubber Ducky,
which pretends to be a keyboard and does a bunch of stuff. >> Oh yes!
In fact, how well did you understand that
while we were doing it?
>> While we were doing it, very little.
I know that there was some social engineering involved
with it that you can use this cute, little rubber ducky
with a USB drive in it,
loaded payload there and put it in a parking lot
or on a park bench or something like that.
Someone gets it, says, "Oh, I wonder what's on here?"
Plug it in, and then it just wreaks havoc
and steals all your stuff.
>> And specifically, [Shannon laughs]
if I understand this correctly,
the reason the Rubber Ducky worked is
because it wasn't trying to pretend to be a hard drive
or any device of importance.
It was an HID, a human interface device,
like a mouse >> Exactly.
>> or a keyboard.
It basically says, "Hello, I am a keyboard,"
and it says, "Oh, you're a keyboard?"
"Well then I don't need administrator access"
"to grant you privileges."
"Great, you're connected!"
"Also, I'm a really fast keyboard programmed"
"to type a bunch of codes into here,"
"go ahead and write an entire program,"
"and open up back doors," [Shannon laughs]
"and I'm done, I'm out, bye."
>> You know, that was actually a really great explanation,
so you can just take it from here.
>> Go for it. [laughter]
These days, you don't even need to cute it up
and put it in a rubber ducky
because someone sees a USB drive or a stray SD card,
and they just think, "I'm going to see what's on there."
>> Shannon: I know, right? >> And it's just
the human vulnerability >> It is.
>> that really makes this effective.
>> It's that inherent trust that people have
on these things, and they want to help people.
The first thing you think when you see something
that's lost, unless you're a terrible person, is
"Oh, I should help them."
They might have some kind of identifying information.
[others drowned out by Jason] >> Yeah, totally. That's actually,
that's what I think all the time, yeah. [laughter]
>> But that is what I think. [Shannon laughs]
If you found a cell phone,
you would open it and then you'd say like, "Call Mom"
or whatever, and so essentially,
you find one of these, you plug it in.
How is this different than a Rubber Ducky?
>> This thing has three different switches on it,
one, two, and three.
So, it turns out, this can actually mimic a couple
of different things even at the same time.
So, it can mimic a flash drive, which is very cool,
because it has storage built into the inside of it;
it can mimic an Ethernet adapter as well;
or a serial device, [Brian gasps]
so very similar to a USB Rubber Ducky.
>> Hold on, hold on, hold on, hold on.
So if I was predicting nefarious things, first of all,
I would say the flash drive
by itself would be fairly innocuous, but an Ethernet,
I'm going to assume this thing has the capability
to log everything that happens on that Ethernet.
>> It can basically pretend
to be its own little network interface,
so I could potentially steal things over the web
from a computer.
If I plug this into it-- >> Okay, and then finally,
the human interface device, the serial device,
that's basically a Rubber Ducky.
>> Yeah. >> So I do know
that with the Rubber Ducky,
you had to have a preprogrammed script
that just ran on Rails.
You plugged it in, and you had to make sure,
if you knew you were trying to penetrate
a Windows 10 computer, you would write a script
to open a command line and start doing stuff
appropriate for that device.
Is it the same thing on this one?
>> It is pretty much the same thing on this one as well,
but this one is cool because I can store multiple payloads
on the thing and then just pick and choose whatever I want
given the specific scenario.
>> So does this have any sort of vulnerabilities
like it'll only work with Windows X and above,
or it will only work on this type of system,
or something like that?
>> Actually, no.
Pretty much all computers are very trusting.
Now, if you have a computer
that automatically blocks flash drives,
for example, with the USB Rubber Ducky,
that's why it does HIDs,
then I could set this
up to be-- >> Wait, wait, wait, boop.
Roll that back. >> Yeah, back up.
Sorry. >> Sorry, that's
why it does HIDs?
Explain. >> Yeah, I don't even know
what that is. >> Human interface devices!
>> Oh, got it, yes. >> Oh, H-I-Ds,
okay. >> No, okay, I knew that.
That's exactly, same page, same page. >> Sorry, yeah.
I heard the same thing.
[all laugh]
What's that?
Do I need to watch out for these?
>> So that's why this one can also do the Ethernet adapter,
because you know, you're not going to block an Ethernet adapter.
You need wireless.
>> Ethernet adapters have the same access.
Oh, interesting. >> Oh my my.
>> Okay, okay, okay.
So, you could have a bunch of preprogrammed scripts like
I don't know what kind of computer I'm going to see
in this foreign embassy,
but I know it'll probably be either one of these flavors
of Linux or one of these versions of Windows or whatever,
so I'm going to have a whole bunch of them ready to go. >> Yeah.
>> Then you stealth in, you pretend to be a janitor.
>> It identifies where it is.
>> Does it figure out what it is connected to?
Or do you have to say, oh, no, no, no,
it's this type of computer.
Let me pick this script to run when I plug it in.
>> I will have to figure out what the computer is
that I'm going to be attacking first,
and then I'll be able to write the script
for that specific scenario.
>> Got it, okay.
So let's say you have a whole bunch of different options,
and then you see like, "A-ha!"
they're running this version of Linux,
and then you tell this, run the version that works on this.
>> Exactly.
So, I have plugged this into my Linux computer
to show you what is currently on the Bash Bunny,
and I have this library of payloads.
I have so many, and all of them are open source
on our GitHub.
So I was just able to download all
of these for free, totally.
>> Can I... [stammering] --okay.
[Brian and Shannon laugh]
Wow.
>> I like the folder labeled prank.
>> Yeah, that's the most innocuous
of them. >> But yeah,
prank's really fun.
So, I can like automatically pull up a 1990s website,
I can make websites go upside down,
I can do a Windows 93 thing,
make your computer look like it's from '93,
and then there's a really fun one in here
like SMB Exfiltrator that lets me use Windows file sharing,
that allows you to share files over a local network,
but I can use that on this so that it's file sharing
to the Bash Bunny. [laughs] >> Holy cow!
>> So I can steal files over a network.
>> You have to know what you want the Bash Bunny to do
>> Exactly. >> as well as
what type of computer you're doing.
It's not just going to be- >> You've got to plan.
>> -a blind plug it into any laptop [fingers snap],
and it does its thing.
>> Yeah, and then you, as a hacker, as somebody that goes in
and is hired to run attacks on a company,
you're going to go in
and make sure that you do some reconnaissance
before you run any kind of attacks.
So this is the attack mode.
>> Now, all of the things that you've shown us,
very, very little code is required.
>> That's true, yeah.
>> Very little.
It's all just rudimentary commands
that anyone can understand. >> Yeah, it's true.
Hak5 and our community and Darren Kitchen have made it
super easy to write all of the different payloads
for all of our devices.
>> All right, let's say we have penetrated the embassy,
we know that we want to extract all of the secret files
from one computer.
I know that this guy is talking to your Linux machine.
Has this guy talked to this machine at all?
>> No, not yet, because I haven't plugged it in,
but I want to get physical access to this machine.
>> Okay.
>> So, let's say that somebody leaves their computer open,
and I'm just sitting right behind them at a coffee shop.
And I look over,
and I automatically can tell from what I see on the desktop,
that's definitely, definitely Windows 10.
Okay, so I know what they're currently running.
So I go over to my Linux computer,
and I say, what can I run against this
so that I can steal files from it?
I know.
Something that's really rudimentary, super easy.
USB exfiltrator.
It's a USB device that's going to exfiltrate data
from this open, unlocked machine.
>> So in other words,
you're converting it into a giant scraping device,
where it's just going to go through,
grab anything of a particular file type,
and download it onto the storage on there.
>> That's exactly what I'm going to do.
[Shannon laughs] >> So you can select like
text files, PDFs, stuff like that,
>> Brian: JPEGs. >> or you could do JPEGs,
yeah. >> Yeah, you could.
>> Can you get like, video files
or really just anything? >> Yeah, if I want to.
Now, it doesn't have a lot of storage on here,
so if you want to get >> Okay.
>> video files, I would suggest changing the code
so that you can transfer the files to another flash drive,
or you transfer them over the network.
>> Okay.
>> But in this case,
I'm going to just steal text files and PDFs,
because chances are
if you have tax docs-- >> She's only going to steal
text files and PDFs, Jason. >> Well here's the thing,
here's the thing. >> I don't see
what there is to be afraid of. >> It's harmless.
>> Say you have tax docs from your CPA,
they're probably PDFs, right?
>> I haven't paid taxes
in like five years, so. [Brian and Shannon laugh]
>> So I'll show you the payload >> I don't know what you're talking about.
>> which I am
currently running on this one.
So I have already copied this payload over
to one of the switches on this Bash Bunny,
one of the physical switches,
and when I switch to that switch on this computer,
you'll get to see what happens.
>> So, okay, so it's basically in standby mode
until you basically flip
the red switch where it's like >> Yeah.
>> now bomb is live, >> Active.
>> and then the moment it plugs in,
it's going to go to work.
Before we try it on this,
it seems like we should put some secret documents
for her to recover, right?
>> Oh, that's a good idea.
>> Yes, yes. >> Leave the embassy, my lady.
We have important documents to write.
[static crackles]
Are you ready, sir?
I have written The Modern Rogue: A Manifesto.
>> Wait, what is this for?
>> Our super secret ideas.
>> What are our tenets?
>> Grey Hulk was better than Green Hulk.
>> Okay, fine.
Mr. Fixit, I'm down with that.
President Kardashian will be imprisoned on our moon colony.
[wheezy muted laughter]
>> Okay. >> High waisted pants are
better than low waisted pants. [Brian laughs]
>> Are you sure we want to make that part
of our official platform?
>> Absolutely we do. >> Okay.
[laughs] High waisted pants
F-T-W.
[static crackles]
Ah! Well, we've done our hard day's work.
I certainly hope nobody infiltrates the embassy
and secretly steals our information.
I'm just going to, I don't know about you, Jason,
I'm just going to lay down and take a little napsy.
>> Jason: Yep.
>> Brian: A little naperoo.
Just uh... >> That's good, nothing to see here.
>> Just, you know what,
>> Shannon: Get out of my way!
>> I like to nap on my side. [Brian and Jason laugh]
>> Jason: That's how he looks when he relaxes.
>> Brian: Not worried at all.
>> Just sleeps with his arms >> Nobody will--
>> suspended up high.
>> That's as one does.
The only thing that could wake me is the panicking reality
that somebody has stolen our manifesto
and is able to tell us something from it.
That would rouse me. >> I'm going to do something
completely believable and be buried in my phone.
>> Uh okay.
Well, I'm just snoozin' away.
Real great, I going to sleep with one eye open. >> [whispering] What just happened?
Did it just happen‽
>> [whispering] What was that?
>> Did she just do it?
>> There was just like a little blink.
>> I don't know.
>> Jason: A little blink on the screen.
>> Shannon: What did it do? >> Brian: Wait a minute,
it was that fast?
Is it happening now?
>> It's happening.
>> It's happening right now.
>> It's The Happening!
>> Okay, how long does it take?
>> So I set this up to steal everything out of the desktop
and the documents folder.
Which means it's going to take about a minute
for it to steal all of the documents. >> Okay.
So you're saying I should
just keep on snoozing [laughter]
back over here. >> Yeah, just snooze.
Just hit snooze for another minute.
>> It's A-OK.
>> Yep, everything's fine.
>> Shannon: I'll be able to tell that it's done
when it tells me that it's finished copying,
so it's currently in use.
So it's copying everything right now.
>> So the payload that it ran, so it plugged in,
pretended to be a device, ran a bunch of...
[organic defragmenting]
With the flash, were you able
to see any code being executed
or anything? >> Uh, I saw a window pop up
and then vanish.
Because I wasn't paying [Shannon laughs]
close attention, I looked over, it went bloop, bloop.
That was it. >> Yep.
That's about all
that you're going to see. >> And there was nothing
in the window either,
really, or that I saw. >> No.
Yeah, and it did pull up the little Run command,
but it typed in so quick that it's impossible to read.
>> And the fact that everything that's happening is happening
in the background of the computer,
it makes me feel like you could casually lean over
and strike up a small talk conversation with someone
and just talk long enough for it to finish its jam.
>> And think about it,
if I just set this up to steal one folder
instead of like the entire desktop [laughs] of everything
that I have on this machine... >> It would have been instantaneous.
>> Instant. Yeah, instantaneous. >> Wow.
>> So if you walk away from your open, unlocked computer
while you're at the coffee shop just to go grab your coffee
from the front counter, >> That's all it takes.
>> that's all it would take to just steal all your documents
out of, I don't know,
your download folder. [Brian gasps]
Okay, so it is done now.
So, I can go ahead and eject it.
♪ ♪
[laughs] Why did you flinch so bad? >> I don't know.
You were really careful with it,
and I just thought... [Brian and Shannon laugh]
>> I don't want to break it.
>> Well, I don't know what's going to happen. >> It definitely looked like a red-wire,
green-wire moment. >> Yeah.
[laughter] >> Where it's like--
>> You kind of hesitated on it,
and I was like, "Oh, oh!"
[static crackles]
>> Brian, if you will help me and grab my laptop.
>> Ah, indeed!
We're back at the hideout
that we definitely have been have been hiding out in.
>> We're at the hideout. >> Yeah, see boss.
I knew you could penetrate that embassy.
Those Modern Rogue guys are a bunch of real doofuses.
>> [laughs] If I left this in the switch position for attack,
and I plugged this into my laptop right now,
it's going to try to attack me. >> It would try to attack you.
Got it. >> So I'm going to switch it back
into just the regular platform, the regular switch,
so that it will just read whatever data is currently
on the Bash Bunny. >> So this is in safe mode
where it's just being a flash drive.
>> Yeah, it's in safe mode. >> Got it.
>> Exactly. >> Pro tip,
because I totally would have been like,
"I got it! I got it!" Plugged it in, "Aw, man."
[Brian and Shannon laugh]
Self-own.
>> Self-own, yes. [Brian laughs and claps]
So, it's going to boot up.
There we go. Okay.
>> That should be a product, the self-own cellphone.
>> Self-own cellphone. >> It's a cellphone
that whatever you say, it just makes you insulting yourself
to the other side. [Jason laughs]
>> All right, so, I want to show you
this because it's pretty funny. >> I'm onto something here.
>> Shannon: The attack created this loot folder right here,
and inside the loot folder, I have USB Exfiltration,
which is the payload I just ran,
so if I double-click on that, I see SNUBS-RAZER
and then the date and the time. >> Brian: Okay.
>> Shannon: That's the exact time that I did this attack.
So then I have two folders inside of there called Desktop
and Documents, so it obviously stole two different folders.
Now, I'm going to go into Documents.
[Brian gasps]
♪ ♪
>> It's our manifesto!
>> Jason, Jason, >> So--
>> I've just received word.
Our manifesto may have been leaked!
>> I have a couple of Quick Start Guides in here,
and then I have The Modern Rogue: A Manifesto.
So I'm going to hit... >> Oh, dear.
>> I'm going to enter it. >> Oh, Jason, I think
she might be reading,
>> Jason: We're exposed. >> Brian: -the hacker lady, I think she--
>> Let's see. >> Trigger the thermite.
Trigger the thermite! [Brian groans and laughs]
>> Gray Hulk was better than Green Hulk. >> Where is Ricardo Montalban? [laughs]
Moon jail, high waisted pants
F-T-W. >> Snubs!
>> She's defeated us!
She's got our secret documents!.
>> Castlevania II was the best in the franchise?
>> Yeah. >> That's just science.
>> Brian: Yeah, that's true.
>> There are multiple endings.
I mean, what do you want?
>> This time they'll get the live-action
Avatar: The Last Airbender right. [laughs]
>> I do believe that, though. >> I do too.
>> That's a real thing.
>> I do too. >> Ooh, look at this.
>> It's from the original creators.
>> Hey! Check that out.
Somebody left a password in here.
>> Oh dear. >> Reminder,
our password is grilled cheese with a three.
>> No, that doesn't sound like
something we would... >> Yeah, that doesn't
sound like us. >> Subs over dubs always.
Mmm.
[laughs] @Snubs over subs over dumbs.
[all laugh]
>> Oh, I wrote dumbs?
>> Dumbs.
[laughter]
>> Right, well, thank you for coming.
>> Ooh. >> Yes.
[all laugh]
>> I am sufficiently
terrified of this thing. >> It works!
>> It definitely, definitely [Shannon laughs]
works, and this is some super-duper spy stuff.
>> I literally found an SD card in the barbecue place,
>> [gasps] Did you really? >> in the parking lot
of the barbecue place that we were talking
about last night. >> Ooh.
>> Did you plug it in?
>> Uh, it...
yeah.
[Shannon laughs] [Brian feedback loops his own stammer]
[Jason drowned out by Brian] >> So! Where can people
see more of your work, Shannon? [laughter]
And learn lessons about not just taking random SD cards
and plugging them into your machine?
>> Well, if you want to learn full tutorials
on how to use this, some primers,
and some other payloads that we've run,
you can check out Hak5 at youtube.com/hak5,
and you can find me on Twitter @Snubs, S-N-U-B-S.
>> Right on.
Now, if I could just delete some of these files.
>> Oh, too bad.
It's on here, it's not on there.
>> If I can, oh, Ricardo Montalban.
>> Jason: Yeah, look. [laughs]
Oh, Herve Villechaize.
Jason Murphy, you know we're almost
to our one-year anniversary
of articles at themodernrogue.com.
>> That's crazy.
>> Right‽
And of course, we were able to go
from nothing to awesomesauce immediately thanks
to our friends over at Squarespace.
Other people spending six figures to get,
[affecting a nasally voice] "Oh, I'm a web programmer."
>> I mock you
if you're spending six figures [Brian laughs]
on making your website.
Why‽
You fool!
>> We're talking about doing a complete redesign
of themodernrogue.com, and now we need your feedback at home
to let us know what you want, whether it's forum boards,
whether it's ways to discover content.
You want a random button so you can just go
to different articles? >> Brian doing the dance
>> Oh, geez. >> with a little GIF
in a corner?
You want that? >> We could do that.
We could put that in there.
>> Yeah, just tell us what you want.
>> Squarespace makes it easy, man.
Too easy.
>> I disagree.
I think now websites are in the hands of the masses.
>> They could look smart and professional
with their blog portfolio or any other kind of website.
Go to squarespace.com, start your free trial, get 10% off,
use promo code rogue, that's R-O-G-U-E.
There's an O-G in rogue.
It stands for...
[haunted exhale] Ooooooooaaawwwhhhh-
-guh.
>> Otter gestation.
>> [laughs] That would be h.
>> Otter
>> Oh, otter.
>> gestation.
>> I thought you said honor
gestation. [laughs] >> Oh.
>> Where it's like you're digesting,
and you're like, "Here is self-respect."
Enjoy my honor [laughs] gestation.
[both laugh]
>> God, we're stupid sometimes.
[Brian laughs]
— CC BY REV — * MODIFIED BY BIZARRE MAGIC * [branding furnace hissing]
[Brandt imitates Brian's howling moan]
>> Both: Guh.
[laughter]
>> 80 percent of the time, we're stupid every time.
>> Bryce: This is like the 10th time doing the O-G bit
and still no ideas.
[all laugh]
>> What do you mean, "no ideas‽" [Brian laughs]
How dare you! >> Sorry, I forgot about og.