- While this may look
like a perfectly ordinary USB drive,
it is actually a tool of chaos. (clicking)
(dramatic music)
(yelling)
- Jesus Christ!
(both yell)
(zombie yells)
(headphone clamor)
(laughing)
- It's known as the Hak5 Rubber Ducky.
And while it can be used to perform silly pranks
or to automate mundane office work,
it can also be used for highly illegal cyber crime.
This ingenious little device here
contains hardware that can be used
to grab password, open back doors for ransomware,
or even delete entire file systems in a matter of seconds.
But rather than ignore it,
hoping that aspire ne'er-do-wells will remain ignorant
of its existence, we are going to show all of you
how it works, demonstrate some of what it can do,
and give you the knowledge that you need
to protect yourself from USB bandits
looking to compromise your precious data.
You know what else we're gonna do?
Tell you about our sponsor.
- Build Redux.
Build Redux makes it easy to configure your new build
with support guides to help along the way.
They also offer competitive pricing
as compared to building a PC yourself.
Head to buildredux.com/linus
and start your new build today.
(futuristic music)
(clinking)
(futuristic music)
(upbeat techno music)
- The rubber ducky has existed for over a decade,
becoming a favorite tool of both real-world hackers
and IT professionals alike.
And it's been featured on TV shows
like "Mr. Robot" and "Sesame Street."
Are you sure about that last one?
- [Camera Operator] Well it was definitely "Mr. Robot"
at least.
- [Robot] I'm doing a hacking with my rubber ducky USB.
- And what makes the rubber ducky so insidious
is that compared to media portrayals of hacking devices
as full-on computer systems that can wreak havoc
when connected to your network
or gadget-y looking keys that override decryption
or authentication, it looks perfectly mundane.
USB-A on one side, USB-C with a little cap on the other.
It's the kind of thing that you might plug
into your machine just to find out what it does.
But the second you do that,
it springs into action, executing its payload
and it bypasses many malware scanners
by disguising itself to your PC, or Mac,
or even your phone as a human interface device
or a keyboard.
I mean, what virus scanner or firewall
would think to check for a nefarious keyboard?
Not all but actually, more than you'd think, it turns out.
Rubber duckies do get detected
by some of the higher-end systems
that know how to look for them.
Or rather, they did get detected.
Earlier this year, Hak5 released the Rubber Ducky 2.0,
which included several features
that make detection attempts now flow off it
like water off a duck's back.
Previously, rubber ducky payloads, or programs,
if you wanna call them that,
had to be tailored to their specific target.
For example, a payload meant to run on Windows 7
might not work on Windows 11
and certainly wouldn't work on macOS.
But this latest iteration can detect the operating system,
detect when the device is set up,
and can even copy hardware information
from an already-attached keyboard and spoof it
to confuse any would-be security measures.
It can't even be detected by its input rate
because it's limited by default
to the speed of an extremely fast,
yet still believable, human,
meaning it has the same level of system privilege
as the logged-in user.
Terrifying.
And while a bit of programming skill
is beneficial to make the most of the rubber ducky,
I suspect the average enthusiast
could pick it up pretty quickly.
The manual is just 32 pages
and fits into the average pant or shirt pocket,
kind of like the kind you'd find
on our excellent workshop jacket,
available at lttstore.com.
Ducky code is written in Ducky script,
a proprietary language from Hak5,
and simple commands are simple to write.
Attack mode lets you set the device
into HID and/or storage mode.
String is used to type out letters.
Delay is used to make the device wait
for a number of milliseconds,
perhaps for a program to launch,
and most other key presses or combinations are achieved
by simply putting the name of the key onto a line.
So here's the Konami Code written in Ducky script.
Once you're done building your instructions,
they can be compiled into a ready-to-use payload
using Payload Studio.
It will highlight syntax, mark potential errors,
and give you suggestions for auto completion
while you're typing.
Automating simple keyboard inputs
is only so useful, though.
The command line is what really turns the target system
into one big ducky puddle playground.
There, it can write and run code
to turn the volume all the way up,
open 20 new Chrome windows with the same YouTube video
over, and over, and over again,
or put a little dancing duck on the screen.
Truly groundbreaking stuff.
To show you a real-world use case,
we wrote a payload to set up a new PC for benchmarking.
It installs Chrome, 7-Zip, and Steam,
pauses to allow for log in,
and then proceeds to install many of the games
we typically run with mark bench.
And this use case is notable
because it's actually the reason that Hak5 founder,
Derren Kitchen, built the ducky in the first place,
to make repetitive tasks
like fixing printers or network shares
faster and easier.
But enough about its intended purpose.
Let's talk about how it can be used
to get around doors and locks that were meant
to stay closed.
(mischievous music)
- Huh.
(mischievous music)
(buzzing)
(crying)
(computer buzzing)
(loud bang)
- All it takes is one user performing one, careless action
to compromise the system
and it only takes one compromised system
to compromise an entire network.
Common practice for troublemakers
looking to access a specific network
is to invest in a small flock of duckies
or similar devices.
Those water fowl get configured within malicious payload.
Then, they get taken out to sea to go whaling.
Whaling is a type of phishing attack
that specifically targets a wealthy
or a powerful person, a whale.
And any city's business district
is full of such aquatic mammals,
like executives, politicians, or celebrities,
who have predictable daily routines
and might not know very much about computer security.
A few armed duckies, then, dropped into a parking lot
or in the stairwell of an office building
can be an extremely dangerous thing.
Its capabilities are limited only by the creativity
of the programmer.
And as you know, there is no such thing
as a perfect lock.
Let's say, for example, a bad actor
wanted to download data from a target system
to a ducky device.
Well, many well-protected systems
completely block external storage devices
but there's a solution for that.
Using a script that reads a target file,
then flashes the caps lock and number lock keys,
the duck can read those flashes as binary bits
and then quack that loop directly
onto its internal micro SD card.
The Ducky 2.0 isn't all-powerful though.
Seasoned programmers may find
that Ducky script 3.0 lacks the same quality of life tools
of typical languages.
Among other common issues,
it's difficult to perform string concatenation, for example.
And the ecosystem leaves a lot of room for improvement.
While lots of completed payloads
can be found online and simply copied
to your rubber ducky, many of them require
modifying the code yourself and lack the documentation
that a novice user might need.
So if you didn't already understand
most of the ducky complaints that we scrolled through,
you could find yourself having issues early on.
The biggest issue, though, is running your code.
There is a light to indicate the status of any code
that's running.
And there's a button that allows you
to stop it midstream.
But there's not really a great way
to test your payloads unless you have an extra machine
that you don't mind doing whatever it is you're doing to.
And even if you're okay with that,
there's no guarantee that other systems
will function exactly the same as yours.
It could even be something as simple
as whatever delay you've programmed
for a Chrome window to launch
might be longer on a target system.
Additionally, if you've already run a payload
on a machine once, some of the changes that payload made
might persist, making it difficult to track
how your code changes
are affecting your payload's function.
If there was an included way, for example,
to run it on a virtual machine
that could be restored with a single button press,
that would be a lot more user-friendly.
If you do have machines to test on
and the patience to learn your way around the small issues
of the Ducky script language,
you, too, though, could be doing Mr. Robot-level
infosec exfiltration, data busting,
door crashing, and output inputting.
But that brings us to an important question.
Should you be able to?
As I said earlier,
a small flock of unattended, armed duckies
can be a very dangerous thing,
as it only takes one to expose an entire network.
That's what almost happened
to the multinational chemical firm, DSM, back in 2012.
Thankfully for them,
instead of checking the contents themselves,
the person that found the mystery USB stick
took it directly to IT.
People following protocol is truly the only way
to keep a network secure.
And even though many people are not aware
of how dangerous physical media can be,
attacking with it is not a new concept.
The Brain computer virus from 1986 used floppy disks
to travel between machines.
And in 2010, Stuxnet famously cloned itself
and traveled by any means possible
to hit a single, offline target in Iran.
However, in any given year,
society is robbed of far more
using crowbars and bolt cutters.
And yet, they still sell those in every hardware store.
So the mere fact that a tool
like the rubber ducky can be used by evil doers,
shouldn't be a cause for panicking.
Just make sure that you and your loved ones
can recognize it for what it is
and always practice safe computer use,
just like I always safely segue to our sponsor.
- Squarespace, if you're building your brand online in 2022,
you need a website.
And if you need a tool to help build that brand,
look no further than Squarespace.
Squarespace is the all-in-one platform
to help expand your brand online.
Make a beautiful website, engage with your audience,
and sell anything and everything
from products to content.
We love Squarespace so much, we use it, here at LMG.
Its custom templates make it easy to stand out
with a beautiful website that fits your needs.
You can maximize your visibility
thanks to a suite of integrate SEO features,
and their analytic insights help you
optimize for performance so you can see what's going well
and what needs a little work.
So get started today and head to squarespace.com/LTT
to get 10% off your first purchase.
- If you guys enjoyed this video,
you might also enjoy our video
on the password reset HEAT, too.
Socks and sandals really go well
with a ninja mask, it turns out.