My first security project was making a flash drive hack a Windows laptop. In fall 2020, I joined a RITSEC mentorship group that used Hak5 USB Rubber Duckies: devices that look like flash drives but tell the computer they’re keyboards, then type pre-written commands at over 1,000 words per minute. Our group used them to open reverse shells, copy files off machines, install malware, change desktop backgrounds, and blast loud music. Watch our presentation below, or skip to how they work and how to defend against them.
TLDR
- What it is: a keystroke injection tool disguised as a USB drive. Computers trust it like a keyboard. (How it works)
- What we did: reverse shells, file theft, malware installs, and pranks on Windows machines, in under a minute each.
- Why it works: antivirus rarely flags a “keyboard,” and the ducky types faster than a person can react.
- How to defend: lock your screen, block unknown USB devices, and watch for keystroke bursts. (Defenses)
Learn how RIT students used Rubber Duckies to exploit Windows machines
Why attackers use them
Hackers often have to type things on a keyboard when attacking a system. Typing can get tiring, and it is easy to make typos. Sometimes typos can cause inaccurate results or leak the presence of the attacker. Thus, typing accuracy is often critical to the success of an attack.
Consequently, hackers created a device that would type everything for them, called the USB rubber ducky. It looks like a typical USB. However, these devices can be extremely dangerous.
When an attacker inserts the USB into a computer, antivirus software usually doesn’t detect it, so the defenses below focus on access and USB policy instead. The rubber ducky also executes the commands incredibly fast, so the attacker can complete their work in a few minutes.
While the rubber ducky resides in the computer, it can steal and transfer files, and change settings and permissions. In other words, the attacker can change settings to block antivirus software and obtain emails, passwords, and documents.
🌸👋🏻 Enjoying this post? Get the next issue of [ret]2read. Once a month, I’ll email you whatever’s on my mind, usually Apple security research, offensive security, open source software freedom, and operating system internals.
What a rubber ducky can do
USB rubber duckies are devices that automate commands otherwise typed by a keyboard, which avoids typos and saves time. Duckies usually come as USB sticks, but the same payload language (DuckyScript) runs on other Hak5 devices too. Although the rubber ducky can do many things, some of the most common functionalities include changing settings and permissions, stealing and transferring information, and executing whatever code the attacker wants on a computer.
Want your company or product in front of [ret]2read readers?
One sponsor per issue →
How to defend against rubber duckies
- Lock your computer whenever you walk away. A ducky needs an unlocked session to do most of its damage.
- Don’t plug in USB drives you found or were handed.
- Use device control. Windows Group Policy (Device Installation Restrictions) or an EDR tool can block new USB keyboards that aren’t on an allow list.
- Watch for inhuman typing speed. Some endpoint tools flag it; hundreds of keystrokes per second is a strong sign of injection.
- Physical security still matters: locked offices and disabled USB ports on kiosks.
Project origin
The Rubber Ducky project was started by Shannon McHale (’20) and Jon Bauer (’20) as a RITSEC Mentorship Group.
RITSEC is a student club dedicated to teaching “Security Through Community.” RITSEC educates and prepares RIT students to compete in offensive and defensive security competitions. It is the largest academic club at RIT and the second largest club on campus.
Further reading
If you enjoyed this post about USB rubber duckies, check out my other projects.
