 While this may look like a perfectly ordinary USB drive, it is actually a tool of chaos. Jesus Christ. It's known as the Hack 5 Rubber Ducky. And while it can be used to perform silly pranks or to automate mundane office work, it can also be used for highly illegal cybercrime. This ingenious little device here contains hardware that can be used to grab passwords, open back doors for ransomware, or even delete entire file systems in a matter of seconds. But rather than ignore it, hoping that aspiring ne'er-do-wells will remain ignorant of its existence, we are going to show all of you how it works, demonstrate some of what it can do, and give you the knowledge that you need to protect yourself from USB bandits looking to compromise your precious data. You know what else we're gonna do? Tell you about our sponsor. Build Redux. Build Redux makes it easy to configure your new build with support guides to help along the way. They also offer competitive pricing as compared to building a PC yourself. Head to buildredux.com slash Linus and start your new build today. The Rubber Ducky has existed for over a decade, becoming a favorite tool of both real world hackers and IT professionals alike. And it's been featured on TV shows like Mr. Robot and Sesame Street. Are you sure about that last one? Well, it was definitely Mr. Robot at least. I'm doing a hacking with my Rubber Ducky USB. And what makes the Rubber Ducky so insidious is that compared to media portrayals of hacking devices as full on computer systems that can wreak havoc when connected to your network or gadgety looking keys that override decryption or authentication, it looks perfectly mundane. USB-A on one side, USB-C with a little cap on the other. It's the kind of thing that you might plug into your machine just to find out what it does. But the second you do that, it springs into action executing its payload and it bypasses many malware scanners by disguising itself to your PC or Mac, or even your phone as a human interface device or keyboard. I mean, what virus scanner or firewall would think to check for a nefarious keyboard? Not all, but actually more than you'd think it turns out. Rubber Duckies do get detected by some of the higher end systems that know how to look for them, or rather they did get detected. Earlier this year, Hack 5 released the Rubber Ducky 2.0, which included several features that make detection attempts now flow off it like water off a duck's back. Previously, Rubber Ducky payloads or programs, if you wanna call them that, had to be tailored to their specific target. For example, a payload meant to run on Windows 7 might not work on Windows 11 and certainly wouldn't work on macOS. But this latest iteration can detect the operating system, detect when the device is set up, and can even copy hardware information from an already attached keyboard and spoof it to confuse any would-be security measures. It can't even be detected by its input rate because it's limited by default to the speed of an extremely fast, yet still believable human, meaning it has the same level of system privilege as the logged in user. Terrifying. And while a bit of programming skill is beneficial to make the most of the Rubber Ducky, I suspect the average enthusiast could pick it up pretty quickly. The manual is just 32 pages and fits into the average pant or shirt pocket, kinda like the kind you'd find on our excellent workshop jacket, available at lttstore.com. Ducky code is written in DuckyScript, a proprietary language from hack five, and simple commands are simple to write. Attack mode lets you set the device into HID and or storage mode. String is used to type out letters. Delay is used to make the device wait for a number of milliseconds, perhaps for a program to launch. And most other key presses or combinations are achieved by simply putting the name of the key onto a line. So here's the Konami code written in DuckyScript. Once you're done building your instructions, they can be compiled into a ready to use payload using Payload Studio. It will highlight syntax, mark potential errors, and give you suggestions for auto completion while you're typing. Automating simple keyboard inputs is only so useful though. The command line is what really turns the target system into one big Ducky Puddle playground. There, it can write and run code to turn the volume all the way up, open 20 new Chrome windows with the same YouTube video over and over and over again, or put a little dancing duck on the screen. Truly groundbreaking stuff. To show you a real world use case, we wrote a payload to set up a new PC for benchmarking. It installs Chrome, 7-Zip, and Steam, pauses to allow for login, and then proceeds to install many of the games we typically run with Markbench. And this use case is notable because it's actually the reason that Hack 5 founder Darren Kitchen built the Ducky in the first place. To make repetitive tasks like fixing printers or network shares faster and easier. But enough about its intended purpose, let's talk about how it can be used to get around doors and locks that were meant to stay closed. Huh. Oh. All it takes is one user performing one careless action to compromise a system, and it only takes one compromised system to compromise an entire network. Common practice for troublemakers looking to access a specific network is to invest in a small flock of duckies or similar devices. Those waterfowl get configured with a malicious payload, then they get taken out to sea to go whaling. Whaling is a type of fishing attack that specifically targets a wealthy or a powerful person, a whale. And any city's business district is full of such aquatic mammals, like executives, politicians, or celebrities who have predictable daily routines and might not know very much about computer security. A few armed duckies then dropped into a parking lot or in the stairwell of an office building can be an extremely dangerous thing. Its capabilities are limited only by the creativity of the programmer. And as you know, there is no such thing as a perfect lock. Let's say for example, a bad actor wanted to download data from a target system to a ducky device. Well, many well-protected systems completely block external storage devices, but there's a solution for that. Using a script that reads a target file, then flashes the caps lock and number lock keys, the duck can read those flashes as binary bits and then quack that loop directly onto its internal micro SD card. The Ducky 2.0 isn't all powerful though. Seasoned programmers may find that DuckyScript 3.0 lacks the same quality of life tools of typical languages. Among other common issues, it's difficult to perform string concatenation, for example. And the ecosystem leaves a lot of room for improvement. While lots of completed payloads can be found online and simply copied to your rubber ducky, many of them require modifying the code yourself and lack the documentation that a novice user might need. So if you didn't already understand most of the DuckyScript complaints that we scrolled through, you could find yourself having issues early on. The biggest issue though, is running your code. There's a light to indicate the status of any code that's running. And there's a button that allows you to stop it midstream, but there's not really a great way to test your payloads unless you have an extra machine that you don't mind doing whatever it is you're doing too. And even if you're okay with that, there's no guarantee that other systems will function exactly the same as yours. It could even be something as simple as whatever delay you've programmed for a Chrome window to launch might be longer on a target system. Additionally, if you've already run a payload on a machine once, some of the changes that payload made might persist, making it difficult to track how your code changes are affecting your payloads function. If there was an included way for example, to run it on a virtual machine that could be restored with a single button press, that would be a lot more user friendly. If you do have machines to test on and the patience to learn your way around the small issues of the DuckyScript language, you too though could be doing Mr. Robot level, InfoSec exfiltration, data busting, door crashing and output inputting. But that brings us to an important question. Should you be able to? As I said earlier, a small flock of unattended armed duckies can be a very dangerous thing as it only takes one to expose an entire network. That's what almost happened to the multinational chemical firm DSM back in 2012. Thankfully for them, instead of checking the contents themselves, the person that found the mystery USB stick took it directly to IT. People following protocol is truly the only way to keep a network secure. And even though many people are not aware of how dangerous physical media can be, attacking with it is not a new concept. The brain computer virus from 1986 used floppy disks to travel between machines. And in 2010, Stuxnet famously cloned itself and traveled by any means possible to hit a single offline target in Iran. However, in any given year, society is robbed of far more using crowbars and bolt cutters. And yet they still sell those at every hardware store. So the mere fact that a tool like the rubber ducky can be used by evildoers shouldn't be a cause for banning it. Just make sure that you and your loved ones can recognize it for what it is and always practice safe computer use. Just like I always safely segue to our sponsor. Squarespace, if you're building your brand online in 2022, you need a website. And if you need a tool to help build that brand, look no further than Squarespace. Squarespace is the all-in-one platform to help expand your brand online. Make a beautiful website, engage with your audience and sell anything and everything from products to content. We love Squarespace so much, we use it here at LMG. Its custom templates make it easy to stand out with a beautiful website that fits your needs. You can maximize your visibility thanks to a suite of integrated SEO features and their analytic insights help you optimize for performance so you can see what's going well and what needs a little work. So get started today and head to squarespace.com forward slash LTT to get 10% off your first purchase. If you guys enjoyed this video, you might also enjoy our video on the password reset key too. Socks and sandals really go well with a ninja mask it turns out.