Do NOT Plug This USB In! - Hak5 Rubber Ducky
ฝัง
- เผยแพร่เมื่อ 18 เม.ย. 2024
- Visit www.squarespace.com/LTT and use offer code LTT for 10% off
Create your build at www.buildredux.com/linus
The Hak5 Rubber Ducky is a dangerous hacking tool that disguises itself as an unassuming USB flash drive. It delivers payloads by injecting keystrokes while appearing to its host system as a regular old keyboard.
Discuss on the forum: linustechtips.com/topic/14675...
Buy the Hak5 Rubber Ducky here: shop.hak5.org/products/usb-ru...
Purchases made through some store links may provide some compensation to Linus Media Group.
► GET MERCH: lttstore.com
► SUPPORT US ON FLOATPLANE: www.floatplane.com/ltt
► AFFILIATES, SPONSORS & REFERRALS: lmg.gg/sponsors
► PODCAST GEAR: lmg.gg/podcastgear
Big thanks to I-Am-Jakoby for their code contributions that made this video possible. Check out their github: github.com/I-Am-Jakoby
FOLLOW US
---------------------------------------------------
Twitter: / linustech
Facebook: / linustech
Instagram: / linustech
TikTok: / linustech
Twitch: / linustech
MUSIC CREDIT
---------------------------------------------------
Intro: Laszlo - Supernova
Video Link: • [Electro] - Laszlo - S...
iTunes Download Link: itunes.apple.com/us/album/sup...
Artist Link: / laszlomusic
Outro: Approaching Nirvana - Sugar High
Video Link: • Sugar High - Approachi...
Listen on Spotify: spoti.fi/UxWkUw
Artist Link: / approachingnirvana
Intro animation by MBarek Abdelwassaa / mbarek_abdel
Monitor And Keyboard by vadimmihalkevich / CC BY 4.0 geni.us/PgGWp
Mechanical RGB Keyboard by BigBrotherECE / CC BY 4.0 geni.us/mj6pHk4
Mouse Gamer free Model By Oscar Creativo / CC BY 4.0 geni.us/Ps3XfE
CHAPTERS
---------------------------------------------------
0:00 Intro
1:28 What's a Ducky?
2:50 Rubber Ducky 2.0
3:50 Programming the Ducky
4:50 Command Line
5:41 Nefarious Uses
7:04 Data Extraction
7:35 Drawbacks
9:07 Should it be legal?
10:43 Conclusion - วิทยาศาสตร์และเทคโนโลยี
7:25 It's because the system can set (from inside) the CAPS lock and NUM lock state of keyboards. The keyboard is aware of change. So if the Ducky can be a keyboard, it also can be aware of such changes. If the script uses these state changes to transmit a message, the keyboard (here the Ducky) can read them and store the data into a file. It's genius.
Yeah that part blew my mind. Also 7:27 wysi
yea that’s really smart
@@Clumrat wysi
@@sven957Sven subvert filesystem locks. Many enterprise systems don't allow for external storage to be connected, but keyboards are fair game. The script will just buffer the state changes to memory which in essence does the same thing.
@@sven957 Systems can detect when a script/executable is launched and blocks it.
Using the keyboard to type a script though, different story.
Hak5: it was made to automate mundane office tasks
Also Hak5: "Attack mode"
Indeed, the Hypocrisy is strong with this one.
thanks
Yeah, among other things, if they wanted it to not be used for malicious purposes, they wouldn't have made it look so mundane. Clear irresponsibility on the part of the creators.
He ptorek
He attak
but more importantly,
he automate mundane office task
@@Theunicorn2012 dafuq
For testing: use vm snapshots to return to a previous state. To get the rubber ducky to work in a vm, pass trough a usb hub or pci card directly to the vm. (not the ducky device itself, that's going to cause issues)
I once heard you still have risks even when using VM for testing bc it could infect your network between it and your "main pc environment"
6:00 4 months later and this has suddenly become a real story XD
Finally a video on these, they've been a thing for ages!
Never plug in a random flash drive you've found or been given a lot of the times.
It's pretty much the equivalent of going rawdog at a lights-out group grope. (orgy)
I have a computer that only has an Ethernet port for network connectivity, no wi-fi or bluetooth interfaces that I use for this purpose. It has no data on it except for the OS, and the Ethernet port remains unplugged always
@@Turboy65 Lol where do you find these things
@@TheLongDon Make lots of kinky friends, wait for the flash mob....LOL....
@@Akkbar21 Not really; having an experimental sandbox computer can be really useful, if not for avoiding physical hacking attempts from USB devices then installing suspicious applications to test them first before installing them on your main machine.
These things have been available for over a decade, I’m surprised Linus has only just made a video on this cool device.
I was just gonna type the exact same thing :D
He says it's been a thing for a decade but a new version was released this year.
I mean he got them for the lab, might as well make a video while at it.
He’s been making videos on these types of malicious USB drives for the better part of a decade.
@@f3rny_66 Also maybe they believed they could make a better video now, with a more experienced team of writers and editors, and just used the excuse that they got a bunch of them for the lab to also make a video on them.
As an IT guy you could test your clients IT Security Awareness with these and load a script onto them, that automatically books the person into the next Security Seminar, so they can learn what to do the next time they find a random USB Stick
What about the OMG cable?
How you gonna teach people to avoid a normal ass lookin cable?
My previous employer did the phishing email version of this. You click the link, you get (polite, short) training. I always thought they were super obvious. There were only ever two emails in four years that made me wonder.
Doing the same with USBs would be cool.
I like your idea
Great in theory, dont do it though... You are opening yourself up to getting sued into oblivion and sent to prison. Just because you use it non-maliciously, doesnt mean you can prove it. You try telling a company 'it was just to make you aware of security risks', when you could just as easily have loaded in a backdoor and used it as a cover story...
@@ianvisser7899 Lol! No. Companies pen test themselves and run "simulated phishing" campaigns against their own employees all the time. Any company serious about cybersecurity should be doing stuff like this. I wouldn't do it unilaterally unless you are the head of IT or cybersecurity and have already built credibility, but you really want to tell as few employees as possible these types of exercises are going on until they are over.
6:11 4 months later that has never been more ironic, LMAO
For additional info, Rubber Duckies are INSANELY easy to access and learn.
I built my own out of an Arduino - it’s pretty much identical in functionality to a Rubber Ducky 1.0 and it cost me maybe 6 Canadian Dollars. Granted, I use it to automate basic batch scripts to quickly troubleshoot Windows PCs for myself and some friends but anyone willing enough could definitely do some damage with it if they were so inclined.
How did you use your arduino
raspberry pi pico works as well
Github link of your code or it didn't happen
@@meme-hj5rs Do you realize how simple these devices are? The code would be maybe 100 lines long for a basic version. A more complicated one would maybe reach 500 or so. Anyway, these are really really simple devices.
This makes a bit more sense to me. I wouldn't pay $100 just to Rick Roll a friend. But there is no Arduino with USB A so how did you do it?
I did a project on this in college in 2014 and nearly got a failing grade because my prof said it was unrealistic. I've seem so many things that work like rubber duckies since and it's just grinds my gears every time! These things are neat but dang can they do some harm.
In a white hat sense, I've been doing this since about 2000(ish). Kinda made ninite, but before ninite was a thing (i think). I just wasn't playing as a HID device because I had everything I did scripted at the time. That prof, I really hope he now gets "defcon" famous.
Should've left a ducky stick next to the professor's car door or office door with a payload that just launched notepad and typed "I told you so"
could you apply for a revision then... obviously a revision of HS grade could happen... after you already finished uni...
"my prof said it was unrealistic"...are the words highly SUS tech people use to deflect from what they "actually" do...hidden in plain sight...faking ignorance to avoid getting known for actual know-how (:D)
Security analyst here, I've only seen one on a network once, they're pretty interesting! I hope you guys cover more cybersecurity topics
I love the people in this comment section who are talking about how much of a threat these are or similar comments, these are a pretty risky attack from a risk reward perspective because you need to make damn sure that your fingerprints are not on the device, so your average person shouldn't be too concerned about these. Just know they exist and leave it at that
Wow this is scary. I am sure someone could modify a keyboard using a hub and a build in rubber ducky to make it look even less harmfull. If someone receives a USB keyboard by mail, if it looks better than their current keyboard, I am sure many wouldn't hesitate to plug it in their computer to try it.
That is a shockingly terrifying and also very clever idea tbh
There's a ducky hidden inside a charging cable that has a wifi connection to control remotely. You can't tell a difference between it and a normal charging cable
Or ANY usb device for that matter. Webcam, mouse, printer, once the USB gets plugged in, it's game over.
Theres already something called duckhunt which detects ultra speed typing.
@@suzierottencrotch7893 you just slow the typing speed down to a human level and while slower is still automated
I remember learning about these many years ago in some certification classes I took when I was 14 & 16. A lot of server places will actually have their USB ports flat out disabled to prevent physical malware attacks and cables locked away behind metal from where they can be physically tampered with the prevent wire tapping even if they are already in locked facilities.
That's actually another good reason to have these onboard USB ports on server boards. Besides having physical access you'd have to take apart the server in order to install the USB device.
Or just keep people out of the server room with proper physical security controls. As a server admin, I need USB sometimes
@@roberttalada5196 Yep, if an adversary has physical access to a server, it's basically game over anyway.
Saw a server in our university lab that had its front facing USB ports epoxied closed.
In a space where students both need to have access to servers to learn and eventually will try stuff like this, I guess it made some sense.
I knew a guy who worked at a place who super glued all their USB ports and installed tamper alarms (Visual and audio) to their terminals. It was a medical office who got hit with some type of ransomware after a disgruntled patient didn't get their refill.
I still use my original rubber ducky to automate all kinds of things and to demo why you don't plug in random flash drives.
Such an amazing piece of kit and the rubber ducky 2.0 is even more amazing!
So it isn't just me... Never figured out why nobody else put them to good and practical use.
@@JonLinde I know right!?
It has been an absolute life saver for multi hour system setups etc
@@BrodieFairhall can you elaborate on your usage? like what kind of things are you automating with this
@@treeskers one good example from years ago was setting up some HMI PC's for a scada system. They were all the same except for some customer names etc.
It involved imaging the OS, mapping a network drive to a file server, then installing various software that required the customer name or specific files to be linked on setup (which is why we couldn't just image everything). Then all the manual files were copied over, registry edits made etc.
We would just change the customer name and a couple of details in the ducky script, put the DVD with the OS image in the machine, plug in the rubber ducky and turn it on.
I don't get why you can't do all that with a regular usb drive and just run some executable file manually that does all you want it to do?
We need to properly thank I-Am-Jakoby for their various contributions to the Rubber Ducky community! Their work made a lot of this possible. Check out their github for some really useful Rubber Ducky resources: github.com/I-Am-Jakoby
Disappointed that Linus did not drop the Rubber Ducky
Thank you sooo much!
It was an honor alone just to be in a video!
@@IamJakoby Epic, you're the legit channel too and not a fake advertiser
@@PlanetXtreme I appreciate you! I've put a lot of effort into trying to make something legitimate to offer 😀
Don't mind me riding Jakoby's coat tails here 😉 Funny to see my 32 wants the D payload refrenced. People can feel free to check out my repo as well.
Colton crying after opening the company to a cyber threat is very foreshadowing xD
I always laughed at people for "acting like just plugging in a single USB stick could cause THAT much harm". I guess, I was the fool.
Guess you also haven't seen those USB killers everyone was talking about like ~5 years ago, it's possible to destroy an entire computer by simply plugging in a USB stick.
Have you seen the USB Killer too?
@@FlameMage2 I had seen that (USB Killer), but also only recently
it doesn’t have to be a use lol you could make your own homemade one that can fit into any type of plug output
You can even take over ATMs...so I've heard
Hak5 brings back so many memories. I'm glad the LTT labs people found a use for their duckies, but I'm not sure I learned all that much.
ahh yes, those fond memories of when Matt Lestock and Paul The Camera Guy were on the team. i stopped watching when Matt left.
This video isn't really for anyone who already knows about Hak5 though. It's for everyone else that doesn't.
I remember watching Hak5 when these things came out. I don't recall Darren saying that it was initially conceived as a way to automate routine maintenance tasks, though. The pineapple had already been out for several years by the time the ducky was released. Ducky was an offline counterpart to pair with your pineapple. There's also a LAN turtle.
Glad that your highlighting security tools, tricks, and remediation. Keep doing videos like this. As a security professional I think tech TH-camrs can play an important role in educating users
I would love for LTT to do more videos on Cyber Security
After seeing what their "server room" looks like, I'm not sure that I would trust them
I wouldn't unless they have someone who actual has some Cybersecurity accreditation or experience.
@@e.l.6562 I wouldn't use personal practice as a gauge for someone's aptitude. Just think of how many peak athletes are coached by people who would never have even dared to strive to compete on the level of the people they train. As long as someone knows what they're talking about that's enough to be taken seriously. Given that I'm effectively clueless in this field, I'd rely on comments from people in the cyber security field and other sources to determine the value of any information put forth anyway.
With LMG's core audience, you've got to be mindful that little of what they do will actually be comprehensive or even entirely accurate. Even so, they are in a prime position to spark someone's interest something they'd never considered thinking of before. In that regard, I think even partially inaccurate advice is better than nothing. It would at least give newbies a starting point to research even if it's nothing more than a few key words or phrases they're unfamiliar with.
@CGG_GSS Then why are they doing a video about cybersecurity?
But he should stay away from talking about the programming. A lot of what he said was not correct or the fault of the device.
Just now do I realize that I actually want one of these, being able to plug in a drive and have it automate a couple commands looks useful as hell
I saw this an my first thought was automating installing emulator games via USB
This sounds like a dream come true for every of Linus's viewers who have grandparents.
they dont even know that they have usb poerts or what usb is
@@ducksongfansthat moment when being illiterate is the best defense 😂
Before USB there were versions of this for PS/2. They were largely used for some of the same legitimate tasks, usually some form of automation, or, in some cases they could act as a converter between RS-232 and PS/2 for some serial devices. The tricky part of these USB HID "attacks" is that unlike the old route of a malicious autorun, you can't avoid it by holding shift, and of course once it's plugged in, it gets activated and can start "typing". Some AV software has started adding "keyboard authorization" features to try to combat these types of devices. One interesting approach of dealing with a suspicious "drive" is to plug it in while in a VM (with shortcuts to 'escape' the VM disabled) . Even though it will connect to the host machine, if it is device like this, then keystrokes it tries to send will go to the VM. Heck a MS-DOS VM running a tiny DOS program that just logs key scancodes to a text file could even provide insight on what exactly it is trying to do.
Can it access the host machine even if the operating system was different from the virtual machine
@@petelee2477 it's an automatically typing keyboard - it requires exactly right context (usually empty desktop) to start working properly
@@petelee2477 Don't rule it out. Malware can escape virtual machines. With this tool in particular, unlikely.
This better be the start of a Hak5xLTT collaboration! Fly Darren and Shannon up to The Lab and let's get a few videos out of this!!
Yes! I'd love to see that
@@GB570 Hell nah, the way the Rubber Ducky for example works is people simply not being aware of it. Any kind of attention kills it, so a TH-camr with about 15 million subscribers making a video specifically about it is horrible. Not for Hak5, but for the users. The OMG Cable would be another example, also from Hak5.
@@anon_acc You're missing the point of Hak5. They want more people aware of security vulnerabilities so that they know what to look for to protect themselves.
@@anon_acc I don't think that Hak5 would agree. They want people to be aware of the threats posed by their tools.
A collab would be a great idea!
Would absolutely LOVE an LTT deep dive on Hak5 tools
I've been watching Hak5 since 2006, LTT since about 2015..... I was SUPER excited to see this video pop up. I really really hope there's more!
Commenting for the algorithm to show this is a great video!
10:35 Thanks Linus. Now I know what a rubber ducky looks like. I can safely plug in that USB I found this morning on the sidewalk - it doesn't have that folding silver shield on it, so can't be a rubber ducky.
That's what I thought it was first too. I think Linus didn't think that part of the otherwise good presentation through. I also would have liked to see some practical advice on how to avoid being hurt by this in real life (other than the obvious "don't attach a USB drive that you find on a street to your computer). Anyway, I think this was a very interesting and generally very well made presentation.
I was wondering if LTT would do more security-related videos like the Rubber Ducky. I was pretty excited for this.
At a University near where I live they scattered 50 of these around with a simple script to ping a specific IP so that they could record how many People plugged it in. They recorded 80 different IP Adresses.
So in other words, it'd be stupid easily to hack people if you had malicious intent? And people let their curiosity get the best of them rather than their common sense?
@@QuackZack at random yeah, good luck nailing a specific target tho.
@@freedustin With a little social engineering, no problem. Send a "free" flash drive in the mail as a fake promotional. Give it to them in a swag bag. Become their friend and tell them the photos from the other night are on there. Convince them to print or scan a specific type of item at their local print shop that requires a flash drive and make sure, when they go looking for one (because who has those laying around anymore besides tech people thanks to the cloud), the malicious one is the first one they find. There are a million ways you could social engineer a specific target into plugging a USB into one of their computers. That's just what I came up with in one minute...get creative.
Been watching since the earliest of the NCIX days. Great video to let people know about the dangers of things like this. Can't describe how happy I am to see the LTT intro and song making their way back into all the videos. don't know why, just am!
Ah yes, the old USB port as an attack vector. Funny you should mention DSM, because one of their SysOps gave a talk at a local small time Defcon type of convention and he mentioned the use of hot melt glue to stop USB port based attacks.
Still I always figured that given what we did as kids in high school during the 90s these kinds of attacks would be obvious by now.
All of the computers in HS ran NT4, so their drives were NTFS. Except for the computers in the computer lab, because due to curriculum requirements those were W95 machines. Now IT had considered that diskettes would be an attack vector, so they passworded the BIOS and made the A and B drives non-bootable.
Except they messed up. All the BIOSes had the same password. Windows 95 is basically a glorified DOS shell, so any user would have low-level access to the hardware. So use W95 to make a dump of the BIOS, take it home, grep the password from the dump.
Prep a muLinux diskette with the NTFS read kernel driver, use BIOS password on NT4 box to enable booting from diskette. Boot up muLinux, grab the SAM files, take em home and run L0pht at your leisure.
It left no trace on the school computers and meanwhile we had Domain Admin level access.
man you old
Those are old news, but its good that someone from the mainstream is actually covering this attack venue, and yet another lesson on why not to plug random USB accessories willy nilly
I guess so, even their wifi and ethernet taps are old stuff too
@@username8644 i get the sentiment, but bro i just ahd a stroke
0:27 "It can also be used for highly illegal cyber crime."
*Displays Windows Update*
The worst crime
That recreation of the Mr.Robot's scene with the usb thumb drive taken and plugged in by the cop was funny AF with Colton being the victim 😂
The main infosec advice I give to people is simple "Unless you know what it is, don't put it in". Works decently for other bad decisions you make sometimes too.
Love seeing this, I would love more security integration from LTT in videos ❤
Very excited and happy to see Linus mentioning Darren Kitchen, two of my first and most favourite youtubers.
There are a ton of other hardware based hacking devices from Hak5, we would really like to see those to be featured in LTT as well.
Always interesting seeing a non-infosec perspective on the different devices/equipment we use. Just assuming based off of your feedback for the ducky, you might be better off using a combination of... Vagrant/Packer for machine image creation, Ansible for software deployment and configuration within the image or device, and Terraform for physical device provisioning. It would all be done over an ethernet connection too instead of the hassle w/ managing multiple duckies and scripts.
LTT needs to do a video on installing windows and user V admin accounts and how to set them up to be secure, topics like login options for users and how they matter.
I remember in the late 80s/early 90s we had to write software on public computers and the only way to save our code was with floppies. We were constantly running into issues where our own floppies that we bought and formatted on our machines, got infected.
Yep, I remember that. First the 5.25 inches, then the 3.5 ones. And those utilities allowing to use extra capacity (2mb total, I think) beyond 1.45 mb. Or the ones which could be used to fake a ram disk to allow certain installations. I remember always knowing even which floppy disks I had as infected. You could recover from that, but was not easy.
My university end of bachelor program was making a program to detect unknown peripherals and checking if they were trying to do a payload. We used a rubber ducky for showcase. :D
Brings back the memories.
The Writer, Tanner McCoolman, was excellent for this video. As someone that was trained in CySec and learned how to use a USB Rubber Ducky, it was very well explained on how this attack vector works!
as a cyber security professional i would love to see LMG pick up more cyber content. LinusSecTips????
LTT x John Hammond collab is what i wanna see
That name will 100% get abused.
@@theBabyDead that's the point
@@theBabyDead perfect
Just go watch Hak5 or Seytonic. Those guys already do a great job at it.
I'm surprised he hasn't reviewed one of these sooner. I've used these for years, amazing tools, but also pretty deadly if you wanted to use it as such
Using this as a means to automate bench setup is pretty ingenious.
Been subbed to the Hack5 channel for a while and totally love what they did there! It's a research tool in one hand, or a weapon in another. Great video!
Thanks, it's always good to be reminded that what I don't know about security is huge compared to what little I know. Great video, thanks again.
I always wondered if they were going to ever release a newer version of the Duckie, I've had mine for years and it is a super useful tool, especially if you work in I.T. and have to do mundane task, I use mine to install software we use at work after a reimage
I moved away from theirs to Michal monday on github he has a supreme ducky albeit a bit out of date now but found it loads better than hak5s not looked into their 2nd version.
Couldn't you just use Winget now?
Pro tip for ya, ninite has most normal software you'd need, grabs the latest versions too and does background installs, which saves you the effort of having to decline installing McAfee...
You really emphasized "Being safe" at the end there🤣
😂
I was NOT ready for that
VM's could totally be an option. I don't know about Windows, but on Linux using qemu you can pass an entire USB controller to a VM, so if you plug the ducky into a specific port it controls the VM
I bought one of these to automate iPad and Mac deployments when we aren’t using DEP. Saves SO MUCH TIME, it just needs to be updated occasionally
These are VERY useful tools, different versions too!
Can you build a 5 minute version of this? I would love to share this with my non-technical staff, just so they can know the danger. Heck, that would be a fantastic new channel--security issues for non security people.
That would be amazing. I want to send this to my family too.
Im into that
Isn't that just Techquickie? Dumbed down tech info, for the average Joe.
@@madness1931 I’m thinking more like Security in Brief. Most security information geared to the regular user is full of stock photography and over explained by experts. The section on USB sticks and how they pose a security threat was the simplest I’ve seen. That could be done for phishing, passwords, etc. Maybe sans the condom, as that wouldn’t fly in my environment. But the security content was perfect for my users.
@@slhuck and hosted by jake or anthony.
I worked for DSM at a local industrial site before our buy out and when I tell you that our classes RAMPED up and they locked our machines. We weren’t allowed to use anything in the machines unless it was provided by our it team.
Although these have been available for a while now, the new ones are especially powerful. Thanks for spreading the knowledge!
If you do forensic on a machine that one of these plugs into, it is very obvious these ran. Unless they changed something but it mostly leaves a lot of traces it was ran.
Automatic log deletion at the end is pretty easy. All you'll see is everything was deleted.
@@inferno2243It won't exactly cover all cases especially depending on the logged in user's group and other 3rd party corporate software.
@@inferno2243 setupapi.dev.log
Great video! Thanks for educating about this kind of attack 😃
Been working on a couple of Open-Source BadUSB projects myself recently.
9:02 - Most hypervisors offer some sort of 'snapshot' feature that will allow you to preserve the state of the virtual machine at that moment in time, including the contents of RAM. That's sort of out of the scope of what this device does, but it's quick and easy to do. You could also use the templating feature, although you might run into issues with unique IDs generated by some systems. Windows has sysprep for this, and linux generally doesn't care, but some of your applications might, especially expensive per-seat enterprise applications.
Fun facts:
The clip in the beginning ( 0:09 - 0:18 ) was a TV-Ad that was actually shown in the early 2000s in germany. The conclusion „So wach warst du noch nie“ at the end means something like „You have never been more awake than now“ and advertised a coffee drink with high caffeine content.
There were many complaints due to horrified children and dropouts of pacemakers because of this ads.
So cool to see Linus tackling some cybersecurity now. Everyone could use some extra awareness.
I saw this first hand while traveling about a decade ago. Working late, I was getting into one of the last cars in the lot when I looked down to see a loose USB drive on the ground. I followed protocol from where I work and turned it in to their security. Apparently they’d been doing internal phishing tests to see who would plug these in.
Companies should give employees a monetary reward for following the protocol, much more than the cost of a new flash drive. Nobody would ever plug them in.
@@KJ4EZJ That has the problem of some people intentionally working together to buy flash drives and share the payout for turning them in, unfortunately
@@rytan4516 Then you fire them for fraud.
It would become obvious pretty quick when your security team watches the cameras to see who is leaving flash drives in your parking lot to attack your employees and you only see the employee walking into the building from their car.
Even if people siphoned a couple hundred bucks a month out of a company, that is much cheaper than responding to a single security incident.
You may also want to make PSA video about the “O.MG Cable” from Hak5 as well. Basically a USB Rubber Ducky + antenna for local wireless offloading of data in a package that looks like your run of the mill USB cable
I made one of these with a cheap raspberry pi Pico and it works amazingly, and it is extremely easy to use, they are really help full when trying to code or set up something on multiple computers because it automates it.
Coltons Reaction was F***ing priceless even if it was staged XD 🤣
Fun story (can’t verify it though)- back in the days of 2600 (an old hacker mag) I remember an article where someone took a bunch of USB drives with CIA and FBI logos on them and dropped them in random locations around Washington, DC
They had one function - ping “home” to indicate they had been plugged in.
The success rate was… disturbing.
Yeah I wonder how many people you could get just by dropping them in the subway and bus stations. Normys do not know good cybersecurity.
Quick add: there was a time when finding a USB key was awesome - they were expensive and sought-after. These days, I wonder if people will even pick them up?
Maybe print 2TB on them with the cool logo?
@@Dan-Simms yup - especially if you “honey pot” them with a logo or printing:
bitcoin usb
police files
UFO proof videos
The possibilities are endless…
Really cool tool actually. Colleagues I have worked with doing penntesting have mentioned the insane amount of times they have just dropped a USB outside a building and someone being silly enough to just pick it up and plug it in to see whats on it...
Most people have absolutely no idea how scary these things are lol. I ordered one a few years ago to play around with. I don't use it much but I still carry it around with me in my laptop bag. The first day I had it I managed to build a payload that when plugged in within a few seconds would grab every single one of my saved Google chrome passwords and email it to myself. My jaw hit the floor when that email came in with my entire password list in it lol. From that point forward I pretty much NEVER walk away from my laptop at work without locking it. It's insane how much damage someone can do with one of these and a little know-how and 5 seconds of access to a USB slot on your device.
Not to mention something like sudo rm -rf /* lol. See ya later data. Hope u had backups.
Damn, there’s even a USB-C version. Nobody is safe.
Great video! Though you should have shown the Ducky as several different looking USB sticks. A novice might only watch out for a stick that looks like the one you are showing. And it seems to me like you are trying to communicate to novices too. Otherwise I have nothing to complain about and found the video very well written and informative.
Thank you for covering this! I know this is the newest release which is awesome!
I've been using a ducky for 5 years to automate changing settings in windows and install software for machines we sell to customers to ensure that they are ready to use out of the box.
Hak5's stuff is great. They have some amazing tools.
It would be interesting if LTT did an interview with Darren Kitchen or Shannon Morse on their products.
If I remember correctly Stuxnet, one of the most sophisticated viruses discovered, happened by someone dropping a usb in a parking lot as the nuclear facility it targeted was completely disconnected from external networks. There is a really interesting podcast (Darknet Diaries ep29) that talks more about it.
At my workplace, the desktops had just the two USB ports for the keyboard and mouse enabled for just HID, and all others disabled. IT are the only ones that can get files off a flash drive using an isolated, disconnected machine with various malware scanners.
on the topic on opsec, has LTT ever hired pen testers to test security? if so, would there ever be a video on the topic?
In Wan show they have talked about the lack of content, because as soon as they tell people what type of security they use they expose themselves.
Linus had someone convince his cell carrier to give them a new Sim and they got access to his 2fa messages.
Just realized my passion and finally started pursuing a comp sci degree this semester. And I'm quite proud of myself because I actually understood every single issue you guys listed with the ducky. I love this field haha
these are perfect for pranks!
remote controlling your teachers computer in class really gets a laugh out of your peers
Love the editing on this one. Also interesting tool for the Labs.
Props to the Hak5 team. Great group of people
You know wireless BadUSBs exist, they're open source too : ) search for them on TH-cam
Oh Seytonic, glad to see you here
“There safe trust me”
Yo it’s seytonic love the videos dude
Interesting use for automating your PC setup. Have you also tried UiPath process automation?! It can perform way more complicated stuff and it seems easier to setup that this rubber ducky stuff. Nice shoutout to the Konami cheat code, I'm a game dev :D
Why would anyone use an external device to run a setup script, especially one that is so limited? If you already have access to the computer, just put the payload on a regular flash drive and run it...
Or Ansible. This is a neat tool but, for businesses, there are much better options for imaging computers and setting up software. Most software can be baked into the ISO image.
Great video! between the Hak and the pineapple wifi there's material for a couple more at best.. would love to see more of it!
Btw, it's just me or Linus looks like he hasn't slept for 3 days?
This is probably the best advertisement they could have asked for. I'd bet tens of thousands of people bought it after watching your great promotion.
You can configure any Arduino to act as a HID device, I had this idea some time ago but ofc there's a consumer product for this already 😃
Or a Raspberry Pi Zero.
@@Max_Mustermann A Pi Zero could also run a real programming language for the scripting. (Think LuaJIT)
@@christopheroliver148 Yes, It works pretty well with Python for example.
Unlike other crime, this is the one that you can stop yourself falling for.
NEVER plug in a USB that isn't yours
Same with "Never EVER EVER open links in mails or text messages", which is personal & business cyber security 101... but still every single day there are a plethora of morons who still do, despite even the main media now regularly warning about the dangers of acute onset idiocy.
happy for things like yubikey and other mfa devices with tools like this
I go through training once a year on IT security, and this is one of the topics.
So happy you're doing hak5 reviews now dude. They have some really cool shit. Get Anthony to start pen testing tutorials on here too. Test would be SOOOO COOOL
Edit. I said tutorials. Watching the end of video probably not a good idea. But examples of like previous attempts or actions
Kind of doubt that will happen by LTT, their already for the kind of niche tech crowd but not that niche or specialized.
Though I would love to see a video into smart home security vulnerabilities, because Linus loves to talk about cool shit he got for his house.
Mr. Robot is such a great show. One of the few series that stuck the landing. With a name like Mr. Robot, the show is not at all what you think it is.
I found it hard to watch due to it's slow pacing. Might just go back.
What it is?
@@MRJMXHD Slow? Really? I loved it. It really takes off season 3 and 4. Stick with it because it all comes together. This show has some of the best directed episodes I've seen on television. The first season is a bit smaller in scope, but becomes a much bigger story as it goes along.
@@MRJMXHD The whole series is on Prime now.
@@NEOREV_MUSIC thanks I will.
I made a very rudimentary version of this once out of a microcontroller. It was to get an achievement in a video game that required a lot of button mashing. Fun times!
OMG, Hak5! One of the OG video content creators out there. They're like older or the same age as TH-cam. Used to watch them in Revision3 back in the day.
5:56 the irony here is palpable - this scene didn't age very well for LMG.
I did suggest to Snubs a few years back to do a colab with you. Good to see you cover it at last. I got the original Ducky way back in the day.
Now they need to cover the Pineapple
I know of one virus that spread through USB, I forget the exact name of it, but I had it both from a school computer and a mobile radio station computer.
The way it worked was: if you inserted a USB drive, the computer had a background task running that would hide all your files/folders, and replace them with shortcuts that both opened the file, and opened the virus, spreading it to your machine and anything else you plugged into it.
Luckily for me, AVG free was able to pick up the virus file on my drive the first time, so I was just stuck with shortcuts for icons (easily fixed with some cmd trickery). The second time I recognized what happened and removed it myself (lucky me I had autorun disabled and the virus couldn't run itself, for some reason).
I've done this somewhat similarly long time ago when I was in high school. I got a rando DVD from my friend and tried it on my PC. The next thing happened was a sudden jumpscare in fullscreen.
I jumped so hard out of my chair, basically my first ever jumpscare.
This is actually why a lot of businesses will prevent you from plugging in any keyboard except the "certified" ones. I think Active Directory even has a feature for that
We actually still configure all of our work machines with PS/2 ports and you can only connect a keyboard to that port. It’s an annoyance but they was the strategy they decided to go with.
@@GulfCoastGrit I wonder if there could be wireless PS/2 keyboard transceivers. After all, as far as the computer is concerned wireless USB peripherals are identical to wired ones.
10:40 Remember kids safety first
😂
Human error is always going to the weakest link in cyber security sadly. As you said it only takes one. I've caught ransomware before working in IT before it caused major issues and each time it was always human error that brought it in.
0:29 i love how that website is considered cyber crime