Computers ask very few questions of a keyboard. That single design decision is why a small device that looks like a flash drive has stayed relevant for more than a decade.
What it is
The USB Rubber Ducky from Hak5 presents itself to a computer as a keyboard and types a prepared script at machine speed. Nothing is exploited in the classic sense. The operating system sees a human input device and accepts its keystrokes, so whatever the logged-in user could type, the device can type too.
The current version arrived in 2022, timed for DEF CON. It added USB-C next to USB-A and a much more capable language, DuckyScript 3.0.
What changed with DuckyScript 3.0
Older scripts were fixed sequences, tailored to one operating system and often one software version. DuckyScript 3.0 adds variables, functions and control flow. A script can work out whether it is on Windows or a Mac and behave accordingly. It can also randomise the delay between keystrokes so that typing looks less mechanical, which is aimed squarely at tools that flag inhuman typing speed.
The most interesting feature for defenders is Hak5's Keystroke Reflection. Data can leave the computer through the lock-key signals between host and keyboard, the same signals that switch the Caps Lock and Num Lock lights. No storage device is mounted and no network is used, so controls that watch only those two channels will not see it.
Why it still matters
Nobody needs a Rubber Ducky to be a real threat for the lesson to apply. The same attack works with any programmable USB device, including cheap hobby boards. The real question is what happens in your organisation when an unknown keyboard appears on an unlocked machine.
What actually helps
- Lock the screen. Injected keystrokes run as the logged-in user. Short auto-lock timers and the habit of locking on leaving the desk remove the easiest opportunity.
- Control USB devices. Device control policies in Microsoft Defender for Endpoint on Windows, or USBGuard on Linux, can restrict which devices are accepted. Be aware that identifiers can be imitated, so treat this as a hurdle and not a guarantee.
- Limit what the user can do. A standard account without local admin rights limits what a typed script can reach. Application control limits what it can start.
- Watch the behaviour, not the device. A shell that opens and immediately fetches something from the internet is suspicious whoever typed it. Endpoint detection should alert on it.
- Talk about found USB devices. Staff should know that a found stick goes to IT and not into a laptop, and that this also applies to anything that looks like a cable or adapter.
Only ever use devices like this on systems you are explicitly authorised to test. Pentesting and consulting at treeinspired →