The Updated USB Rubber Ducky Is Out

The Rubber Ducky USB looks like a USB flash drive. However, when plugged in, the computer detects the stick as a USB keyboard and accepts keystroke commands from the device just as if they were entered by a human.

The USB Rubber Ducky was released over 10 years ago by Hak5 and has become a popular tool for hackers. Several updates have been released since then, but the latest version of Rubber Ducky contains a set of new features that make it a more flexible tool.

Previous versions of Rubber Ducky could create a fake Windows pop-up to collect user credentials or force Chrome to send all saved passwords to an attacker's server. But these attacks had to be carefully designed for specific operating systems and software versions, and lacked the flexibility to work across platforms.

The new USB Rubber Ducky comes with a major update to the DuckyScript programming language, which is used to create commands on the target machine. Previous versions were limited to writing keystroke sequences, while DuckyScript 3.0 allows you to write functions, store variables and use logical elements.

The new Ducky identifies the computer OS to which the flash drive is connected and conditionally executes code corresponding to each OS. It can also disconnect if connected to the wrong target. It can also generate pseudo-random numbers and use them to add a variable delay between keystrokes for a more realistic effect.

The USB Rubber Ducky can steal data from the device by encoding it in binary format and transmitting it using signals that tell the keyboard when the CapsLock or NumLock LEDs should light up. USB Rubber Ducky also comes with an online development package that can be used to write and compile payloads for the attack and then download them to the device.

Around 500 copies of the USB Rubber Ducky were sold at Def Con 2022 for $59.9.