From the «cute, though» department:
Feed: Slashdot
Title: The New USB Rubber Ducky Is More Dangerous Than Ever
Author: BeauHD
Date: Sat, 20 Aug 2022 06:00:00 -0400
Link: https://it.slashdot.org/story/22/08/19/2136257/the-new-usb-rubber-ducky-is-more-dangerous-than-ever?utm_source=rss1.0mainlinkanon&utm_medium=feed

The USB Rubber Ducky "has a new incarnation, released to coincide with the Def
Con hacking conference this year," reports The Verge. From the report: To the
human eye, the USB Rubber Ducky looks like an unremarkable USB flash drive. Plug
it into a computer, though, and the machine sees it as a USB keyboard -- which
means it accepts keystroke commands from the device just as if a person was
typing them in. The original Rubber Ducky was released over 10 years ago and
became a fan favorite among hackers (it was even featured in a Mr. Robot scene).
There have been a number of incremental updates since then, but the newest
Rubber Ducky makes a leap forward with a set of new features that make it far
more flexible and powerful than before. With the right approach, the
possibilities are almost endless. Already, previous versions of the Rubber Ducky
could carry out attacks like creating a fake Windows pop-up box to harvest a
user's login credentials or causing Chrome to send all saved passwords to an
attacker's webserver. But these attacks had to be carefully crafted for specific
operating systems and software versions and lacked the flexibility to work
across platforms. The newest Rubber Ducky aims to overcome these limitations. It
ships with a major upgrade to the DuckyScript programming language, which is
used to create the commands that the Rubber Ducky will enter into a target
machine. While previous versions were mostly limited to writing keystroke
sequences, DuckyScript 3.0 is a feature-rich language, letting users write
functions, store variables, and use logic flow controls (i.e., if this... then
that). That means, for example, the new Ducky can run a test to see if it's
plugged into a Windows or Mac machine and conditionally execute code appropriate
to each one or disable itself if it has been connected to the wrong target. It
also can generate pseudorandom numbers and use them to add variable delay
between keystrokes for a more human effect. Perhaps most impressively, it can
steal data from a target machine by encoding it in binary format and
transmitting it through the signals meant to tell a keyboard when the CapsLock
or NumLock LEDs should light up. With this method, an attacker could plug it in
for a few seconds, tell someone, "Sorry, I guess that USB drive is broken," and
take it back with all their passwords saved.

[image 2][2][image 4][4]

Read more of this story[5] at Slashdot.

Links:
[1]: http://twitter.com/home?status=The+New+USB+Rubber+Ducky+Is+More+Dangerous+Than+Ever%3A+https%3A%2F%2Fbit.ly%2F3QFkexg (link)
[2]: https://a.fsdn.com/sd/twitter_icon_large.png (image)
[3]: http://www.facebook.com/sharer.php?u=https%3A%2F%2Fit.slashdot.org%2Fstory%2F22%2F08%2F19%2F2136257%2Fthe-new-usb-rubber-ducky-is-more-dangerous-than-ever%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook (link)
[4]: https://a.fsdn.com/sd/facebook_icon_large.png (image)
[5]: https://it.slashdot.org/story/22/08/19/2136257/the-new-usb-rubber-ducky-is-more-dangerous-than-ever?utm_source=rss1.0moreanon&utm_medium=feed (link)

--
Usenet: antisocial media