What is my goal?

In the context of training for IT users, it is crucial to raise their awareness of the risks associated with the use of unknown USB sticks.

To make a difference, a practical demonstration is often more effective than a simple speech. That is why I would like to program a USB stick capable of simulating damage on a computer, in order to show concretely the dangers involved.

Note: : At the request of some of you, I propose that you create this fake key for yourself, so you will find it ready, programmed and operational in my garage sale. Of course, it is not dangerous!! Read on to understand what it does.

What are Rubber Duckys?

Rubber Duckys are USB sticks designed to simulate a keyboard when connected to a computer. They are often used by hackers to perform keystroke injection attacks, which consist of simulating keyboard keystrokes to execute malicious commands on a target computer.

Rubber Duckys are equipped with a programmable microcontroller that can store pre-recorded scripts. When connected to a computer, they behave like a standard USB keyboard and can send pre-recorded key sequences at a very high speed, allowing complex commands to be executed in seconds.

Rubber Duckys are often used for penetration tests or IT security demonstrations, but they can also be used for malicious purposes, such as data theft or the installation of malware. It is therefore important to make users aware of the risks associated with the use of unknown USB sticks and to take appropriate security measures to protect computers against keystroke injection attacks.

As explained in the previous paragraph, my aim is to raise awareness among users of IT tools and demonstrate to them the dangerousness of inserting an unknown USB stick into their computer.

Why am I talking about fake Rubber Ducky?

The Rubber Ducky are overpriced and I'm looking for an affordable solution so that as many people as possible can buy an awareness key. No one puts these prices:

Which equipment did I choose?

I will use much lighter equipment because it only has 6k of memory, but that is enough, I will not run a complex script. It is a Digispark ATTINY85.

This equipment is affordable and functional.

Its configuration is a bit complex, you have to use drivers that are detected as dangerous, I have documented its programming on a RetEx some time ago.

What will this key do when we connect it?

The principle of this fake USB stick is to run a script at the moment it is inserted.

Obviously hackers will install a malicious program or will exfiltrate data and send it over the internet. This is not what I am going to do, I want something graphic and visual that symbolizes an intrusion, an ongoing hack and on-screen messages.

It was really at this stage that I had to choose which ‘classic’ actions were going to be spectacular enough to freak out a user.

Here is what I chose, this video illustrates what happens when you insert the key (plus the sound that does not agree on this screenshot):

I have made some keys, they are at your disposal

Obviously, nothing commercial in all of this. For an educational purpose, I invite you to carry out the demonstration with your children, parents, friends, colleagues. After the demonstration, they will no longer insert an unknown key into their computer.

I had a company make 3D printing a small box to insert the Digispark, protect it and make it look like a USB stick. I am very proud of the result:

At the end of the key, there is a hole to add it to a keychain for example and on the other side, there are two holes that allow the light of the green LED and the red LED to pass through.

Digispark costs between €4 and €5, 3D printing costs between €1 and €2, excluding inspection costs. A bubble wrap (0.20€) and a stamp at 1.29€.

For those who have asked me, I can therefore manage to make a set USB key + shipping paid at €8.50.

I made 5, I keep 1 so if you want one, contact me.

I place them in the empty attic, I can be reached with the nickname Sigalou on HACF, Jeedom community, Discord, my email is given in the first paragraph of the empty attic.