11
May, 2024

I want to raise awareness about the danger of unknown USB flash drives

My goal

In the context of training for IT users, it is crucial to raise their awareness of the risks associated with the use of unknown USB sticks.

To make a difference, a practical demonstration is often more effective than a simple speech. That is why I want to get a USB stick capable of simulating damage on a computer, in order to show concretely the dangers involved.

Rubber Duckys are USB sticks used by hackers, but their cost is often prohibitive. I am therefore looking for a more economical solution to create this awareness tool.

In short, I want to find an affordable alternative to Rubber Ducky to make users aware of the risks associated with the use of unknown USB sticks, using a USB stick capable of simulating damage to a computer.

What are Rubber Duckys?

Rubber Duckys are USB sticks designed to simulate a keyboard when connected to a computer. They are often used by hackers to perform keystroke injection attacks, which consist of simulating keyboard keystrokes to execute malicious commands on a target computer.

Rubber Duckys are equipped with a programmable microcontroller that can store pre-recorded scripts. When connected to a computer, they behave like a standard USB keyboard and can send pre-recorded key sequences at a very high speed, allowing complex commands to be executed in seconds.

Rubber Duckys are often used for penetration tests or IT security demonstrations, but they can also be used for malicious purposes, such as data theft or the installation of malware. It is therefore important to make users aware of the risks associated with the use of unknown USB sticks and to take appropriate security measures to protect computers against keystroke injection attacks.

As explained in the previous paragraph, my aim is to raise awareness among users of IT tools and demonstrate to them the dangerousness of inserting an unknown USB stick into their computer.

Here is the price of Rubber Ducky, hence my wish to find another solution, the price is eliminatory for the usefulness that I will have.

I will use a Digispark Rev. 3 equipped with an ATTINY85

I will use much lighter equipment because it only has 6k of memory, but that is enough, I will not run a complex script.

This equipment is worth between 5 and 7 euros.

You can order it among the Chinese directly praying that you will have the right version or at Amazon in batch of 3.

The connectors won't be useful to me, I'm not going to flash it.

Constraints of the Digispark ATTINY85

If we compare a Rubber Ducky and a Digispark, we realize that the first and main limit is the storage capacity of usable scripts.

The ATtiny85 microcontroller has 8 KB of flash memory, but part of this memory is used to store the bootloader and application program code. In general, the amount of memory available for storing data on a Digispark ATtiny85 key is approximately 6 KB. For my use, this is enough.

Rubber Ducky keys have advanced features such as the ability to simulate USB devices other than a keyboard, such as a mouse or an external hard drive. Digispark ATtiny85 keys are more limited in this area and can usually only simulate a USB keyboard. That also suits me.

I download the drivers of the Digispark

I will install the Digispark drivers on my personal computer. While this may seem like a complex and delicate task, it is important to note that this manipulation should only be performed on my own computer and not on the computers targeted by the damage simulation. Indeed, once the Digispark is connected to a computer, it will be recognized as a keyboard.

I am therefore uploading the files needed to install the drivers:

Once downloaded and decompressed, it is the file that will allow the drivers to be installed.

As this driver is not signed, normally Windows will block the installation, so it is necessary to temporarily disable the mandatory driver signature.

I disable the mandatory signature of pilots

I will temporarily disable the mandatory driver signature on my computer. This operation poses no risk and will be automatically canceled the next time the computer is restarted. This step is necessary to allow the installation of the Digispark drivers, which have not been digitally signed by a trusted publisher.

I'm going into Settings then Recovery to press the button Restart Now

Then at restart, choose Troubleshooting

then Advanced options then Settings

The PC restart and restart, here are the choices:

I want option 7, so I am relying on F7.

I install the Digispark drivers

I can now launch the file Install Drivers.exe

I install the Arduino IDE

Arduino’s Integrated Development Environment (IDE) is an open-source software for programming Arduino and other compatible maps. It is he who will allow me to enter the code of the script I want to run and then upload it to the Digispark key.

Nothing very complicated, everything settles down on its own.

I am integrating the Digispark pack into the IDE

To manage the Digispark card, it is necessary to use the Digispark pack.

I launch IDE Arduino, then File then Preferences.

I have to complete theAdditional Card Manager URL

In all the tutorials and other docs you will find on the internet, this link is specified:

But on the day of my tests, this link did not work, the site digistump being HS.

Here is the link I used:

In Tools, Cards, Card Manager, typing digistrump then click on Install from Digistump AVR Boards

Then return select the Default card in Tools, Map, Digistump AVR Boards, then Digisdpark Default 16.5mhz.

 

I install the QWERTY keyboard

In order not to get trapped on the writing of the commands to be sent, I install an American keyboard in QWERTY. So when I enter commands to execute or display, I will switch the keyboard to ENG.

I enter my code/script

Here is my script:

#include <DigiKeyboard.h> void setup() { //pinMode(1, OUTPUT); // LED shines more if declared output digitalWrite(1, HIGH); // Turns on the red LED (to signal that execution is underway) DigiKeyboard.delay(3000); // Wait 3 seconds DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT); // Open a Windows DigiKeyboard.delay(500) runtime window; DigiKeyboard.print("c;d"); // Write "cmd" DigiKeyboard.delay(500); DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate the ENTRY button DigiKeyboard.delay(500); DigiKeyboard.print("curl 6o;usic<;p# https.>>uploqdsong<netlify<qpp>;usic<p#"); // Write "curl -o music.mp3 https://uploadsong.netlify.app/music.mp3" DigiKeyboard.delay(500); DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate the ENTRY button DigiKeyboard.delay(500); DigiKeyboard.print("ipconfig >qll"); // Write "ipconfig /all" DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate the ENTRY button DigiKeyboard.delay(500); DigiKeyboard.print("exit"); // Write "exit" DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate the ENTRY button DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT); // Open a Windows DigiKeyboard.delay(500) runtime window; DigiKeyboard.print(";usic<;p#"); // Write "music.mp3" DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate the ENTRY button DigiKeyboard.delay(1000); int color = 1; while (color < 5) {DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT); // Open a Windows DigiKeyboard.delay(500) runtime window; DigiKeyboard.print("c;d"); // Write "cmd" DigiKeyboard.delay(500); DigiKeyboard.sendKeyStroke(KEY_ENTER); DigiKeyboard.delay(1000); switch (color) { box 0: DigiKeyboard.print("echo off1color )1cls1tree");// Write "echo off&color 0&cls&tree" break; Box 1: DigiKeyboard.print("echo off1color!1cls1trqcert *<*<*<*"); // Write "echo off&color 1&cls&tracert 8.8.8" break; Box 2: DigiKeyboard.print("echo off1color @1cls1PING google<fr 6n!)"));// Write "echo off&color 2&cls&ping google.fr -n 100" break; Box 3: DigiKeyboard.print("echo off1color #1cls1tree");// Write "echo off&color 3&cls&tree" break; Box 4: DigiKeyboard.print("echo off1color $1cls1trqcert *<*<*<*");// Write "echo off&color 4&cls&tracert 8.8.8" break; } DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate the ENTRY button DigiKeyboard.delay(500); color++; } DigiKeyboard.delay(1000); DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT); // Open a Windows DigiKeyboard.delay(500) runtime window; DigiKeyboard.print("notepqd"); // Write "notepad" DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate the ENTRY button DigiKeyboard.delay(1000); DigiKeyboard.sendKeyStroke(KEY_ENTER); DigiKeyboard.print(" Cuckoo // Computer pirqt2< Do;;qge "); DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate pressing the ENTER button while (color < 15) { DigiKeyboard.sendKeyStroke(KEY_ENTER); // Simulate the ENTRY button DigiKeyboard.print(" Exfiltrqtion of current data<<<< "); delay(300); color++; } digitalWrite(1, LOW); // Turning off the Led Rouge } void loop() { }

I commented on it as much as possible.

I upload it into the Digispark key

I do not plug in the key, I start the compilation and upload with the button with the arrow to the right:

When the console displays plug in device now, I can insert Digispark key

Uploading is extra fast, either I manage to remove the key before the script launches or I benefit from the first launch of the … key script

It is over, the key is ready.

Thus, to simulate a keystroke injection attack, simply slide the key into a USB port.

Bibliography to go further