A USB Rubber Ducky is an attack tool that looks like an ordinary USB flash drive but identifies itself to the computer as a keyboard. Once plugged in, it automatically executes a pre-programmed sequence of keystrokes – faster than any human can react. In less than 60 seconds, malware can be installed, a backdoor opened, or sensitive data stolen. The device was originally developed by Hak5 as a penetration testing tool and costs less than $80.
The attacker programs the Rubber Ducky using a scripting language called DuckyScript. The script contains a precise sequence of keystrokes designed to carry out an attack.
The device is plugged into an unattended computer – e.g. in an office, library, or hotel. Windows immediately recognizes it as a trusted keyboard and grants it full input privileges.
The Rubber Ducky executes the script in milliseconds: opens PowerShell, downloads malware and launches it – entirely automatically with no visible user interaction.
After successful injection, the attacker has persistent access to the system – even after the USB device has long since been removed.
Instead of deploying malware, saved passwords, browser cookies, or documents can be copied to the USB device in a matter of seconds.
Attackers deliberately leave rogue USB sticks in parking lots or lobbies. Curious employees plug them in – and unknowingly trigger the attack.
Simulate what happens when a Rubber Ducky is plugged into a computer. Click «Plug in USB» and watch how the attack unfolds in seconds.
No operating system is immune: Because the Rubber Ducky identifies itself as a keyboard, the OS trusts it completely. Antivirus software cannot block a keyboard.
No technical knowledge required: Ready-made scripts are freely available online. Anyone can launch an attack.
Extremely fast: A professionally programmed Rubber Ducky needs less than 30 seconds to compromise a system.
Brief access is enough: Even a short, unobserved moment of physical access is sufficient – such as during a coffee break.
1. Never plug in unknown USB devices: Never insert a USB stick whose origin you don't know – even if it's found in the office parking lot.
2. Disable USB ports: In security-critical environments, USB ports can be locked via group policy or physically, so only approved devices function.
3. Never leave your computer unattended: Always lock your computer when you leave your workstation (Windows key + L). A Rubber Ducky attack takes only seconds.
4. Use USB device control software: Enterprise solutions allow only pre-approved devices to connect to company computers.
5. Security awareness training: Awareness training is the most important protection. Those who know the threat won't plug in a random USB device.