The USB Rubber Ducky: HID Injection, Keystroke Attacks and the Reason You Should Never Plug In a Found USB Drive

The scenario plays out in under six seconds. Someone walks past a desk. They plug something into a USB port on the side of a laptop. They keep walking. The laptop owner, returning with coffee, notices nothing. By the time they sit down, their saved WiFi passwords are on a server in another country, a backdoor is running as a scheduled task, and the device that made it happen has been pocketed and walked out of the building.

The USB Rubber Ducky has been a standard piece of penetration tester equipment since Hak5 released the first version in 2010. It looks exactly like a USB flash drive. The computer treats it exactly like a USB keyboard. The difference is that it types faster than any human, executes a pre-loaded script without any visible interaction, and can accomplish in seconds what would take a person minutes.

The reason it works on fully patched, enterprise-managed, AV-protected systems is that it is not doing anything the system considers suspicious. It is typing. Keyboards type. That's what they do.

//How HID Injection Works

USB devices identify themselves to the operating system via a device descriptor that includes a Vendor ID, Product ID, and device class. A USB keyboard has device class 0x03 (HID - Human Interface Device). When the OS enumerates a new HID keyboard, it loads the appropriate driver and begins accepting keystroke events from it. This process is automatic, requires no user confirmation, and runs before any security software has an opportunity to inspect the device.

The USB Rubber Ducky presents itself as a generic HID keyboard. The OS loads the HID driver. The Ducky begins sending keystroke reports. The OS delivers them to whatever application has focus, exactly as it would deliver keystrokes from the real keyboard. There is no flag distinguishing "keystrokes from the user's keyboard" from "keystrokes from a malicious USB device" - they arrive through the same HID input stack.

Speed matters here. The Ducky Gen 2 (released 2022) introduced "Dual Boot Attack Mode" and dramatically improved keystroke rate. A payload that opens PowerShell, types a download cradle, and hits enter can complete in 2-3 seconds. At that speed, the typical user return time is far longer than the attack window.

//Ducky Script

Ducky Script is the scripting language used to write Rubber Ducky payloads. It is deliberately simple: one command per line, human-readable, with a small instruction set covering delays, string input, modifier keys, and control keys. The Ducky Script community at hak5.org has published thousands of payloads covering credential dumping, persistence mechanisms, exfiltration, and access creation.

A Minimal Payload

The simplest useful payload illustrates the structure. To open PowerShell as a hidden window and run a command:

DELAY 500
GUI r
DELAY 300
STRING powershell -w hidden -ep bypass
ENTER

DELAY 500 waits 500ms for USB enumeration. GUI r is Windows key + R (Run dialog). DELAY 300 waits for the dialog. STRING types the following text at maximum speed. ENTER submits. In practice, 500ms of delay could be reduced to 200ms on a fast system. The entire sequence completes in well under two seconds.

//Why It Bypasses Security Controls

Enterprise security architecture is built around the assumption that threats come in the form of executable files, network connections, and process behavior. Antivirus scans files. EDR monitors process creation and API calls. Network filtering inspects traffic. Behavioral analytics looks for anomalous process trees.

HID injection bypasses all of this at the input layer. The payload types keystrokes. The OS processes keystrokes. A terminal opens - not because a process created it programmatically, but because a keyboard said "Windows key, R, type cmd, enter". The resulting command prompt is a legitimate process spawned by the shell host at user request. Every downstream action - running PowerShell, downloading a file, executing code - happens via processes that exist in every legitimate workflow.

The process tree looks exactly like a user who opened a command prompt and typed commands. Because that is, from the operating system's perspective, what happened.

Payload Techniques That Work in 2024

WiFi credential dumping via netsh wlan show profiles remains effective on every Windows version without elevation. Registry persistence via HKCU\...\Run works without admin rights. PowerShell IEX download cradles (Invoke-Expression with New-Object Net.WebClient) are flagged by some EDR but remain a common first step. Encoding payloads in base64 or using certutil for download bypasses naive string matching.

More sophisticated payloads use MSBuild.exe, InstallUtil.exe, or regsvr32.exe - Living Off the Land Binaries (LOLBins) that are signed by Microsoft and present in every Windows installation. Executing malicious code via LOLBins often evades both AV and EDR that relies on application whitelisting.

//Physical Security: The Overlooked Layer

Every security assessment that ignores physical access is incomplete. A technically sophisticated network perimeter with immaculate patch management offers no protection against an attacker who walks through the front door, sits at an unattended workstation for six seconds, and leaves.

Physical security hygiene relevant to HID injection attacks: screen lock policy (a locked screen prevents keystroke injection from doing anything useful), USB port restrictions (Group Policy can prevent new HID devices from enumerating without admin approval), and clean desk policy (unattended unlocked workstations are the attack surface).

//O.MG Cable and the Next Generation

The USB Rubber Ducky requires physical access to a USB port. The O.MG Cable takes the concept further: a charging cable with a miniaturized attack implant embedded in the USB head that establishes a WiFi access point. An attacker connects to that AP and delivers payloads remotely, while the cable is plugged into the target device. The target user may be using the cable to charge their phone.

The OMG Cable supports keystroke injection, geofencing (payloads activate when the device is in a specific location), and self-destruct (the implant can wipe itself to prevent forensic analysis). It is visually indistinguishable from a standard Lightning or USB-C cable.

These devices represent the commodification of a capability that required custom hardware and significant skill a decade ago. The barrier to performing a credible HID injection attack is now about $60 and a lunch break.

//Defensive Summary

Defenses that do not work: antivirus, EDR behavioral analysis, network monitoring, patch management. Defenses that do work: USB port locks (physical), HID device enrollment policy (GPO/MDM), screen lock + short timeout, physical security (no unattended access to workstations), and security awareness for staff who regularly connect unknown USB devices.

The fundamental issue is that the HID attack surface is an intentional design feature of the USB specification - keyboards are supposed to be trusted. The fix requires policy enforcement at the OS level or physical hardware restrictions. Neither is free or easy at enterprise scale.