bad USBs are SCARY!! (build one with a Raspberry Pi Pico for $8)

About this video

NetworkChuck explains and builds a ‘bad USB’ — a device that looks like a flash drive but registers as a Human Interface Device, so the computer trusts it as a keyboard. He demonstrates a USB Rubber Ducky disabling Windows Defender and opening a reverse shell hands-free, and a Rick Roll prank that he says cannot be muted or stopped easily, and he claims the device can type about 1,000 words per minute versus his 50 to 75. Because he says the Rubber Ducky costs about $45, he shows a cheaper build with a Raspberry Pi Pico, which he says costs about $5, using the Pico-Ducky project: installing CircuitPython, copying the Adafruit HID library, and replacing code.py with the Ducky-in-Python script so DuckyScript payloads run as payload.dd, while the Rubber Ducky instead requires encoding a script into inject.bin on its microSD card. He closes with defences he recommends: never plug in unknown USB drives, always lock a computer when away, require a password for administrator elevation, apply least privilege, and consider locking or disabling USB ports.

Key takeaways

• A bad USB works by pretending to be a trusted HID keyboard, not a storage drive, and typing its payload very fast
• Pico build: install CircuitPython, add the Adafruit HID library, and rename the Ducky-in-Python script to code.py
• Rubber Ducky payloads must be encoded to inject.bin; Pico payloads are saved as payload.dd with no encoding
• Editing a Pico payload risks running it on your own machine; he shows resetting it with the BOOTSEL button and a flash-nuke file
• Defences he gives: do not plug in found drives, lock with Windows key + L, require a password for admin elevation, and use least privilege

Episode details: published August 20, 2021 · 21:03 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: you need to learn Python RIGHT NOW!! // EP 1 · Next: your home router SUCKS!! (use pfSense instead) →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube