I am aware of the ducky quacky devices, however, is there a possibility of impersonating an usb input device to extract data from the target computer? Michael Smith's defcon talk ( http://www.slideshare.net/the_netlocksmith/defcon-2012-hacking-using-usb-devices ) implies such a thing but -if I did not skip it- upon a closer look I do not think his attack is what I have asked. In my shallow knowledge an input device has limited allowed abilities so there is nothing to fear, am I wrong?

Thank you,

  • While the classic "badusb" emulated an input device there can be other things done with usb devices, like emulating a network card. And this can then be used to extract data from the system, see poison tap. Apr 23, 2017 at 19:49
  • Thank you for your reply, however, for my specific case there are no whitelisted VID/PIDs other than HIDs.
    – keoxkeox
    Apr 23, 2017 at 20:08

1 Answer 1


Some of the ways that a USB device can be used for malicious actions.

Act as a keyboard

  • There are a bunch of different makers out there, but a USB Rubber Ducky is the most popular one. It impersonates a keyboard. Technically, to the computer it IS a keyboard, because it identifies itself as an HID (Human Interface Device).
  • If a user walks away, this device can be inserted and essentially type everything an attacker wants to do. However, it doesnt have storage typically, so how would it steal passwords? By running a script (bash or powershell), that posts the files to public sites like pastebin.
  • As a human, you cant remember and type several thousand characters of base64 encoded powershell, but a rubber ducky can. It can type out a full payload and call invoke-expression to execute arbitrary powershell code. They are awesome.

Act like a network card

  • You can get a LAN turtle, or newer models, like a bash bunny, that act as a USB ethernet card. This is different from a rubber ducky because this kind of USB device can be blocked via group policy or BIOS settings. But a LAN Turtle acts as a network card.
  • Windows will automatically install the drivers for a network card, no matter if the user is logged in, or locked screensaver.
  • Once the USB network drivers are installed, the LAN Turtle can issue your computer a DHCP IP address, and start poisoning the traffic to route traffic to itself.

    • This is often done with Responder.py, and awesomesauce tool that does tons of attacks like ARP Poisoning, WPAD poisoning, DNS, SMB, HTTPS, and others.
  • Basically, you plug in the device, and hope to catch some credentials moving across the network, like mounting an SMB share.

Physical destruction

Overall, USB can do lots of damage, and thats not including specifically destructive USB drives like a USB killer, which has a good chance of frying the motherboard or USB controller.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .