bad USBs are SCARY!! (build one with a Raspberry Pi Pico for $8)

Bad USB devices turn a simple “plug in a USB drive” moment into a fast, automated keyboard takeover—capable of disabling security software, triggering reverse shells, or playing disruptive pranks—often before anyone notices. The core danger is that computers treat these devices as Human Interface Devices (HID), the same category used for keyboards and mice, which means the system effectively “trusts” the input as if a person typed it.

The transcript demonstrates the risk with quick, hands-off examples: plugging in a malicious USB leads to Windows Defender being disabled, followed by a reverse shell opening on a laptop. The attack doesn’t require visible user interaction because the device can inject keystrokes through the operating system’s normal input pathways. Even when the payload is “just” a Rickroll, the impact can be sticky—audio keeps playing and typical controls may not stop it—highlighting how little time defenders have once the device is connected.

Effectiveness comes from two factors. First, HID trust: when a normal flash drive appears, the computer routes it through file storage workflows. A bad USB instead presents itself as an HID keyboard/mouse, so the operating system routes the traffic as legitimate user input. Second, speed: humans type roughly 50–75 words per minute, while the device can simulate input around 1,000 words per minute. That gap matters when an attacker relies on the victim leaving a computer unlocked or unattended; the malicious sequence can complete before the user realizes anything is happening.

The practical build section focuses on two approaches. The “classic” option is the USB Rubber Ducky from Hak5, a purpose-built bad USB that uses Duckyscript—commands that simulate keyboard actions. The cheaper alternative is a Raspberry Pi Pico (about $5) configured to behave like a bad USB using CircuitPython and an HID library. Setup involves installing CircuitPython onto the Pico, adding the HID support package, and placing a payload script (named code.py for the Pico) so the device runs immediately on connection.

For the Rubber Ducky route, scripts are typically encoded into an inject.bin payload using a web-based encoder, then copied onto the device’s microSD storage. For the Pico route, the payload can be pasted as a Python script and placed into the Pico’s root directory as code.py, with a caution that it may execute as soon as it’s written—meaning editing can accidentally trigger the attack.

Defenses emphasized in the transcript are largely behavioral and policy-based. The simplest rule: don’t plug unknown USB devices into computers. Lock the workstation when stepping away (e.g., Windows Key + L), because a locked screen and password barrier can prevent the HID-injected actions from succeeding. For organizations, the transcript recommends reducing administrative exposure via least privilege and requiring password prompts for admin actions—implemented through Windows registry policy changes or group policy—so malicious keystroke sequences can’t silently elevate privileges.

Overall, the message is that bad USBs exploit everyday habits and default trust in input devices. With the right configuration, a $5 microcontroller can behave like a keyboard at machine speed, turning curiosity-driven USB plugging into a high-risk intrusion path.