Detect Ready - Smarter Initial Delays for Keystroke Injection Attacks with the USB Rubber Ducky

* Hak5 was founded in 2005.
* The USB Rubber Ducky attack originated from Keystroke Injection attacks dating back to DuckyScript 1.0.
* Conventional wisdom recommended a DELAY 3000 ms at the start of payloads for reliability against variable delays.
* Modern, fast computers complicate the use of fixed delays.
* The EXTENSION DETECTREADY allows payloads to wait only as long as necessary before injecting keystrokes, based on CAPSLOCK state or iteration limits.
* The minimum response DELAY set in the extension is 25 ms.
* Testing with debugging instrumentation showed a 25 millisecond reduction on an Intel i7 machine and a 100ms reduction on a Linux VM.
* Testing on an ASUS Eee PC 701 resulted in approximately 400ms delay, an 86.67% reduction from the conventional standard.
* Mobile targets require extra time due to operating systems closing on-screen keyboards after keyboard recognition.
* PASSIVEDETECTREADY and PASSIVEWINDOWSDETECT are new extensions that detect readiness passively by monitoring lock key states or driver level detection, respectively.
* The extension architecture allows payload authors flexibility in defining the delay.

The narrative pivots on the tension between established security practices (safety first via large delays) and practical efficiency (speed and reliability). The core shift is from a heuristic—"better safe than sorry"—to a dynamic, feedback-driven approach facilitated by the EXTENSION framework. This move reflects a broader pattern in adversarial technology development: maximizing utility while minimizing friction for the operator.
The introduction of DETECTREADY embodies an evolution where assumptions about system behavior are actively tested and refined through instrumentation, moving from generalized rules to specific, measured responses based on system state flags. The results showing substantial speedups across varied hardware underscore a systemic inefficiency in pre-defined security measures when dealing with dynamic, heterogeneous targets.
The subsequent introduction of passive detection mechanisms (PASSIVEDETECTREADY, PASSIVEWINDOWSDETECT) suggests a pattern of continually seeking the lowest possible information footprint. If waiting is necessary, the most efficient waiting mechanism is to passively monitor existing synchronization events rather than imposing an arbitrary, long pause. This implies that for advanced interaction, the goal shifts from controlling the timing via brute force delay to leveraging inherent system signaling—a principle that places greater cognitive load on the defender to anticipate all possible state reflections during system initialization. The implication is that security and efficiency are increasingly defined by the ability to read and react to the minimal necessary signals rather than relying on blanket safety assumptions.
Bridge Questions: If timing is completely eliminated, what new classes of side-channel information must be monitored to guarantee payload injection success across all future operating systems? How does this focus on passive state detection shift the responsibility for establishing baseline system behavior from the payload injector to the target system itself? What are the long-term security implications of favoring dynamic, context-aware payloads over static delay protocols in high-stakes engagements?