Condemned is the one who doesn't keep a close eye on their USB ports, because a simple connection can turn into pure chaos. The first time we talked about BadUSB was in August 2014, and later we learned about its public release. Now it's MalDuino's turn, which is essentially BadUSB on open source hardware. Once connected, MalDuino behaves like a virtual keyboard and begins injecting text. What kind of text? Well... that depends on you.
In the Mr. Robot series, one of the characters hacks a terminal using the famous Rubber Ducky accessory. With the right script, the Rubber Ducky can extract all cleartext passwords from memory in less than twenty seconds. The episode left several technical details unresolved, such as whether the computer was locked or not (if so, it requires an additional attack before entering), but if we compare it with CSI-level horrors (in all its versions), it was a very well-executed scene. The Rubber Ducky concept follows the BadUSB path, a device that behaves differently than expected. Once we have physical access to the computer, the sky is the limit... however, we first need a ladder.
MalDuino: The Ladder
This ladder can be MalDuino, a small accessory equipped with an ATmega32u4 that assumes the role of a keyboard and begins to inject text. By using the ATmega32u4, MalDuino is positioned as a compact version of the Arduino Leonardo, which in turn enables programming with the official IDE. There will be two versions for sale. The first will be the Lite, with a total of 30 kilobytes to store scripts, an LED that indicates the execution status (in progress or complete), and a switch that blocks scripts while we program it. The Elite version will resemble the Rubber Ducky, with a microSD card slot to store more complex scripts, and switches that allow selection on the fly.
Price and Availability
According to its Indiegogo campaign, the MalDuino Lite will cost €19 with worldwide shipping included, and the Elite will be €32. Even so, the project is open source, and anyone can reproduce the hardware themselves if they wish... which automatically leads us to the magic of generic Chinese hardware. Today you can buy something similar on eBay for less than six dollars with free shipping, as long as you wait for the Chinese New Year to end. MalDuino already has all the necessary funding, and the first deliveries will be in March.
