[Forensic Side of the rubber ducky]

On 7/28/2017 at 1:32 AM, Dave-ee Jones said:

It's interesting, and you've brought some key events (no pun intended) to our attention when it comes to what is left behind giving some nice examples, but I think it could be written a bit better. You seem to jump around the place a lot in the middle of paragraphs, as if you've just thought of something as you were writing it and quickly added it in a "rush-of-the-moment".

In some parts it sounds like you're trying to attack Hak5 (you probably aren't, but in some places it does look like it..).

In regards to what the Ducky leaves behind, there will more than likely be Windows Event logs and things like that HOWEVER there are ways to delete those entries and edit the registry, as shown by some payloads written up on the Github. However these do require Admin privileges so it's not too hard to stop - don't give your employees Admin access.

Thanks for the feedback.
Yea not the best writer I'll admit hence why I needed to try to do something that will get me writing more.

I'll attempt to clean it up, and I did rush but wanted to motivate myself to get it out and I had some free time to write it.

I did a quick investigation would love to dig down deeper and hopefully will. 

[Forensic Side of the rubber ducky]

Wrote a blog on some of the artifacts left behind when using the USB Rubber Ducky with the following installed.

I wanted to see if someone where to try to steal files with the USB Rubber Ducky how would it look to a forensics investigator who receives the computer. I did a quick 30 minute investigation and would love to dig down deeper with various other tools, but for now here is a simple write up.

This is my first blog entry and if I can find time do this with other devices such as the lan turtle ect. Let me know what you think and if you find it helpful or interesting. 

Forensic look into the Rubber Ducky

[Sketchy Packet]

Found that on the network that leads to ip 107.22.196.8 and i looked up and register to amazonaws and then saw this LINK

Then found this

Should i be worried.

[Network Help]

http://i.minus.com/jb1HXgh1suU3Ik.JPG

[Network Help]

Do you know if your room mate, uses Torrents for downloading files. Torrent can have a huge impact sometimes!

Nah he doesn't im looking at the traffic through cain and able just basic webpages such as twitter and streaming youtube videos.

[Network Help]

So i lost my other account krew790 so made a new one; but here my main question.

So i playing bf3 with fine ping of 100 and less but then when my roommate turns on his pc my ping turns to 1000 and above and get hit with massive lag.

But lets say i am playing and someone turns on wdtv with netflix i don't notice any lag, or if other roommates turn on laptops.

I know previously his laptop had a virus that would ping places and he claims he got rid of it.

So what the best way for me to tell what is hitting me that hard?