Close
today i learned (til)

“Quacking the Code” – Rubber Ducks in IT

May 3, 2024

When asked to think about a rubber duck, the average person would probably envision a yellow toy that kids play with, usually when taking a bath.

In the information technology field, however, rubber ducks signify more than just a toy. To those in the software industry, rubber ducks are tools used for debugging and hacking.

No longer the staples of childhood bathtime, rubber ducks are used by programmers as debugging companions. Often referred to as “rubber duck debugging,” this practice is a simple yet surprisingly effective tactic. When programmers encounter a particularly troublesome bug or a problem in their code, they explain the code and their thought process out loud to the rubber duck, as if the duck were an attentive listener.

The act of verbalizing the problem forces the programmers to slow down and articulate their thoughts, which can often lead them to identify the issue themselves. A form of cognitive debugging, the act of explaining the code helps the programmer understand it better by breaking complex problems down into smaller, more manageable parts. By walking through the code step by step, they can often pinpoint exactly where any flaws or logical errors occur.

Apart from this effective debugging tactic, rubber ducks signal another aspect of software – hacking USBs. Theoretically, this tool is utilized for penetration testing. Security experts can use rubber duckies to test the resiliency of their computers systems. However, it can also be used by hackers for keystroke injection attacks. When plugged into a computer’s USB port, they emulate a keyboard and can type out pre-programmed keystrokes at an extremely rapid pace, often faster than a human could type.

Posing a significant threat to computer security, USB rubber duckies can bypass common security measures to automate attacks, exploit physical access, and evade traditional security measures. Incredibly dangerous tools like the Hak5 USB Rubber Ducky exploit the trust that computers place in activities such as clicking and typing. Because these actions are typically associated with humans, computers are less likely to have security measures built in. USB rubber duckies can be pre-loaded with scripts that automate various malicious actions, such as installing malware, stealing sensitive data, or reconfiguring system settings. Once plugged in, they execute these scripts with lightning speed, making it difficult for users to detect and respond to the attack in real-time. Additionally, unlike remote hacking methods that rely on exploiting vulnerabilities over a network, USB rubber duckies require physical access to the target system. This makes them particularly dangerous in scenarios where an attacker can physically access a computer, such as in an office setting, where unattended workstations are common. USB rubber duckies can also be easily disguised as innocent-looking USB drives, making them effective tools for social engineering attacks. USB rubber duckies can bypass traditional security measures that focus on detecting malicious software or network-based attacks. Since they appear as standard keyboards to the computer’s operating system, they often go unnoticed by antivirus software or intrusion detection systems.

The Hak5 USB Rubber Ducky.

Organizations and individuals should be aware of the risks associated with these devices and take steps to mitigate them, such as implementing strict access controls, educating users about the dangers of plugging in unknown USB devices, and deploying endpoint security solutions that can detect and prevent unauthorized keystroke injections.

While the image of a rubber duck may evoke memories of childhood innocence for many, its significance in the realm of information technology transcends mere nostalgia. From its role as a trusted debugging companion in software development to its potential as a formidable tool for hackers in the form of USB rubber duckies, this seemingly innocuous object embodies both creativity and danger. As technology continues to evolve, understanding both the playful and perilous aspects of innovations like rubber ducks is crucial for safeguarding digital systems and maintaining a secure computing environment.

 

Sources:

Dahmane, A. (2016, March 24). USB Rubber Ducky — Basic Use Case Scenario. Medium. https://medium.com/@dahmane/usb-rubber-ducky-basic-use-case-scenario-51b2fcbe2f5e

Faife, C. (2022, August 16). The new USB Rubber Ducky is more dangerous than ever. The Verge. https://www.theverge.com/23308394/usb-rubber-ducky-review-hack5-defcon-duckyscript

Kahmen, J. (2023, May 12). Awareness with a USB Rubber Ducky. Turingpoint. https://turingpoint.de/en/blog/awareness-with-a-usb-rubber-ducky/#:~:text=A%20USB%20Rubber%20Ducky%20is

Rubber Duck Debugging: History and Benefits. (2023, April 7). Masterycoding.com. https://www.masterycoding.com/blog/rubber-duck-debugging-history-and-benefits#:~:text=Rubber%20duck%20debugging%20is%20a%20simple%20but%20effective%20technique%20used

Rubber ducky attack definition – Glossary | NordVPN. (2023, August 9). Nordvpn.com. https://nordvpn.com/cybersecurity/glossary/rubber-ducky-attack/#:~:text=A%20rubber%20ducky%20attack%2C%20also

Subastil, A. C. (2020, August 12). The Psychology Behind Rubber Duck Debugging. Medium. https://medium.com/@arnoldcsubastil/the-psychology-behind-rubber-duck-debugging-f19141c70060

0Likes
About Author

You May Also Like

today i learned (til)
Quantum Computing For Dummies
today i learned (til)
Coffee Chemistry
today i learned (til)
Agriculture Overseas- An Examination of Floating Sea Farms
Story Time, today i learned (til)
The Conspiracy of the 12 Scientists!

Your journey starts here! Let’s talk!

ThemeRex © 2026. All rights reserved.
  Timothy Durham was convicted of rape when a test showed his DNA genotype matched the DNA recovered from the crime scene. Eye witnesses testified that Durham was in a different state at the time of the incident, but he wasn’t exonerated from his 3000 year sentence until follow up DNA analysis showed that the preliminary forensic analysis used in the trial was misinterpreted (Thomas et al.). DNA testing serves an invaluable part in our criminal justice system, but it comes with complications and bias that can lead to wrongful convictions and misinformed juries.  

Background:

Forensic genetics aims to identify the origin of a biological sample. It can be traced back to Karl Landsteiner who discovered human ABO blood groups. With blood groups, suspects could be eliminated based on their blood type. For example, if a suspect had type A blood and there was type B blood left at the scene by the perpetrator, the investigators could rule out the suspect. Unfortunately, the reverse didn’t work. If the suspect and perpetrator both had the same blood type, it can’t be concluded that the suspect was guilty. Blood identifiers evolved into 8 distinct categories which improved the ability to eliminate suspects, but could only conclude that (if the system matched) it might be the perpetrator or this person might be related to the perpetrator (Jobling and Gill). The field evolved in the 1980s with the discovery of Minisatellites, lines of repetitive DNA that don’t encode proteins. Minisatellite patterns in DNA create what we know today as the DNA fingerprint, and it has a much higher accuracy rate than previous methods (Augustyn et al.). Around the same time, a breakthrough for victims of sexual assault was discovered. In the case of assault, bodily fluids of both the victim and the assaulter can get mixed. A process called differential lysis was created which could selectively increase the concentration of sperm in a fluid sample thereby allowing for accurate DNA testing (Jobling and Gill). Forensics evolved to use single-locus probe testing after several years because of its ease of interpretation. It looked at specific minisatellites that had high variability between subjects. This was the first DNA-based method to be used in a criminal investigation. Two murder homicides from several years apart were connected using DNA evidence. The evidence was then used to exonerate an innocent man, and the guilty party was found when he tried to evade mandatory DNA testing for all men in the small town. His guilt was then reinforced when the DNA profiles matched, and he gave a confession (Jobling and Gill). Finding DNA at a crime scene doesn’t guarantee that you’ll find a murderer. There are issues with non-pure samples and limited samples that make DNA work difficult, and accreditation of facilities and new techniques and take time (Jobling and Gill).  

Subjectivity of DNA Interpretation:

In a 2009 publication, the National Academy of Science discusses the possibility for subjective influence in lab based forensics. The interpretation bias happens in complex cases where, for example, there could be a mixture of DNA. A study published in 2011 looked specifically at this issue. A gang rape happened in Georgia, and the mixture in DNA from the case was used to prosecute one suspect after another suspect took a plea bargain to testify against him. With DNA mixtures, there are three possible conclusions: suspect excluded, suspect cannot be excluded, and inconclusive. If the suspect is excluded, it means that there’s little to no possibility that his DNA is part of the sample. If the suspect cannot be excluded, it means that there’s a possibility that his DNA is part of the sample. In the trial, the DNA examiners who knew the context of the case concluded that the suspect being prosecuted could not be excluded. The 2011 study gave the DNA evidence from this case and the DNA profiles of the suspects to 17 forensic examiners. These examiners had no context of the case, and they all worked independently. Of the 17, only 1 came to the same conclusion (suspect cannot be excluded) as the examiners who knew the context of the case. Twelve of the 17 concluded that the suspect who was prosecuted and convicted had no relation to the DNA found in the sample. Not only does this show that subjectivity occurs due to the context of the case, but the 17 examiners came up with different findings based on their past experiences meaning that not all DNA analysis is objective. Some organizations like the Scientific Working Group on DNA Analysis Methods say that quantitative statistical evidence should be presented with every categorical conclusion, but the US doesn’t require this (Dror and Hampikian).

False Positives:

There are two categories that cause wrongful identification in a DNA report: coincidental matches and false positives. Coincidental matches are DNA matches between two unrelated people. The probability of these matches is about 1 to 500,000 for white individuals and about 1 to 350,000 for black individuals. This small probability of coincidental matches makes people feel confident in DNA evidence. False positives, on the other hand, are matches between DNA and test DNA that result from issues in the forensics lab. There have been multiple cases of forensics labs accidentally switching victim and suspected rapist DNA which lead to convictions that were later overturned when the lab realized the error. There are also cases of misreading or misunderstanding a sample. In a case from 1993, a man was convicted of rape because someone interpreted a mixed sample of victim and perpetrator DNA as an individual sample. The conviction was again overturned. To prevent false convictions, retesting DNA is allowed, but it’s not an efficient solution. Many people are pushing for statistical information on the probability of false positives, so that the jurors can make accurate judgements based on DNA evidence (Thomas et al.).  

Conclusion:

DNA analysis is a useful tool for the criminal justice system, but subjectivity can be an issue in forensic testing. To combat wrongful convictions, there are organizations like The Innocence Project who use DNA testing to free the innocent, but reformed forensic testing standards should be put in place to prevent subjectivity and to ensure juries are correctly informed during trials. https://www.innocenceproject.org/    

Citation:

Augustyn , Adam, et al. “DNA Finerprinting.” Encyclopedia Britannica , 26 Apr. 2018, www.britannica.com/science/DNA-fingerprinting#ref153186. Dror, Itiel E., and Greg Hampikian. “Subjectivity and Bias in Forensic DNA Mixture Interpretation.” Science & Justice, vol. 51, no. 4, 2011, pp. 204–208., doi:10.1016/j.scijus.2011.08.004. Jobling, Mark A., and Peter Gill. “Encoded Evidence: DNA in Forensic Analysis.” Nature Reviews: Genetics, vol. 5, no. 10, Oct. 2004, pp. 739–751., doi:10.1038/nrg1455. Thompson, William C, et al. “How the Probability of a False Positive Affects the Value of DNA Evidence.” Journal of Forensic Sciences, vol. 48, no. 1, Jan. 2003, pp. 1–8., doi:10.1520/jfs2001171.