Summary of USBNinja – BadUSB embedded into a USB cable
USBNinja is a USB cable that functions normally for power and data but hides a Bluetooth-triggered payloader. When commanded remotely via a smartphone app or a Bluetooth remote, it emulates a USB keyboard/mouse to inject customizable keystroke and mouse payloads (programmable via Arduino IDE). It supports multiple connector types, fast charging, and varying wireless ranges depending on antenna choice, making it useful for security testing, pranks, demos, and training.
Parts used in the USBNinja:
- USB cable (1 m, white)
- Connector options: Micro-USB, USB Type-C, Lightning
- Embedded Bluetooth device (customizable name and password)
- Rechargeable battery 3.6 V, 40 mAh
- Antenna (options: 2 dBi 3 cm, 3 dBi 11 cm, 18 dBi directional panel)
- Microcontroller programmable via Arduino IDE (for payloads)
USBNinja is an information security and penetration testing tool that looks and functions just like a regular USB cable (both power and data) until a wireless remote control triggers it to deliver your choice of attack payload to the host machine. In essence, USBNinja is the next step in the evolution of BadUSB, embedding the attack in the USB cable itself.
The Attack
When plugged into a host computer, USBNinja acts just like a regular USB cable. For example, it can be used both to charge your phone and to transfer images from your phone to your computer. However, perfectly concealed within USBNinja is a very small Bluetooth device, patiently waiting. When USBNinja receives the secret command, either from a smartphone running the USBNinja app or from our custom-built Bluetooth remote control, it goes from a passive cable to a stealthy attacker by emulating a USB mouse and/or keyboard to deliver its hidden payload to the host computer.
The Payload
The payload delivered by USBNinja is completely customizable. You can use the standard Arduino IDE to create your own payload and we’ll also provide plenty of examples of payloads that inject keystrokes and move and click the mouse.
Use Cases
USBNinja is truly a versatile tool, with applications such as practical jokes, magic tricks, secret love confessions, game assists, and information security trainings. We leave it as an exercise to the reader to come up with their own uses.
Features & Specifications
- Cable Physical Characteristics
- Length: 1 m
- Color: white
- Connector options: Micro-USB, USB Type-C, Lightning
- Voltage range: 4-25 V (supports fast charging)
- Current consumption: 10 mA (typical)
- Full-rate USB data transmission
- Remote Control
- High-powered Bluetooth wireless (customizable name and password)
- Battery: 3.6 V, 40 mAh, rechargeable
- Standby current: 80 μA
- Transmission current: 30 mA
- Range (under ideal conditions with antenna):
- 30 m with 2 dBi, 3 cm antenna
- 50 m with 3 dBi, 11 cm antenna
- 100 m with 18 dBi directional panel antenna
Read more: USBNinja – BadUSB embedded into a USB cable
- How does USBNinja deliver its attack?
It remains a normal USB cable until a Bluetooth command triggers it to emulate a USB mouse and/or keyboard and inject a payload. - Can I customize the payload delivered by USBNinja?
Yes, payloads are customizable and can be created using the Arduino IDE with provided examples. - What connector types are available for USBNinja?
Micro-USB, USB Type-C, and Lightning connector options are available. - Does USBNinja support fast charging?
Yes, it supports a voltage range of 4–25 V and fast charging. - What is the battery specification for the remote control?
The remote uses a rechargeable 3.6 V, 40 mAh battery. - How far can the Bluetooth remote reach?
Range varies by antenna: about 30 m with a 2 dBi 3 cm antenna, 50 m with a 3 dBi 11 cm antenna, and 100 m with an 18 dBi directional panel under ideal conditions. - Does USBNinja perform regular USB data transmission?
Yes, it supports full-rate USB data transmission and typical 10 mA current consumption. - Can the Bluetooth device name and password be changed?
Yes, the Bluetooth wireless is customizable in name and password.
