{"id":421300,"date":"2026-04-05T11:37:10","date_gmt":"2026-04-05T11:37:10","guid":{"rendered":"https:\/\/www.europesays.com\/ie\/421300\/"},"modified":"2026-04-05T11:37:10","modified_gmt":"2026-04-05T11:37:10","slug":"hid-omg-detect-linux-driver-in-development-to-detect-malicious-hid-devices","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ie\/421300\/","title":{"rendered":"hid-omg-detect: Linux Driver In Development To Detect Malicious HID Devices"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" alt=\"HARDWARE\" src=\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2025\/12\/hardware.webp.webp\" width=\"100\" height=\"100\"\/><br \/>\nZubeyr Almaho has been leading work on a new HID driver named hid-omg-detect with an intent on passive monitoring to watch out for any malicious HID devices being connected to the system.<\/p>\n<p>The hid-omg-detect kernel module attempts to detect any malicious HID devices like specially crafted keyboards and mice . Detection is currently based on factors like low keystroke timing entropy, immediate post-enumeration typing, and known suspicious vendor\/product IDs and HID descriptor anomalies.&#13;<\/p>\n<p>With this driver there is a configurable threshold and if such a device is believed to be malicious, it would emit a warning and paired with the likes of USB Guard in user-space could then block the device. The hid-omg-detect driver doesn&#8217;t block any devices itself nor modify HID events or delay them.&#13;<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/04\/image.webp\" alt=\"Example USB mice as HID devices\"\/><\/p>\n<p>It&#8217;s an interesting driver addition currently under review and consideration on the mailing list.<\/p>\n<p>Those concerned about potentially malicious HID devices being connected to your systems or just curious about hid-omg-detect can find all the details on this driver via the <a href=\"https:\/\/lore.kernel.org\/lkml\/20260404133746.80914-1-zybo1000@gmail.com\/\" rel=\"nofollow noopener\" target=\"_blank\">patch series<\/a> on the Linux kernel mailing list.<\/p>\n","protected":false},"excerpt":{"rendered":"Zubeyr Almaho has been leading work on a new HID driver named hid-omg-detect with an intent on passive&hellip;\n","protected":false},"author":2,"featured_media":421301,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[74],"tags":[36622,18,19,17,36621,36619,36618,36625,36623,36620,36624,36617,36628,82,36626,36627],"class_list":{"0":"post-421300","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"tag-desktop-linux","9":"tag-eire","10":"tag-ie","11":"tag-ireland","12":"tag-linux-benchmarking","13":"tag-linux-hardware-benchmarks","14":"tag-linux-hardware-reviews","15":"tag-linux-how-to","16":"tag-linux-performance","17":"tag-linux-server-benchmarks","18":"tag-open-source-graphics","19":"tag-phoronix","20":"tag-phoronix-test-suite","21":"tag-technology","22":"tag-ubuntu-benchmarks","23":"tag-ubuntu-hardware"},"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@ie\/116351903126700564","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/421300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/comments?post=421300"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/421300\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media\/421301"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media?parent=421300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/categories?post=421300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/tags?post=421300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}