hid-omg-detect: Linux driver in development to detect malicious HID devices

Posted by somerandomxander@reddit | linux | View on Reddit | 14 comments

[-]

fellipec@reddit

It is nice but the consequence of this will be malicious HID harder to detect/better mimicing legit ones. The old cat and mice race.

[-]

linuxjohn1982@reddit

That's not a bad consequence. It's always better that malicious software is harder to make or spread. Always.

[-]

So, I’m the guy who makes the OMG Cable, which this kernel module is named after. The ability to bypass this type of detection has already been built into the cable. But I intentionally choose very detectable defaults.

Adding detections like this is sort of like locking your front door but not installing high security doors that cannot be kicked open. It’s a good idea that stops a large subset of threats. Especially if adding it is relatively low cost.

[-]

Swizzel-Stixx@reddit

I wonder if my macropad will be flagged as malicious. It’s basically a badusb with 16 buttons.

[-]

MartinsRedditAccount@reddit

Yeah wouldn't (shouldn't) this detect any QMK-based devices?

[-]

loozerr@reddit

Human interface device devices

[-]

Dangerous-Report8517@reddit

Physical devices that provide virtual Human Interface Devices. Makes sense, if only because USB devices can present multiple devices over a single port (which is part of the reason this is a threat in the first place)

[-]