--- title: hid-omg-detect: A Linux kernel driver to flag suspicious... description: A new Linux kernel driver called hid-omg-detect is being developed to passively detect suspicious USB HID devices such as keyboards and mice. It scores devices... canonical: https://daily.dev/posts/hid-omg-detect-a-linux-kernel-driver-to-flag-suspicious-hid-devices-uqtxc2ghg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: hid-omg-detect: A Linux kernel driver to flag suspicious HID devices | daily.dev og:description: A new Linux kernel driver called hid-omg-detect is being developed to passively detect suspicious USB HID devices such as keyboards and mice. It scores devices... og:url: https://daily.dev/posts/hid-omg-detect-a-linux-kernel-driver-to-flag-suspicious-hid-devices-uqtxc2ghg og:image: https://api.daily.dev/og/posts/UQtxc2ghg.png og:image:alt: hid-omg-detect: A Linux kernel driver to flag suspicious HID devices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # hid-omg-detect: A Linux kernel driver to flag suspicious HID devices **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary A new Linux kernel driver called hid-omg-detect is being developed to passively detect suspicious USB HID devices such as keyboards and mice. It scores devices based on keystroke timing entropy, plug-and-type latency, and USB descriptor fingerprinting to identify potential BadUSB attacks or O.MG cables. The driver fires a kernel warning when a suspicion threshold is crossed, and is designed to work alongside USBGuard for actual blocking. Currently on its second patch revision awaiting kernel maintainer approval, it targets behavioral patterns rather than device identity, though real-world false positive rates remain untested. ## Content A new Linux kernel driver called `hid-omg-detect` is under development that passively monitors USB HID devices — keyboards, mice, and similar peripherals — for signs of malicious behavior, like BadUSB attacks or O.MG cables. The driver doesn't block anything. Instead, it scores devices based on a few behavioral and structural signals: - **Keystroke timing entropy** — legitimate human typists are irregular; automated injection is not - **Plug-and-type latency** — a device that starts sending keystrokes immediately after enumeration is suspicious - **USB descriptor fingerprinting** — known bad vendor/product IDs and unusual HID descriptor patterns When a device's suspicion score crosses a threshold, the driver fires a kernel warning. For actual blocking, it's designed to work alongside USBGuard in userspace — the driver detects, USBGuard acts. The patch series is on its second revision after feedback on the mailing list, mostly around global state management and spinlock logging. It's still a proposal waiting on kernel maintainer approval, so don't expect it in a stable release anytime soon. The approach is interesting because it targets behavior rather than identity — a device can have a clean vendor ID and still get flagged if it types like a robot the moment it's plugged in. That said, the real-world false positive rate on this kind of heuristic scoring remains to be seen once it gets broader testing. ## Similar posts on daily.dev - [Bad USB: The Invisible Hardware Threat](https://daily.dev/posts/bad-usb-the-invisible-hardware-threat-eynzntkfp) · InfoSec Write-ups · 0 upvotes · 0 comments - [Linux 7.1 Supports Newer Logitech Bluetooth Keyboards, Malicious Input Hardware Sanitization](https://daily.dev/posts/linux-7-1-supports-newer-logitech-bluetooth-keyboards-malicious-input-hardware-sanitization-bfenenjys) · Phoronix · 2 upvotes · 0 comments - [Linux Driver Being Worked On For Pulsar Gaming Mice](https://daily.dev/posts/linux-driver-being-worked-on-for-pulsar-gaming-mice-sw7fjbc48) · Phoronix · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/hid-omg-detect-a-linux-kernel-driver-to-flag-suspicious-hid-devices-uqtxc2ghg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"hid-omg-detect: A Linux kernel driver to flag suspicious HID devices","url":"https://daily.dev/posts/hid-omg-detect-a-linux-kernel-driver-to-flag-suspicious-hid-devices-uqtxc2ghg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hid-omg-detect-a-linux-kernel-driver-to-flag-suspicious-hid-devices-uqtxc2ghg"},"datePublished":"2026-04-06T07:59:47.046Z","dateModified":"2026-04-06T08:00:22.107Z","description":"A new Linux kernel driver called hid-omg-detect is being developed to passively detect suspicious USB HID devices such as keyboards and mice. It scores devices...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1bccaeb3b309ac31af39ea5f44271634?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1bccaeb3b309ac31af39ea5f44271634?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hid-omg-detect-a-linux-kernel-driver-to-flag-suspicious-hid-devices-uqtxc2ghg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"hid-omg-detect: A Linux kernel driver to flag suspicious HID devices"}]} ```