{"id":5438,"date":"2026-04-06T00:35:58","date_gmt":"2026-04-06T07:35:58","guid":{"rendered":"https:\/\/catbradley.io\/?p=5438"},"modified":"2026-04-06T00:35:58","modified_gmt":"2026-04-06T07:35:58","slug":"a-new-linux-kernel-driver-wants-to-catch-malicious-usb-devices-in-the-act","status":"publish","type":"post","link":"https:\/\/catbradley.io\/?p=5438","title":{"rendered":"A New Linux Kernel Driver Wants to Catch Malicious USB Devices in the Act"},"content":{"rendered":"

A patch has been submitted<\/a> to the Linux kernel mailing list proposing a new HID<\/a> driver that would passively monitor USB keyboard-like devices and flag the ones that look like they’re up to no good.<\/p>\n

The driver is called hid-omg-detect<\/em><\/strong>, and it was proposed by Zubeyr Almaho.<\/p>\n

The way it works is fairly clever. Rather than blocking anything outright, the module sits quietly in the background and scores incoming HID devices<\/strong> based on three signals. <\/p>\n

Keystroke timing entropy, plug-and-type latency, and USB descriptor fingerprinting. The idea here is that a real human typing on a real keyboard behaves very differently from a device that was purpose-built to inject keystrokes the moment it’s plugged in.<\/p>\n

If a device’s score crosses a configured threshold, the module fires off a kernel warning and points toward USBGuard<\/a> as a userspace tool to actually do the blocking. Zubeyr adds that the driver itself does not interfere with, delay, or modify any HID input events.<\/p>\n

This is already the second revision of the patch. The first pass got feedback on things like global state management and logging inside spinlock-held regions, all of which have been addressed in v2.<\/p>\n

Is there a real threat?<\/h2>\n

The short answer is yes. The proposal explicitly calls out two threats, BadUSB<\/strong> and O.MG<\/strong>; both are worth knowing about.<\/p>\n

BadUSB<\/a> is the broader class of attack that was first disclosed back in 2014<\/strong> by security researchers. It works by reprogramming the firmware on a USB device to impersonate a keyboard.<\/p>\n

The operating system sees it as a perfectly normal input device, trusts it completely, and lets it do whatever its payload tells it to, be it open terminals, download malware, or exfiltrate data.<\/p>\n

The O.MG Cable<\/a> takes the same idea and hides it inside something that looks exactly like a regular USB cable. There’s a tiny implant built into the connector that can inject keystrokes, log them, spoof USB identifiers to dodge detection, and be controlled remotely over WiFi.<\/p>\n

Neither of these are making the headlines as often as they once did, but that doesn’t mean the threat has gone away<\/strong>. Such tools have only gotten more refined and accessible, and malicious actors in 2026 are not getting any less creative or aggressive.<\/p>\n

However, there’s a big ‘but<\/em>‘ (not that you pervert<\/em>) here. This is only a proposal, and while it looks good on the surface, the kernel maintainers have the final say in whether this makes it into Linux<\/a>.<\/p>\n

Via: Phoronix<\/a><\/p>\n

<\/p>","protected":false},"excerpt":{"rendered":"

A patch has been submitted to the Linux kernel mailing list proposing a new HID driver that would passively monitor USB keyboard-like devices and flag the ones that look like…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-5438","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-rss"],"_links":{"self":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts\/5438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5438"}],"version-history":[{"count":0,"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts\/5438\/revisions"}],"wp:attachment":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}