The Duck Stops Here: Building hid_guard — Catching Keystroke Injection at the Kernel Level

Short summary

A developer recounts building hid_guard, a Linux kernel-space security tool that uses eBPF HID-BPF to detect and block keystroke injection attacks from devices like Rubber Ducky and BadUSB by analyzing millisecond-level typing timing anomalies. The project began as a college prank with an ESP32-based wireless keyboard emulator and evolved into a serious open-source tool with an RFC patch submitted to the linux-input mailing list. The post serves as an index for a multi-part series covering the architecture, eBPF challenges, and lessons learned along the way.

• •hid_guard uses eBPF HID-BPF in the Linux kernel to detect automated keystroke injection from malicious HID devices
• •Originated from a college prank with a $5 ESP32-S2 acting as a wireless Rubber Ducky
• •RFC patch submitted to linux-input mailing list; series covers the full build journey including failed prototypes

Generated with AI, which can make mistakes.