Can anyone detect when I'm using TinyPilot?

If you're running TinyPilot in an environment with strict IT policies or endpoint scanning tools on the target system, it's helpful to understand how TinyPilot presents itself to those systems.

The TinyPilot team is not aware of any IT tools that specifically detect TinyPilot or flag the device as a threat. That said, TinyPilot is designed to control systems that you own or have permission to access. TinyPilot does not attempt to evade detection from software that searches for remote administration tools.

How TinyPilot appears to the target system

Since TinyPilot acts as a KVM, the target system sees a few devices attached:

• A Generic Plug 'n Play Monitor (for video output)

• A USB hub with the following attached:

  • A generic USB keyboard
  • A generic USB mouse

  • A USB mass storage device / thumb drive (Pro only)

    • Only when you explicitly mount virtual media

TinyPilot does not install any software or drivers onto the target system.

TinyPilot's unique identifiers

Network identifiers

All TinyPilot devices ship with the hostname tinypilot.

You can change TinyPilot's hostname from the web interface by clicking System > Hostname from the main menu:

USB identifiers

All USB devices declare the name of their manufacturer when they connect to their target system's USB port. TinyPilot declares its manufacturer name as tinypilot within the /opt/tinypilot-privileged/init-usb-gadget file:

echo "tinypilot" > "${STRINGS_DIR}/manufacturer"

USB devices also present a serial number to the target system. TinyPilot's USB serial number is 6b65796d696d6570690, which is stored in /opt/tinypilot-privileged/init-usb-gadget:

echo "6b65796d696d6570690" > "${STRINGS_DIR}/serialnumber"

If you mount virtual media (Pro only), the target machine will see a USB drive with the name TinyPilot. The name that TinyPilot presents for the USB drive is stored in /opt/tinypilot-privileged/scripts/mount-mass-storage:

readonly INQUIRY_STRING='        TinyPilot           '

Display device identifiers

Monitors share their capabilities with other devices with a message called an EDID. The EDID contains the monitor's manufacturer name, product name, and other metadata.

Because TinyPilot appears as a monitor to the target system, it announces an EDID when it begins capturing the target system's output. TinyPilot's EDID contains the product name TinyPilot.

Your target machine's display and audio device settings may list your TinyPilot device under the name TinyPilot.

Modifying TinyPilot's display information

You can modify TinyPilot's product name by changing your TinyPilot's EDID.

Some operating systems save TinyPilot as an audio device under the name TinyPilot even after you switch to TinyPilot's alternate EDID.

On Windows systems, you can change how the operating system names TinyPilot as an audio device by performing the steps below:

1. Press Win+R to display the "Run" dialog.
2. Type mmsys.cpl into the text box and click "Run".
3. Right-click on the TinyPilot sound device.
4. Click on "Properties".
5. Change the name in the text box at the top of the "General" tab to Toshiba-H2C.
6. Click on "OK".
7. Restart your computer.

When the Windows system reboots, the audio device associated with TinyPilot should appear under the name Toshiba-H2C instead of TinyPilot.