Can anyone detect when I'm using TinyPilot?

If you're running TinyPilot in an environment with strict IT policies or endpoint scanning tools on the target system, it's helpful to understand how TinyPilot presents itself to those systems.

The TinyPilot team is not aware of any IT tools that specifically detect TinyPilot or flag the device as a threat. That said, TinyPilot is designed to control systems that you own or have permission to access. TinyPilot does not attempt to evade detection from software that searches for remote administration tools.

How TinyPilot appears to the target system

Since TinyPilot acts as a KVM, the target system sees a few devices attached:

• A Generic Plug 'n Play Monitor (for video output)

• A USB hub with the following attached:

  • A generic USB keyboard
  • A generic USB mouse

  • A USB mass storage device / thumb drive (Pro only)

    • Only when you explicitly mount virtual media

TinyPilot does not install any software or drivers onto the target system.

TinyPilot's unique identifiers

Network identifiers

All TinyPilot devices ship with the hostname tinypilot.

You can change TinyPilot's hostname from the web interface by clicking System > Hostname from the main menu:

USB identifiers

All USB devices declare the name of their manufacturer when they connect to their target system's USB port. TinyPilot declares its manufacturer name as tinypilot within the /opt/tinypilot-privileged/init-usb-gadget file:

echo "tinypilot" > "${STRINGS_DIR}/manufacturer"

USB devices also present a serial number to the target system. TinyPilot's USB serial number is 6b65796d696d6570690, which is stored in /opt/tinypilot-privileged/init-usb-gadget:

echo "6b65796d696d6570690" > "${STRINGS_DIR}/serialnumber"

If you mount virtual media (Pro only), the target machine will see a USB drive with the name TinyPilot. The name that TinyPilot presents for the USB drive is stored in /opt/tinypilot-privileged/mount-mass-storage:

readonly INQUIRY_STRING='        TinyPilot           '

Display device identifiers

Monitors share their capabilities with other devices with a message called an EDID. The EDID contains the monitor's manufacturer name, product name, and other metadata.

Because TinyPilot appears as a monitor to the target system, it announces an EDID when it begins capturing the target system's output. TinyPilot's EDID contains the product name TinyPilot. Your target machine's display and audio device settings may show this product name as a device identifier.