Does Any Open Pandora Malware Exist?

[KillRoXx]

i did find one in stepmania. but it only affects the stepmania.cfg

it resets keymappings to pc version. and sets it to 480x200

 

[Hồng Thất Công]

OpenBox asks for root.

notaz SGX driver PND asks for root. 

Codec Pack PND asks for root. 

Java PND ask for root (I think).

 

[sebt3]

notaz SGX driver PND asks for root. 

Codec Pack PND asks for root.

These have to be trusted : they have been produced by team members in a way or an other. They would have way better ways to hide a malware on your device if they realy wanted to

 

[Hồng Thất Công]

 

[WizardStan]

Java PND ask for root (I think).

For the install so it can put a simple script in the bin path, just so you can call "java whatever.class" from the command line, and all java applications just work in exactly the same way as on a desktop (mostly).If you don't trust that, and I wouldn't blame you if you didn't, it has a "Run JAR" command which doesn't require root, it just runs a selected jar file.

 

[_wb_]

Pandora System Info asks for root if you want to modify your system bus clockspeed or disable wifi power saving. You can make your Pandora crash if you overclock the system bus too much.

Pandora Flashlight (my first Pandora application ) also asks for root, so it can set the backlight brightness itself. It uses that to display the color you want in the most power-friendly way, and also for the stroboscope mode.

 

[Hồng Thất Công]

Can this "ask for root" thing be indicated on the repo so user can be informed before downloading them?  I know, I'm paranoid here But if it's too much work then forget it

 

[Binky]

Can this "ask for root" thing be indicated on the repo so user can be informed before downloading them?  I know, I'm paranoid here But if it's too much work then forget it

What help would that be?

If a program you don't trust asks you for the root password, you can simply refuse to give it.

 

[Hồng Thất Công]

But the "dangerous" pnd is already on SD card.

 

[levi]

But security means that if you don't give it the password, it can't modify system files.

 

[TrashyMG]

 

[Klumpen]

Why are you spreading ideas like this and why do you people even give indirect advice how to make such files?

This whole thread is malware.

 

[Hồng Thất Công]

We need to talk about it to know if it's possible and how to prevent it, I guess

 

[FaeMinx]

The best way to prevent it is to stop giving it energy, I.e. dropping the subject. Malware is juvenile... this community *in general* has a maturity level above that of the general populace, and imo while I'm all for freedom, I still feel discussing this subject serves no real purpose... except to plant ideas.

 

[Binky]

x is bad! We must erase all reference to x from the internet to protect the consumers! Think of the children!

 

[b_o_b]

The best way to prevent it is to stop giving it energy, I.e. dropping the subject.

If we were discussing trolling I would definitely agree, but I don't think you will stop people from creating malicious software by avoiding talking about it. 

That said, I don't think the risk is very high in this small community. 6000 Pandora's sold, lot of members have more than one Pandora so my wild guess is worldwide only 5000 owners - not much to gain here. Most devs are also known here by the community or OP team. 

If you want to reduce the risk to almost zero, you can start using open source software only and/or don't go online with your Pandora.

 

[levi]

Anyone who knows how to code will know what can and can't be done regarding making malware on Linux.  This conversation doesn't help them at all.

 

[notaz]

Pandora System Info asks for root if you want to [...] disable wifi power saving.

For wifi powersaving you don't have to since almost forever, you can run it with sudo -n without password.

 

[Neelix]

x is bad! We must erase all reference to x from the internet to protect the consumers! Think of the children!

I would normally have agreed with your point,   except that FaeMinx did not suggest that at all - the suggestion was to avoid tempting fate by dropping the subject, which isn't the same as censorship.  

- Neelix

 

[WizardStan]

We need to talk about it to know if it's possible and how to prevent it, I guess

Is it possible? Yes.How to prevent it? If it asks for a password make extra super double plus sure you trust the source.

That is it.