Does Any Open Pandora Malware Exist?

[jastolze]

Hey I've been a proud owner of my Pandora since Feb 2012. I was curious if any Malware, Spyware, etc. has been found? I'm aware of that some do exist on Linux, but since the Pandora is a custom version of Linux, it made me wonder.

Thanks for any info!

 

[TrashyMG]

I had a bad zenity script that caused some havoc,


however that was self-inflicted..

 

[Hồng Thất Công]

The pandora's "immune system" is too weak that a malware/spyware can kill it instantly from turning on.  so don't worry

 

[Binky]

I haven't heard of any existing - and I read a lot of the material on this forum

Also:

1. Linux security is pretty good, and implemented at quite a low level
2. Most Linux malware is compiled for x86 (or Android perhaps)
3. The Pandora uses obscure, non-standard hardware and software

 

[WizardStan]

Someone could produce a malicious PND file which would wipe out all the stuff saved on your SD card, but if such a thing actually got onto the repo I'm pretty sure it would be caught pretty quickly. Don't keep anything vital on your SD cards, always keep backups of important photos and videos. Good life lesson, not just for the Pandora.

That is literally the worst that could happen though, I think. If something malicious gets into the firmware, you can just reflash it no matter how bad it gets; if something tries to do damage to your Pandora by overclocking it like crazy or something it'll just sputter and freeze and you merely restart; If they put some bad data into the power circuit to make it so it won't turn on you remove the battery for 20 minutes and it goes back to factory defaults.

There isn't really a lot someone could do other than waste some of your time.

 

[levi]

They could make a trojan that uses the Pandora to send out infections to other devices on the network, but my Pandora's network stability is such that it'd only ever have a very short window to get its work done.

 

[Binky]

if something tries to do damage to your Pandora by overclocking it like crazy or something it'll just sputter and freeze and you merely restart;

That would also have to ask for your password - which would ring alarm-bells.

 

[hedwards]

I haven't heard of any existing - and I read a lot of the material on this forum

Also:

1. Linux security is pretty good, and implemented at quite a low level
2. Most Linux malware is compiled for x86 (or Android perhaps)
3. The Pandora uses obscure, non-standard hardware and software

Also most of the software is installed through the store and most of the apps that people want to use are compiled and ported by people that are known to the community. A stranger isn't necessarily going to be unwelcome, but it would be unlikely that they'd get more than a half dozen installs like that.

 

[HelenF]

A malicious app could steal your data and passwords. For example, if you check email on your Pandora, the attacker could hijack your email account (and following from that, all other accounts secured on that email address).

 

[WizardStan]

I'm pretty sure it is really difficult, if not impossible, for non-foreground, non-root apps to just read keyboard state. I remember when I was trying to create a background process that sprang to life on particular keypress it needed to be run as root in order to listen for the keys. I could have been doing it completely wrong though.

 

[Hồng Thất Công]

Now you guys scare me. Do all PNDs on the repo go thru some kind of review process to detect these evil acts? I guess not but just want to ask anyway.

 

[_wb_]

Now you guys scare me. Do all PNDs on the repo go thru some kind of review process to detect these evil acts? I guess not but just want to ask anyway.

No, but as long as they don't ask for your root password, they shouldn't be able to do too much harm to the system. That is, they can theoretically still wipe out your data and make your Pandora grind to a halt with a forkbomb (nothing that isn't solved with a reboot, but still).

If you're paranoid about it, you can make things a lot safer by creating two different user accounts on your Pandora (or any other GNU/Linux system). One "secure" user that has write permissions to your valuable data (and maybe exclusive read permissions to your confidential data), and one "insecure" user that has only read permissions to your data. You can then log in as the "insecure" user whenever you want to try out unknown software.

In practice, I think the risk of someone putting intentionally malicious software on the repo is rather limited - but it doesn't hurt to watch the comments for warnings. Unintentionally malicious software can of course also happen, but in that case the damage is likely to be contained to that PND's own appdata directory.

In short: there is no need to worry, and I don't think we have had any bad experiences so far. But it never hurts to be a bit careful when running software of unknown reliability.

 

[moxie]

These things do get found out, too. There was, a quite long time ago now, someone who wanted user statistics, so he put some code into his apps that were to send (if I remember correctly) username and a timestamp to a data collection server somewhere whenever the app was started (and the pandora had a net connection, obviously). Not much. It got found out, however, fairly quckly and a lot of noise erupted. Moral of story: Don't do sneaky stuff in your apps - You'll catch hell for it. 

 

[Ziz]

Maybe I should make one for the still alive competition in the category "new pandora use"...

 

[sebt3]

Hey there is one in the gparted PND !!!!

 

[bzar]

PNDManager does not contain malware.

 

[sebt3]

PNDManager does not contain malware.

As if we're going to trust you on this...

 

[WizardStan]

PNDManager does not contain malware.

It does contain mall ware though

 

[ElPoco]

Maybe I should make one for the still alive competition in the category "new pandora use"...

Then you can create the antivirus that checks for it for another "new pandora use"

 

[Rockthesmurf]

While stuff like this can happen http://www.neowin.net/news/bitcoin-hoax-dupes-mac-users-into-wiping-their-hard-drives the weakest link of the chain is once again the end user

To be fair, it isn't really fair to blame the end user a lot of the time, a cool game port could be uploaded to the repository, and in the settings menu there could be a 'Bypass GPU bug (increases performance, requires root)' which when you select it does the password required dialogue, and then just does something nasty with root privilege. Sure most Open Pandora users are aware of the harm root can do, but even if the games Pandora version was open source I would guess that the majority of people wouldn't bother checking before trying the option...

So yes, the Pandora is very much open for naughty applications to wipe everything, hopefully in all cases the unit can be re flashed back to its original state. The chances of anything bad happening are relatively low (if something bad is found it would be quickly reported/addressed) but sure you could be unlucky and be the first to fall victim of a bad application.