Pandora for business

[Kumaki]

...assuming the Pandy COULD handle it, and I seriously doubt Pandy could do it at all...and if it could...not at any useable speed.

Why should the mad hypothetical cracker genius use your software? He could write his own native pandora software for messing up your database.
The use of a pandora to compromise your IT security is vanishingly unlikely, but not impossible

I think this thread tailed off into the realms of the hypothetical many pages ago

You still need our software to access the fucking data to begin with!

More to the point...the database is regularly backed up...so if anyone gets in and screws it up, you simply restore to the last valid save point.

And, AGAIN...why the fuck dink with a Pandy to make it do what could easily already be done with a PC or a laptop? I mean...if your GOAL is to fuck with my database...

For GOD'S sake, no one has yet offered one reasonable answer that that most basic question/.

 

[Hồng Thất Công]

Hey guys I'm a little low on cash so i'm trying to convince the company i work for to help me pay for an open pandora so i can use it for "work" related stuff on the road such as something to take notes with/use as a calendar, just small things, what else could it do/could i tell the company it does to convince them further? 

Thanks

Bane 

Tell your boss you use it to emulate PS1, CPS1, CPS2, CPS3, N64, Sega Genesis, GB/GBA.  Basically, just to play retro games to make you happy and when you're happy, you're more productive for him 

 

[Binky]

...assuming the Pandy COULD handle it, and I seriously doubt Pandy could do it at all...and if it could...not at any useable speed.

Why should the mad hypothetical cracker genius use your software? He could write his own native pandora software for messing up your database.

The use of a pandora to compromise your IT security is vanishingly unlikely, but not impossible


I think this thread tailed off into the realms of the hypothetical many pages ago

You still need our software to access the fucking data to begin with!


More to the point...the database is regularly backed up...so if anyone gets in and screws it up, you simply restore to the last valid save point.


And, AGAIN...why the fuck dink with a Pandy to make it do what could easily already be done with a PC or a laptop? I mean...if your GOAL is to fuck with my database...


For GOD'S sake, no one has yet offered one reasonable answer that that most basic question/.

a) Most things can be reverse engineered - software equivalent to what you use to access the database could be written

B) This is a insane cracker genius - perhaps he's sworn never to touch a windows machine again (or some other ridiculous reason)

c) It is possible to mess with a database without the modifications being obvious

From a practical point of view, you are absolutely right. Noone in their right mind would attempt to mess up your database using a pandora, and they would have an incredibly hard time if they tried. I can guarantee that it will never happen

The point is that it is possible.

 

[Kumaki]

But that is my whole point. someonbe would have an incredible hard time doing it...even if they could.

And if their objective is to "stick it to me" as it were...why not do it in a simpler way? Use a PC or a laptop.

My whole point has been that these security nerds...these neckbeards...are ridiculous...they clamp down on anything just because there's a 0.00000000001 percent chance something COULD be done...and it probably wouldn't be done even if it could.

I seem to remember a line from a book I read as a child, about what-iffers...."what if I grew a beard made of green spinach?"

 

[Neelix]

Except that I don't think anyone ever really suggested anything you wouldn't do in a similar situation.

You said it yourself:

any employee connecting to our wifi with their Pandy...would be grounds for termination.

This is exactly the kind of restriction that the 'neckbeards' are recommending. All this talk of security has almost all been talk of NETWORK security. Right from the beginning.

- Neelix

 

[Kumaki]

This may be the source of the whole argument then. Becvause I am arguing that, with a Pandy...you really could not mess up my database, which is on a cloud server. Not from my network or any other network...not with a Pandy. I don't see it possible.

It stands to REASON...nobody accesses MY wifi network without my permission. and they don't GET the log-on password...I enter it FOR them. and set their computer to auto-access it later.

Yeah, a geek might find a way to rip into the area where that stuff is saved and find my logon pass...I don't know how easy or difficult that is.

But if they are caught on my network with an unauthorized device, it's a CEM - Career Ending Move.

simple, stupid as that.

Is my database impenetrable? Hardly. Reasonable security protections are in place, but nothing is totally secure, I get that.

My network? again...simple...anyone connecting to my specific wifi network with an unauthorized device...is terminated.

My whole annoyance is with the people who act like Pandy is a super-awesome device that has no limits on it's abilities...and I just plain beg to differ.

Yeah, Pandy is awesome. But there ARE things it flat can't do.

And if you want to attack my network, or my database, you're far easier and better using a PC or laptop to do it.

 

[Neelix]

My whole annoyance is with the people who act like Pandy is a super-awesome device that has no limits on it's abilities...and I just plain beg to differ.

Yeah, Pandy is awesome. But there ARE things it flat can't do.

And if you want to attack my network, or my database, you're far easier and better using a PC or laptop to do it.

I don't believe anyone even suggested that. Sure there are limits to what a Pandora can do, but there is a big difference between being limited in scope and being effectively useless for such things.

- Neelix

 

[2bit]

Name one ( besides play battlefield 3 ) !

 

[Binky]

1. get the wifi password (trivial once someone entered it for you - even some kind of real-life phishing could work here)
2. tap/monitor the company's internal network - perhaps set up an imposter wlan access point to help with this)
3. analyse and reverse-engineer comms to/from the database
4. get any extra passwords you need (this may involve cracking into the windows desktops remotely)
5. repeat step 3
6. write software for the pandora that sends valid signals to the database server
7. Use this software to subtly change data in a non-obvious way

 (I accept no liability if the above actually works)

The above is a stupid, risky, extremely-difficult, making-life-hard-for-yourself and very-likely-to-get-you-sacked approach.

Its much more complicated that the above sounds; utterly impractical.

I cannot imagine anyone ever even attempting it.

It is not, in any way, a real-life security threat. The only precaution to take is don't hire a deranged cracker genius, (which I expect you take already )

Having said that, a pandora could (but wouldn't) play a major part of an attack outlined above. Pandoras are general purpose computers and, as such, are extremely versatile.

 

[patrick295767]

<Actually how do you encrypt your sd card slot ? which  steps you recommend and how to mount this over fstab?

ex fstab:


/dev/mmc1blkp1 /home ext2 defaults 0 1

and if you had a boot menu with pwd? no risk

we can make this boot, and you flash it.

As far as I know there is currently no way to require a password at the boot loader stage, and as I noted above there are ways to change the login password without requiring a reflash as long as you have a way to boot an external OS.

And while nothing will ever entirely remove the risks, a big part of my point here is that you have to be aware of the risks so that you can make sure you take steps to reduce them.    The particular scenario I just suggested for example, would be thwarted by making sure that the software in question is always run via wired connection.   That doesn't mean there would be no other avenues for attack,  but knowing that one gives you a way to cut it off.    Denying that there are security risks on the other hand, is the arguably the biggest security risk of all.

- Neelix

It could be for instance possible to ask the pandora dev team to give us the source code of the bios boot. With this, we can add a password prompt.

It is likely in C, so, that will not be a big deal to reprogram it and add that ... and flash the pandora with it

Maybe one could try to use qemu arm with the bios to test it before

 

[Binky]

Have you looked at this:

http://git.openpandora.org/cgi-bin/gitweb.cgi

More specifically this:

http://git.openpandora.org/cgi-bin/gitweb.cgi?p=pandora-u-boot.git;a=summary

 

[Kumaki]

• get the wifi password (trivial once someone entered it for you - even some kind of real-life phishing could work here)
• tap/monitor the company's internal network - perhaps set up an imposter wlan access point to help with this)
• analyse and reverse-engineer comms to/from the database
• get any extra passwords you need (this may involve cracking into the windows desktops remotely)
• repeat step 3
• write software for the pandora that sends valid signals to the database server
• Use this software to subtly change data in a non-obvious way

 (I accept no liability if the above actually works)
The above is a stupid, risky, extremely-difficult, making-life-hard-for-yourself and very-likely-to-get-you-sacked approach.

Its much more complicated that the above sounds; utterly impractical.

I cannot imagine anyone ever even attempting it.

It is not, in any way, a real-life security threat. The only precaution to take is don't hire a deranged cracker genius, (which I expect you take already )

Having said that, a pandora could (but wouldn't) play a major part of an attack outlined above. Pandoras are general purpose computers and, as such, are extremely versatile.

Bolds and underlines say it all. I rest my case.

 

[Kumaki]

By the way...in order to even use the Wi-Fi on the Pandy, you have to have access to the keyring.

And employees wouldn't have that.

Yeah, I know, the easy answer is to simply re-flash.

But a sopt-check on anyone's Pandy would find the keyring had been alrtered...and that employee is gone.

 

[Neelix]

*shrugs* pointing out the impracticalities of an hypothetical situation designed to be impractical is meaningless.

- Neelix

 

[Kumaki]

You just never give it up, do you, Neelix? You seem convinced the Pandy CAN do it...and that someone WOULD use a Pandy to do it...when much easier methods actually exist.

I'm done. I already rested my case.

 

[Neelix]

Now you're just putting words in my mouth...

I've never once suggested using a Pandora for the type of heavy duty processing Binky's scenario calls for.

I do however regularly use my Pandora to remotely control other computers on my network in various different ways, not all of them necessarily visible to someone at the keyboard, and I do this with readily available software, so I know that to suggest that it couldn't possibly present a security risk in a corporate network environment is hopelessly naive position to take.

- Neelix

 

[2bit]

Perhaps


this thread should


Locked … ?

 

[Binky]

Why?

It seems to has calmed down by itself.

As long as kumaki and I stop arguing, people can get on with discussing real uses for the pandora

 

[2bit]

Because the argument is pointless . Because there a lot of devices worse than the pandora for cracking ( ds lite with custom firmware ) and there are quite a few others better ( falcon northwest tlx ) .

 

[Binky]

A thread with this title is worth having, even if that argument isn't