Pandora Security

[XxionxX]

After watching

https://www.youtube.com/embed/U4oB28ksiIo?feature=oembed (pretty long at 20 mins) I started thinking about securing my Pandora from theft, etc.

The speaker was able to get his machine back because he didn't totally lock it up. I was wondering if we have some software which is already ported or can be ported which can secure the on-board memory from being re-flashed(is that even possible?).


I am hoping that if someone steals my panda I can VNC to my Panda or maybe use something like Adeona to find them. I don't want them wiping out my software before I can catch them though, hence the question about the on-board memory. Is there a way to secure it from attack? I don't want people kept out, I want people to log in and use it so I can find them. Am I talking crazy talk?

 

[Stradian]

Paranoid?


Well, Being linux, you can use alot of things. Use Ip tracking for sure, use difficult passwords, etc. The Pandora is a full fetch usable computer, just look up how to handle security in linux. You can apply the same concepts for the pandora.


EDIT: Besides, Most thieves will proably have no interest in a pandora as it is very little known. If you don't know about a device or the buyer doesn't know about the device, then how can you fence it?

 

[XxionxX]

I have had numerous devices stolen from me so... Yes. Although I prefer the term cautious. I have found that a lot of thieves like to take things just because they are attracted to them. If it is cool, why not just take it (most people know that Google will solve their probs)? Besides, I like the feeling of being secure. I don't like it when I say to myself, "If I had only..."

 

[PokeParadox]

As someone that had his Pandora actually stolen... the fact that you can set it to use the password screen is in itself a godsend.


The thief tried to use the Pandora, switched the Sds around and smudged the screen... and then couldn't actually turn it off because he could not get passed my password.


(If you don't know it got handed into the police station a few days later...)


So the password is enough to deter the common thief... but the problem is what the thief may do after that.

 

[XxionxX]

I remember your story! I am glad you got your Panda back! Actually the whole concept of the log in screen is what concerns me. In your case you eventually got it back, but what if the thief had not turned it in? What if the "scorched earth" policy was in effect(If I can't have it no one will *smashes Pandora* etc.)? If they are able to log in you have the chance to track your panda (with the proper software). The only caveat I can see with my idea is that if someone is able to format the on-board memory my countermeasures are totally useless.

 

[urjaman]

^ It's always possible to format the on-board memory (unbrickable design remember? I've even posted instructions on this board), but it needs a bit of a geek to do so.


It is possible to make it so that the normal reflash system doesnt work, but then you also lose our "normal" (with boot.txt/autoboot.txt) SD boot capability (ofc direct SD booting as with recovering a dead device cant be disabled). And you would need to know how to mod u-boot in order to do this (disabling stuff is not that hard even if you dont really know how to code, OTOH).


EDIT: TL;DR if he knows what he is stealing, you wont stand a chance. Best protection is physical protection.


EDIT2: OTOH if you want to do something in software, I would propably just add some simple home-calling mechanism and hope that the thief wont reflash it.

 

[Blue Protoman]

I've never had issues with stuff being stolen; partially because I'm very responsible with my things, partially because I don't actually take them to many places. :mellow: Though someone should write an app that displays a message on the login screen if a button is pressed ("If found, please return to X Placeholder Street, XXXXX, please call XXX-XXXX")

 

[Gerix]

I'm sure this isn't as magical as other peoples' solutions, but you could change the welcome_msg variable in /etc/slim.conf to display "Reward: [contact info]."

 

[snostrebla]

After watching

https://www.youtube.com/embed/U4oB28ksiIo?feature=oembed

It was after watching this I realized my laptops were lacking in the security department. I decided to install Prey, Open source, cross-platform (no arm port yet I'm afraid), and easy to use. Tested this out for kicks, it was able to get my home address easily, I was surprised. Sadly it used to be entirely free, but it's still good even though you only get 10 reports per device. If this ever gets ported to ARM I'd use it on my pandora if it's light as they say it is.

 

[Austin25]

It was after watching this I realized my laptops were lacking in the security department. I decided to install Prey, Open source, cross-platform (no arm port yet I'm afraid), and easy to use. Tested this out for kicks, it was able to get my home address easily, I was surprised. Sadly it used to be entirely free, but it's still good even though you only get 10 reports per device. If this ever gets ported to ARM I'd use it on my pandora if it's light as they say it is.

If it's open source, why couldn't you change the code a little and have it talk to a personal server for free?

 

[snostrebla]

If it's open source, why couldn't you change the code a little and have it talk to a personal server for free?

It may be open source, but I don't actually expect it to be entirely open, and I haven't dug enough into it to determine whether or not it has been done.

 

[Austin25]

It may be open source, but I don't actually expect it to be entirely open, and I haven't dug enough into it to determine whether or not it has been done.

Well, the internet is a very good system to program for. Maybe I should write a program or script to access a secure server online, maybe ssh, ftp, email, etc, and check the state to see if it was stole, then in the case of theft, send back information like IP records, access logs, online traffic, etc. It would need to be able to be disabled in case the server becomes compromised, yet invisible so a thief doesn't see it.

 

[second exodous]

Wow, loved that vid. I guess you can't expect the common thug to know how to format and re-install. He's lucky this guy just called the cops, he could have totally screwed up his life if he wanted to. After getting all the data he wanted off the PC he could have gotten money off him, sold his identity, or whatever else he wanted. Actually the computer wasn't worth much anymore because that was the last G4 model and Apple into G5 or Intel by the time he tracked down the thug so the computer was only worth the data it had on it. When you think of it like that you realize how lucky the thug was. Having said that I hope the cops found something in his apartment to put him away for a long long time.


As far as doing something like this to get my Pandora back I don't know if I could do it but I know some friends that could help. I'll be watching this thread and hope that a method is found.

 

[Austin25]

Wow, loved that vid. I guess you can't expect the common thug to know how to format and re-install. He's lucky this guy just called the cops, he could have totally screwed up his life if he wanted to. After getting all the data he wanted off the PC he could have gotten money off him, sold his identity, or whatever else he wanted. Actually the computer wasn't worth much anymore because that was the last G4 model and Apple into G5 or Intel by the time he tracked down the thug so the computer was only worth the data it had on it. When you think of it like that you realize how lucky the thug was. Having said that I hope the cops found something in his apartment to put him away for a long long time.


As far as doing something like this to get my Pandora back I don't know if I could do it but I know some friends that could help. I'll be watching this thread and hope that a method is found.

The thug, I'm sure, is now extremely humiliated. Also, don't forget that he also told this story publicly, he could have done such evil things, but not have said anything due to legalities.

 

[XxionxX]

^ It's always possible to format the on-board memory (unbrickable design remember? I've even posted instructions on this board), but it needs a bit of a geek to do so.


It is possible to make it so that the normal reflash system doesnt work, but then you also lose our "normal" (with boot.txt/autoboot.txt) SD boot capability (ofc direct SD booting as with recovering a dead device cant be disabled). And you would need to know how to mod u-boot in order to do this (disabling stuff is not that hard even if you dont really know how to code, OTOH).


EDIT: TL;DR if he knows what he is stealing, you wont stand a chance. Best protection is physical protection.


EDIT2: OTOH if you want to do something in software, I would propably just add some simple home-calling mechanism and hope that the thief wont reflash it.

I thought as much. And that does sound like a pain in the ass. I guess you are right about the physical protection. I will have to hope the thief is not tech savvy (fat chance).

Wow, loved that vid. I guess you can't expect the common thug to know how to format and re-install. He's lucky this guy just called the cops, he could have totally screwed up his life if he wanted to. After getting all the data he wanted off the PC he could have gotten money off him, sold his identity, or whatever else he wanted. Actually the computer wasn't worth much anymore because that was the last G4 model and Apple into G5 or Intel by the time he tracked down the thug so the computer was only worth the data it had on it. When you think of it like that you realize how lucky the thug was. Having said that I hope the cops found something in his apartment to put him away for a long long time.


As far as doing something like this to get my Pandora back I don't know if I could do it but I know some friends that could help. I'll be watching this thread and hope that a method is found.

I guess that I am with you, and I will just hope the thief is not smart enough / too lazy to format the device. Does anyone know of some software we can use to this effect?

 

[Stradian]

I thought as much. And that does sound like a pain in the ass. I guess you are right about the physical protection. I will have to hope the thief is not tech savvy (fat chance).


I guess that I am with you, and I will just hope the thief is not smart enough / too lazy to format the device. Does anyone know of some software we can use to this effect?

You will be surprised at how many non-tech savy people there are. You could make it boot in recovery, just the sheer sign of a text interface will stump alot of the population. :lol:


Looking back at the video, you will see that he is the victim of a random burglar (probably a druggie knocker, who would usually steal one valuable thing and get out as quickly as possible.), This lowly criminal ether traded, or sold to someone underground. Two years later, That laptop eventually would be landed, and used, in la. That's where the whole video takes off.

 

[second exodous]

Maybe you could have a two user mode, it boots into basic user with all the tracking stuff and then after logged into that the owner would be able to log into the owners account, the thug wouldn't even know of a second account. This way it wouldn't make the thug want to erase anything so your data is still safe from being erased.


One problem with the Pandora is it doesn't have much on system storage so if you put anything of importance to either track or data wise on one of the SDs then it is easily removed and formatted. I hope the next Pandora puts a SD slot under the battery so it will look like system storage to a thug but be easily removable or replaced by the owner, that way everything could be stored there to track or sensitive data could be stored there under a password protected user.

 

[Austin25]

Maybe you could have a two user mode, it boots into basic user with all the tracking stuff and then after logged into that the owner would be able to log into the owners account, the thug wouldn't even know of a second account. This way it wouldn't make the thug want to erase anything so your data is still safe from being erased.


One problem with the Pandora is it doesn't have much on system storage so if you put anything of importance to either track or data wise on one of the SDs then it is easily removed and formatted. I hope the next Pandora puts a SD slot under the battery so it will look like system storage to a thug but be easily removable or replaced by the owner, that way everything could be stored there to track or sensitive data could be stored there under a password protected user.

Maybe write a script to cause it to crash if the SD card is removed, and recase or paint the SD card to appear as some sort of spacer. Make sure the script identifies the right card.


edit: or remove the ejector spring.

 

[XxionxX]

Maybe you could have a two user mode, it boots into basic user with all the tracking stuff and then after logged into that the owner would be able to log into the owners account, the thug wouldn't even know of a second account. This way it wouldn't make the thug want to erase anything so your data is still safe from being erased.


One problem with the Pandora is it doesn't have much on system storage so if you put anything of importance to either track or data wise on one of the SDs then it is easily removed and formatted. I hope the next Pandora puts a SD slot under the battery so it will look like system storage to a thug but be easily removable or replaced by the owner, that way everything could be stored there to track or sensitive data could be stored there under a password protected user.

Are tracking programs that big? I figured they would be a few MBs at most. How would you make a second user mode? That sounds exactly like what I was getting at. Would it mess with functionality? I would like to make the security as painless as possible.

 

[Trip]

I made a thread on the other forum about this a while back but not too many people seemed interested.


Here's the link!


Something like Adeona could maybe be added to the Pandoras bios (disabled by default of course) and that integrated with JustStolen.net would add a pretty good level of protection.


It would probably have to be added to the bios with the Pandora being unbrickable, otherwise the thief could boot from an SD card and it would be pointless.


I'm not too sure if this would be too big or complicated for the bios but I'm sure that it could be tweaked etc. and improved