Protecting The Pandora Against Theft At Boot Time

[WizardStan]

Before I had my own domain name, I had a script which would send me an email with it's current IP anytime it changed so that I could SSH into it. A discreet daemon which monitors connection and simply phones home it's IP address would solve the problem reasonably well. The police should be able to handle the rest from there.

 

[raytaller]

If I recall correctly, part of what makes it unbrickable is that the bootloader exists in shadow rom which is (almost) impossible to overwrite. It can only be done with a jtag cable, I believe. No software recompile and flash can fix it. And if you screw up while loading the new bootloader, you have successfully bricked your unbrickable machine.

The OMAP has few kb a TI boot ROM inside, that is impossible (atleast not possible with JTAG or programmatically) to change (its a Read Only Memory FFS) that makes the design unbrickable. The boot rom can boot from NAND,SD,UART and as a USB Device. What the TI boot rom loads is a small (<64k) bootloader (called xloader) that initializes the DDR SDRAM above the OMAP, then continues booting (it usually knows where it should have been loaded from...) by loading (for linux) the u-boot bootloader which (atm) shows a pandora logo, loads the linux kernel (and optionally the initrd) and boots the kernel.

If you implement any security in u-boot (or xloader), it is easily bypassed by changing the status of a GPIO pin (connected to the button) used by the TI boot ROM to determine the boot sequence.

Thanks, this is very interesting.
As far as I understand, u-boot could wear the boot message or password protection, even if, as you said, it won't be bulletproof.

 

[kuru]

In case of theft my Pandora should say:

Hate. Let me tell you how much I've come
to hate you since I began to live. There
are 387.44 million miles of printed
circuits in wafer thin layers that fill
my complex. If the word hate was engraved
on each nanoangstrom of those hundreds of
millions of miles it would not equal one
billionth of the hate I feel for humans
at this micro instant. For you. Hate. Hate.

 

[droneb]

Before I had my own domain name, I had a script which would send me an email with it's current IP anytime it changed so that I could SSH into it. A discreet daemon which monitors connection and simply phones home it's IP address would solve the problem reasonably well. The police should be able to handle the rest from there.

XD, in that case it would be usefull, but on the other side DDNS works great too.

the issue around this is to make the thing auto connect wifi networks and send the ip

 

[may88]

... but if ownership is transferred to another person...

Woah! I don't think anyone will be selling theirs. A Pandora is for life and not just for Christmas (next one as the last two were missed ).
I'm going to be buried with mine.

I was thinking about the same topic, not having seen this post until today (well yesterday now).

May be the app store could be used? You register your Pandora, for a small fee, and once done it phones home each time the Pandora is connected to the network. (part of the ip stack in NAND). The Panda would need a hostid of some sort, unique to the unit. Not fully thought through.
Similar in principle to Wizard Stan's email home script.

 

[White Demon]

I don't think that the "theft protection" need be foolproof. Even if something as simple as removing the card would defeat it, the point is to convince a person picking it up that it won't work for them at the outset. Once they show determination by taking it and looking into how to break the protection, it's already gone. Even if they were unable to break it without manufacturer support, you don't have it anymore. I see no reason to make yourself "feel better" by knowing that they can't possibly use it. I've had a laptop stolen at one point in my life, and I never felt worse merely because I thought of them getting use out of it. I was just irritated that I didn't have it.

Stop talking crap. Firstly, it's perfectly fine to want the dude who stole your stuff to not be able to use it. He's broken social convention, you're not doing anything morally wrong by denying him use. Revenge is healthy. Secondly, it's a perfectly good deterrent, let's say they put something in iphones that meant you could only access them with a password and for arguments sake this couldn't be cracked. A stolen iphone would be as much use to a theif as a brick, so he probably wouldn't go to the effort to steal the thing anyway.

Stop trying to take the moral high ground.

What absolute rot. How the hell does knowning that someone will not be able to use something of mine that they've stolen make me feel better or like I've gotten some sort of revenge?

Recently we had someone steal a couple of laptops from our home, and what made it worse was we were at home at the time (but in different parts of the house, and no, our house isn't big, but the person who came in must have been VERY quiet).

One of the laptops was very old (a P266) and the battery in the other was completely shot (not dead, but could not hold a charge beyond a couple of minutes).

Did any of that make us feel better because the person would get little or no use/resell value out of it? Hell no, the mere fact that they came into our house any took something which we owned was bad enough, and nothing was going to change how we felt.

 

[droneb]

I don't think that the "theft protection" need be foolproof. Even if something as simple as removing the card would defeat it, the point is to convince a person picking it up that it won't work for them at the outset. Once they show determination by taking it and looking into how to break the protection, it's already gone. Even if they were unable to break it without manufacturer support, you don't have it anymore. I see no reason to make yourself "feel better" by knowing that they can't possibly use it. I've had a laptop stolen at one point in my life, and I never felt worse merely because I thought of them getting use out of it. I was just irritated that I didn't have it.

Stop talking crap. Firstly, it's perfectly fine to want the dude who stole your stuff to not be able to use it. He's broken social convention, you're not doing anything morally wrong by denying him use. Revenge is healthy. Secondly, it's a perfectly good deterrent, let's say they put something in iphones that meant you could only access them with a password and for arguments sake this couldn't be cracked. A stolen iphone would be as much use to a theif as a brick, so he probably wouldn't go to the effort to steal the thing anyway.

Stop trying to take the moral high ground.

What absolute rot. How the hell does knowning that someone will not be able to use something of mine that they've stolen make me feel better or like I've gotten some sort of revenge?

Recently we had someone steal a couple of laptops from our home, and what made it worse was we were at home at the time (but in different parts of the house, and no, our house isn't big, but the person who came in must have been VERY quiet).

One of the laptops was very old (a P266) and the battery in the other was completely shot (not dead, but could not hold a charge beyond a couple of minutes).

Did any of that make us feel better because the person would get little or no use/resell value out of it? Hell no, the mere fact that they came into our house any took something which we owned was bad enough, and nothing was going to change how we felt.

no one said you would feel good, but at least knowing that he wasted time stealing a piece of brick nearly useless or non profitable would be better than letting theft being profiitable or in most cases used to buy drugs

 

[b1llygo4t]

the average person wouldnt be able to bypass the password or even know how to set things up on the sd card to boot another os, especialy if their the average thief. its not a gameboy, and buying a new power cord from the local game store wont make it so they can use it. a pawn shop or game store wouldnt buy it unless they could show that it functioned, or if there was an "if found" splash that the thief couldnt bypass . without a password there is no point in having contact/reward info. a friend of mine has the largest engraving laser in town... "property of U.S. Gov." comes to mind

i like the call home idea

how hard would it be to hack a thumb print scanner into it, arent there bare pads on the board for us to hack with? mabe an internal

security through obscurity can have its good points, i for one will not have the name "pandora" in my splash screen.

 

[Titcher]

Could definitely have the pandora try to automatically connect to your PC every few minutes in the background and give a terminal, using netcat or similar. Then from there use that access to monitor their web usage, hope they buy something online, then report the address to the police.

 

[Quizzor]

A solution to keep people from stealing valuable pocketable items already exists BTW.

Or simply having them drop from your pocket. This is why I'd take a pandora over a laptop. This is actually possible with the pandora.

...Bikers are more clever than computer nerds? And many many Ipod owners?