Overview of PandoraBox

PandoraBox is a free tool designed to clean USB drives of potentially harmful files before they are used on secure systems. It functions as a kiosk, allowing users to insert a USB drive, review flagged files, and remove them if necessary.

New version details

The latest version of PandoraBox is a complete rewrite, no longer relying on the Pandora project from CIRCL. It is now built as a hardened system image based on Debian 13, with its code licensed under GPL-3.0 and its 3D-printable case licensed under CERN-OHL-S v2.

Detection and interface improvements

The kiosk uses multiple detection engines to identify dangerous files and displays them on a touchscreen for user confirmation before deletion. It replaces the old pypandora system with a more integrated detection chain, removes outdated components, and replaces its image slideshow with a real graphical interface.

Security and analysis features

PandoraBox uses detection tools such as MalwareBazaar, ClamAV, and YARA-X, and includes heuristics for identifying malicious files disguised as documents. It operates in a "fail closed" mode, meaning it will not mark a file as safe if it cannot fully analyze it. Each partition of the USB drive is checked, and an unreadable partition will cause the drive to be marked as unverified.

Hardened system design

The system image is built using mkosi from Debian 13 and includes only essential components for analysis. It features a secure boot chain, filtered USB devices, no user session, sandboxed detection engines, and firewall and kernel settings aligned with ANSSI guidelines. The graphical interface is rendered directly in the framebuffer without needing a display server or browser.

Operation and update capabilities

PandoraBox operates offline by default, with all updates arriving signed to ensure security. It supports A/B updates via USB or online, and logs can be retrieved without a user session. An online version can send logs to a security information and event management (SIEM) system using standard protocols.

Hardware and development status

The reference kiosk uses a refurbished Lenovo ThinkCentre M720q Tiny with a 7-inch Waveshare touchscreen, and the system image works on any x86_64 UEFI computer with at least 2 GB of memory. The desktop case is 3D printed in one piece. The project is actively under development, with core features working as intended and future updates planned.

Community and future goals

The project is open for community contributions, including testing on different hardware, improving detection rules, translating the interface, and conducting security reviews. Vulnerabilities are reported through a defined security policy. The project is hosted on GitHub, with documentation, a roadmap, and an installation guide available for users.