Pandora-Box is back — let's build it together

[dbarzin]

Hi everyone,

Thank you to everyone who has used, tested, forked or reported issues on Pandora-Box over the years. The project has reached a turning point, and I'd like to share where it is heading and get your input before the first lines of new code are written.

Why a rewrite?

Pandora-Box relied on Pandora from CIRCL for its analysis, and on engines such as Comodo that are no longer maintained on Linux. The Raspberry Pi target also turned out to be too slow for real-world devices. Rather than patching these limits, I decided to restart on a clean base.

The name stays, but the next version of Pandora-Box will have no dependency on Pandora. The goal remains the same: a USB decontamination kiosk ("sheep-dip station") that is free, auditable and hardened, and a credible alternative to commercial solutions for sensitive environments such as healthcare, industry and public administration.

What stays, what changes

Kept and refactored from the current version: the state machine, USB detection with pyudev, mounting (now strictly read-only), quarantine, the curses admin mode, logging (moving to structured JSON) and the systemd service.

New:

• 🔌 Plugin-based scanning pipeline: ClamAV, YARA-X (YARA Forge + signature-base), MalwareBazaar hashes, and CIRCL Hashlookup as an offline Bloom filter to skip known-good files
• 🛡️ Minimal hardened image (Debian 13, built with mkosi): read-only root, dm-verity, Secure Boot with UKI, A/B updates, USBGuard against BadUSB, each analyzer sandboxed with bubblewrap
• 📴 Offline by default, with signed signature updates (online through an allowlisted channel, or from a signed USB device for air-gapped kiosks)
• 🖥️ Reference hardware: refurbished Lenovo ThinkCentre (x86_64) + 7" touchscreen + 3D-printed enclosure, published as open hardware
• 📄 Advanced analysis (later phases): oletools, pdfid, controlled archive extraction, capa, and content disarm and reconstruction with Dangerzone
• 📊 Fleet management: SIEM export, scan receipts, optional central server, Mercator integration
• ✅ Assurance: threat model, fuzzing, external audit, mapping to NIS2 and ISO 27001 (control 7.10)

Pandora-Box will be distributed only as a complete hardened image, not as a package for an existing system. The full roadmap is in ROADMAP.md.

Where I need your input

1. "Suspicious" verdict: should the default policy block the device or only warn the user?
2. Hardware: which ThinkCentre models (or other small form factor PCs) do you already use or have in stock? Which 7" touchscreens have worked well for you under Linux?
3. Engines: are there detection engines or rule sets you would like to see as plugins?
4. Your context: where do you deploy (or plan to deploy) a USB kiosk, and what is missing from the solutions you use today?
5. Languages: the interface will ship in FR, EN, DE and NL. Who would like to help with other translations?

How to get involved

• 💬 Reply to this discussion with your feedback, use cases and ideas
• 🐛 Open issues on this repository
• 🧑‍💻 Contributions are welcome on the scanning engine, image hardening, the kiosk interface, the enclosure design and documentation

Looking forward to building this with you.