USB - Sourcentishttps://www.sourcentis.com/en/tags/usb/Sourcentis - Des solutions Open Source innovantes !Hugo -- 0.168.0enFri, 16 Oct 2026 00:00:00 +0000Pandora-Box is backhttps://www.sourcentis.com/en/blog/20261016-pandora-box/Fri, 16 Oct 2026 00:00:00 +0000https://www.sourcentis.com/en/blog/20261016-pandora-box/Pandora-Box, our open-source USB decontamination kiosk, is being rebuilt on an entirely new foundation. We are opening a discussion to build it together.We are happy to announce the return of Pandora-Box, our USB decontamination kiosk. The project is restarting on an entirely new foundation, and we want to hear from you before the first lines of new code are written.

Why a rewrite?

Pandora-Box relied on Pandora from CIRCL for file analysis, and on engines such as Comodo that are no longer maintained on Linux. The Raspberry Pi target also turned out to be too slow for real-world devices. Rather than patching around these limits, we decided to restart on a clean base.

The name stays, but the next version of Pandora-Box will have no dependency on Pandora. The goal remains the same: a USB decontamination kiosk (“sheep-dip station”) that is free, auditable and hardened, and a credible alternative to commercial solutions for sensitive environments such as healthcare, industry and public administration.

What stays, what changes

Kept and refactored: the state machine, USB detection with pyudev, mounting (now strictly read-only), quarantine, the curses admin mode, logging (moving to structured JSON) and the systemd service.

What’s new:

  • 🔌 Plugin-based scanning pipeline: ClamAV, YARA-X (YARA Forge + signature-base), MalwareBazaar hashes, and CIRCL Hashlookup as an offline Bloom filter to skip known-good files
  • 🛡️ Minimal hardened image (Debian 13, built with mkosi): read-only root, dm-verity, Secure Boot with UKI, A/B updates, USBGuard against BadUSB, each analyzer sandboxed with bubblewrap
  • 📴 Offline by default, with signed signature updates (online through an allowlisted channel, or from a signed USB device for air-gapped kiosks)
  • 🖥️ Reference hardware: refurbished Lenovo ThinkCentre (x86_64), 7" touchscreen and 3D-printed enclosure, published as open hardware
  • 📄 Advanced analysis (later phases): oletools, pdfid, controlled archive extraction, capa, and content disarm and reconstruction with Dangerzone
  • 📊 Fleet management: SIEM export, scan receipts, optional central server, integration with Mercator
  • ✅ Assurance: threat model, fuzzing, external audit, mapping to NIS2 and ISO 27001 (control 7.10)

Pandora-Box will be distributed only as a complete hardened image, not as a package for an existing system. The full roadmap is available in ROADMAP.md.

We need your input

To guide the design choices, we would like your feedback on a few questions:

  1. “Suspicious” verdict: should the default policy block the device or only warn the user?
  2. Hardware: which ThinkCentre models (or other small form factor PCs) do you already use or have in stock? Which 7" touchscreens have worked well for you under Linux?
  3. Engines: are there detection engines or rule sets you would like to see as plugins?
  4. Your context: where do you deploy (or plan to deploy) a USB kiosk, and what is missing from the solutions you use today?
  5. Languages: the interface will ship in French, English, German and Dutch. Who would like to help with other translations?

How to get involved

  • 💬 Reply to the GitHub discussion with your feedback, use cases and ideas
  • 🐛 Open issues on the project repository
  • 🧑‍💻 Contributions are welcome on the scanning engine, image hardening, the kiosk interface, the enclosure design and documentation

Planning to deploy a USB kiosk in your organization? Contact us — we would be glad to discuss your needs.

]]>