Let's say I create a device which has an embedded Linux box in it (for example, a Raspberry Pi). After booting up, it starts the main application which is designed to provide the UI for the device.

The simplest way to produce more of them, is just to set up everything on one specific device, set the users, privileges, configure the booting process, install my software, and then create an image of the SD card. Installing that image to other SD cards gets me identical clones of the original device, which I can now ship.

However, this can lead to a serious vulnerability. As all the users will have exactly the same root password, all it takes is one user figuring it out (having access to the physical devices counts, as far as I know, for completely compromised security), and that one user might then use this knowledge to compromise the devices of other users (the device is expected to be used while connected to a network)

How can one mitigate this risk?

The software also needs to know the root password (as it needs to configure some hardware registers for the peripherals), so does this mean I have to compile the executable for each of the physical devices separately with separate root passwords, and create the users on each device separately, then manage to copy the correct software to the correct machine? This seems like a management nightmare.

I interpret your question as:


  What's the motivation for someone to use an alien Facebook account to play poker and stock it with chips?


It's not that strange if you think about it this way:

As poker is a game where knowledge about the dealt cards gives you a significant edge in the game, you'd like to use sock puppets at a table to know more about the card distribution.

Thus, using sock puppets that are valid, active - real - Facebook accounts are the only way to gather more information without being spotted easily by heuristics.

Düsseldorf is where one of the big data centers in Germany is located, so there is a good chance that session was held by a bot on a server, not a real person.

Using two or three such bots on a table that are connected gives them a significant statistical edge to beat the other - real - players.

This (collusion) is probably illegal in most poker games and thus real accounts are used to make detection hard. Also, that's probably not the attacker's real name, their mail address and/or PayPal account.

It is probably the account of another victim of identity theft.

In the light of the other answer, I assume that Facebook handles the legal things when you marked the activities as fraudulent.


Update for modified question:

As there seems to be no real money gains involved in this poker game instance, there is another valid reason to use your mom's account:

Because it offers anonymity. If the stolen PayPal account owner tracks the usage down, it'll be your mom as a suspect, not the actual hacker.

Using real, alien Facebook accounts offers another layer of protection with respect to law enforcement.



There still remains the question of how the account was taken over. There are questions here that might answer that.

If your mom does do password reuse, you might educate her about the implications and urge her to change all passwords and use different, strong ones for all accounts.

This would be a good time to introduce her to the famous xkcd about diceware and/or a password manager, as David suggested in the comments.

Also, as S.L. Barth suggests in the comments, using two-factor authentication wherever possible is a good call in any case.
