First look at the Pwn Pad 3, the latest in mobile security mayhem

Pwnie Express, the company that began as a builder of "drop boxes" for penetration testers and white-hat corporate hackers, has been evolving toward a more full-service security auditing platform vendor over the past few years while continuing to refine its hardware and software in ways that appeal to the corporate security set. Now Pwnie has released the third generation of its flagship mobile penetration testing platform, the Pwn Pad, bringing the Android and Kali Linux-based platform a step further away from the rough-hewn penetration testing tools it began with and into the realm of something with a lot more polish—and performance.

Pwnie Express' Mobile Platform Engineer Tim Mossey and Director of Research and Development Rick Farina recently gave Ars a walk-through of the Pwn Pad 3, which has just begun shipping out to pre-order customers. We expect to do a full review of the Pwn Pad 3 soon but wanted to get an early look at what to expect. The biggest visible change is the hardware itself, as Pwnie has left the relative comfort zone of Google's reference platform Nexus tablets and moved to the more powerful Nvidia Shield. But there are some changes behind the scenes as well that make the Pwn Pad 3 act more like an actual flagship commercial product and less like something way off the corporate reservation.

Full disclosure is in order here—Ars bought hardware from Pwnie Express to support our own security testing lab, and we enlisted help from Pwnie Chief Technology Officer Dave Porcello for our joint project with National Public Radio last year. So we've had a bit of experience with Pwnie's platform in many of its incarnations. We've also worked with a number of open source penetration tools, including the Kali Linux-based NetHunter platform for Android.

First, there's the hardware. The Nvidia Shield is built on a 2.2 GHz ARM-based Cortex A15 CPU with 2 gigabytes of RAM. Compared to the ASUS Nexus 7 2013 that the previous generation of Pwn Pad was built upon—which has a 1.5 GHz Snapdragon S4 Pro processor—that's a significant step up in processing power. At the same time, the Shield has significantly longer battery life than the older Nexus 7 hardware.

As a result, Farina said, "on all the benchmarks we've run, this tablet is more than twice as fast. It's more like what your laptop was like four years ago–it has the horsepower for cracking and decrypting SSL on the fly."

Moving off the Nexus 7 to Nvidia's hardware was a lot more challenging than just recompiling the code, Mossey said, "but man, have we reaped the benefits." The Shield was "uncommonly pleasant" to work with compared to other Android platforms, he added. The choice of the Shield came after Pwnie's team screened dozens of platforms, keeping in mind that they also wanted a hardware platform that would be affordable to users of the open source community edition of Pwn Pad's software. "It's a premium device at a reference platform price, which is sort of a unicorn in this space," Mossey said.

The software updates for Pwn Pad 3 are a bit more subtle, but they're certainly significant. More of the functionality of the underlying Kali Linux build that powers Pwn Pad's auditing and penetration testing tools have been surfaced through scripted Android launchers, making them much easier and faster to use on a tablet and reducing the amount of screen typing in a console window. The hardware support within the software for network devices has been improved as well, allowing for the use of a wider range of USB-based Wi-Fi and wired Ethernet adapters via the Shield's on-the-go (OTG) cable. "We were actually able to bake in support for dozens of wireless chipsets that haven't been supported in the previous versions," Mossey said.

There's also one major improvement to the software functionality of the Pwn Pad with the addition of support for Kali Disk Forensics. Any drive that can be mounted via a USB device based on a range of file systems can be directly connected to the Pwn Pad 3 and accessed by the disk forensics tools built into the underlying Kali Linux platform.

Another change in functionality is the addition of over-the-air updates to the Pwn Pad. In the past, updating the Pwn Pad (or for that matter, any of the Android-based penetration testing suites we've looked at) required a complete re-flashing of the system's image. Now, users can set the device to automatically retrieve over-the-air updates to the software, keeping it current both in terms of Android and Kali updates.

Of course, all this comes with a slightly higher price tag than an off-the-shelf Shield. The fully supported version of the Pwn Pad 3 is $1,095—the original price point of the Pwn Pad 2. For now, you can still get the Nexus 7-based Pwn Pad 2 (now dubbed the Pwn Pad 2014) for $995.

We're looking forward to a full hands-on test of the Pwn Pad 3 in and around the Ars network test lab. Maybe we'll even play a little Doom on it as well when we're done pwning the neighbors' Wi-Fi. (No, we won't be pwning the neighbors' Wi-Fi, at least not without getting permission.)