# Analysis of Tizen Security Model and Ways of Bypassing It on Smart TV Platform
## 3 Tizen Security Model  
Though the security system used on Tizen platform is pretty complex, it can be quite accurately represented using simple model (Figure 3), as it is pretty similar to what is being used on other platforms, such as iOS [41], Android [42], PS4 [43], or Vita [44]. In the beginning, read-only BootRom validates Bootloader, and if all checks are passed correctly, execution is moved to it. One of Bootloader's main tasks is the validation of kernel, and here, the same scenario applies. Once the kernel boots, it validates the checksums of partitions to ensure system integrity. However, the system requires some place for storing user applications and data. Therefore, it is necessary to have some writable partitions so their checksums are not validated. To ensure the integrity of the trust chain [45], all libraries and binaries loaded from those partitions are passed through Unauthorized Execution Prevention (UEP), which is part of the Security Framework Filter Driver (SFD), and their checksums are validated. As a result, it looks that there is no entry point. However, if we look closely, we can notice that users can install some web-based applications, and this trust chain (as many others) suffers from one flaw. All signatures are checked before loading data and execution of code, meaning that if we cause an error in an application that is already running, we can move execution to any code we want, and no signature checks will be applied. Besides using chain of trust [45] Tizen OS on smart TVs offers many different security mechanisms, the most important are:  
* Data Execution Prevention (DEP) [46] is a security mechanism that disallows direct execution of data. In the 90s and early 2000s, data were often marked as read, write, and execute--RWX ([[https://kc.mcafee.com/corporate/index?page=content&id=KB](https://kc.mcafee.com/corporate/index?page=content&id=KB)]([https://kc.mcafee.com/corporate/index?page=content&id=KB](https://kc.mcafee.com/corporate/index?page=content&id=KB)) 58554, accessed on 15 December 2021) which made exploitation of such systems very easy. Nowadays on Linux systems, memory for data is mapped as PROT_READ! PROT_WRITE--RWY ([[https://man7.org/linux/man-pages/man2/mmap.2.html](https://man7.org/linux/man-pages/man2/mmap.2.html)]([https://man7.org/linux/man-pages/man2/mmap.2.html](https://man7.org/linux/man-pages/man2/mmap.2.html)), accessed on 15 December 2021) and does not have PROT_EXEC--(X) permissions. The same principle is implemented on Tizen OS, making it necessary to bypass DEP for successful exploitation. * Security Framework (SF) Filter Driver (D) is a security layer used on Samsung smart TV with Tizen OS, which besides blocking certain file system access (verified by UEP), also filters network activity. It can filter both inbound and outbound traffic using both TCP and UDP protocols ([[https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/dispatcher/SfFirewallRulesList.c](https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/dispatcher/SfFirewallRulesList.c)]([https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/dispatcher/SfFirewallRulesList.c](https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/dispatcher/SfFirewallRulesList.c)), accessed on 15 December 2021). Network requests can be blocked based on IP, network mask, port, and subnetwork (remote or local).