# Analysis of Tizen Security Model and Ways of Bypassing It on Smart TV Platform
## 7 Legality and Ethics of Conducted Research  
An essential part of our research was performing a comprehensive analysis of security mechanisms present in the smart TV variant of Tizen OS and finding a way to disable them completely. As a result, the topic of legality and ethics of our research might be a concern. Firstly, it is important to note that both under US [54] and EU [55] law modification of devices owned by the users is completely legal. Moreover, breaking or bypassing security mechanisms is the only way to test them [56] and check how secure they really are. It is important to remember that \"assessing the security state is a continuous and necessary task to understand the risks there exist. This assessment is usually performed through security tests\" [57]. It always comes to a simple rule: the chain is as strong as its weakest link [58]. Of course, after finding flaws, it is important to follow the procedure commonly known as \"responsible disclosure\" [59; 60; 61]. In short terms, the procedure states that no information regarding a security flaw should be published before respective vendors were informed and fix or patch released. Usually, it is common to wait around 90 days after such release. The flaws we describe in this paper relate to TV series released almost 7 years ago, though we were able to identify similar issues in models released in recent years. Therefore, we describe them only to illustrate the problem and highlight the importance of not relying on security mechanisms as a way of \"blocking\" security threats. Every day new vulnerabilities are found, and sooner or later, some of them will affect smart TVs. As a result, it is crucial to take into consideration that they can be used to disable any security mechanisms completely. Therefore, people should focus on keeping their devices up to date and vendors on providing patches to security issues regularly and provide longer support. In our research, we used two specific publicly known and (relatively) old vulnerabilities (CVE-2014-1303 and CVE-2015-1805) to illustrate the issue. As a result, those specific flaws serve only demonstrative purposes and do not pose a severe risk to the user. At the same time, as it is pretty common for people to use TVs for 10 or more years, sometimes not updating their firmwares at all, we will not present details about our recent findings as it might endanger users. Therefore, through this publication, we hope to raise awareness about security issues in modern smart TVs and hopefully increase the percentage of people who regularly update their firmware.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Method**Security** & **Acquired Access Level** & **DEP User Level** & **DEP Kernel Level** & **SFD** & **UEP** & **SMACK** \\ \hline Using Native Application SDK [23] & User & **Bypassed** & Active & Active & Active & Active \\ \hline Exploitation of Tizen OS specific vulnerabilities [25] & User & **Bypassed** & Active & Active & **Bypassed** & Active \\ \hline Abuse of Tizen API [26] & User & Active & Active & Active & Active & Active \\ \hline General security issues [22; 24; 27] & User & Active & Active & Active & Active & Active \\ \hline
**Developed methods** & **Root \& Kernel** & **Bypassed** & **Bypassed** & **Disabled** & **Disabled** & **Disabled** \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of other works with developed methods. Bold font illustrates preferable result.