# Analysis of Tizen Security Model and Ways of Bypassing It on Smart TV Platform
## 5 Example of Attack Scenario
### Kernel Level Exploitation
#### 5.2.5 Disabling Tizen OS Security Features  
To get full advantage of gained root access, we have to solve the problem of Tizen OS security mechanisms. Some of them we decided only to bypass, but others we wanted to be completely disabled (Figure 4). As DEP is only an issue during the exploitation and does not pose any serious restrictions after obtaining root, we only bypassed it temporarily (Section 5.1.1). SFD restricts filesystem as well as network access (Section 3). Final decision whether specific activity should be blocked or not is made in SfdPerformBlocking([[https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/dispatcher/SfdDispa](https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/dispatcher/SfdDispa)]([https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/dispatcher/SfdDispa](https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/dispatcher/SfdDispa)) tcher.c, accessed on 15 December 2021) function. Therefore, we decided to disable SFD (Figure 4) by patching this function (Listing 13) so it always returns SF_STATUS_OK (0) and as a result forcing SFD to allow all possible actions. UEP blocks all executables, libraries, and kernel modules that do not have a valid signature (Section 3). Since processes are validated on launch, the only way of bypass  
Figure 4: A simplified Tizen OS security model that illustrates bypassed (yellow) and completely disabled (red) security mechanisms  
ing is to load additional code using some vulnerability of already running process (Section 5.1). Final decision on whether specific action should be blocked is made in SfdUepPacketHandler ([[https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/uep/SfdUepHookHandlers.c](https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/uep/SfdUepHookHandlers.c)]([https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/uep/SfdUepHookHandlers.c](https://github.com/mmajchr/SamsungKernelSecurity/blob/main/sfd/uep/SfdUepHookHandlers.c)), accessed on 15 December 2021) function. UEP uses s_uepStatus global variable as a kind of flag which indicates whether framework is active or not. Therefore, we decided to completely disable it (Figure 4) by finding UEP location in the kernel memory and changing s_uepStatus flag to 0 (Listing 13). * SMACK restricts a lot of filesystem and memory operations (Section 3) based on specific rules (over 15,000 on smart TV). Internally, SMACK uses similar approach as SELinux framework ([[https://www.kernel.org/doc/html/v4.13/admin-guide/LSM/SELinux.html](https://www.kernel.org/doc/html/v4.13/admin-guide/LSM/SELinux.html)]([https://www.kernel.org/doc/html/v4.13/admin-guide/LSM/SELinux.html](https://www.kernel.org/doc/html/v4.13/admin-guide/LSM/SELinux.html)), accessed on 15 December 2021). When performing different tasks kernel checks security_operations ([[https://elixir.bootlin.com/linux/v4.1/so](https://elixir.bootlin.com/linux/v4.1/so)]([https://elixir.bootlin.com/linux/v4.1/so](https://elixir.bootlin.com/linux/v4.1/so)) urce/include/linux/security.h#L1460, accessed on 15 December 2021) structure. If the framework is enabled, specific hooks are executed before kernel original functionality to check whether the specific operation is allowed.