ITSEC Newsletter 2024-09-05

In Part 1 we’ve seen how to create a new kernel object type. The natural next step is to implement some functionality associated with the new object type. Before we dive into that, let’s take a broader view of what we’re trying to do. For comparison purposes, we can take an existing kernel object type, such as a Semaphore or a Section, or any other object type, look at how it’s “invoked” to get an idea of what we need to do.

In this post, we will look at physical attacks that could be used to compromise these boxes. These attacks could be used by malicious actors to either infect boxes they find in the wild or perform a low-cost, low-effort supply chain attack by drop-shipping them. We mostly focus on the SD card slot on the T95 but the same primitives can be ported to other boxes relatively easily.

The first argument of a program’s command line, typically reflecting the program’s name/path and often referred to as argv[0], can in most cases be set to an arbitrary value without affecting the process’ flow. Making the case against argv[0], this post demonstrates how it can be used to deceive security analysts, bypass detections and break defensive software, across all main operating systems.