NL 2025: Glitching Google's TV Streamer From Adb To Root

### Overview

Nick Tmers from Railize presents a fault injection attack on Google's TV Streamer, demonstrating how electromagnetic glitches can corrupt CPU instructions to bypass kernel security checks and escalate privileges from an unprivileged ADB shell to root. Despite achieving a root shell, the attack is ultimately limited by SELinux enforcement.

### Key Topics

**Reconnaissance & Access** - Google TV Streamer uses a quad-core ARM CPU at 1.8 GHz with DDR memory, eMMC storage, and external Wi-Fi/Ethernet chips - Security posture similar to Pixel 9: secure boot, Android kernel hardening, and trusted execution environment (but no external Titan security chip) - ADB debugging enabled via developer options; custom unprivileged code executable via Android Studio - Firmware downloads obtained by interfacing with Google's OTA servers, yielding unencrypted boot and system partitions - Kernel source and debug symbols publicly available from Google, including generic kernel image (GKI) with matching SHA-1 hash

**Fault Injection Setup** - Electromagnetic fault injection (EMFI) technique using a Keysite glitch device to generate high-current pulses through a coil - Setup: XYZ stage for probe positioning, USB control for power cycling resets, minimal wiring - Target: corrupting CPU instructions during execution to bypass software security models

**Characterization Phase** - Two-phase scanning of chip surface: coarse scan (10 power levels across 20×20 grid, ~40 minutes) identifies responsive locations; fine-grained scan targets those locations - Custom test code runs in user-space loop, incrementing counter to 10,000; altered counter values written to disk indicate successful faults - Fault models observed: instruction skipping, instruction corruption (changing operands or entire instruction), bit flips in instruction encoding - Different sensitive locations per CPU core (quad-core dependency confirms CPU targeting)

**Privilege Escalation Attack** - Target: setuid syscall's capability check for CAP_SETUID, which blocks unprivileged processes from changing UID to root - Attack code continuously issues setuid(0,0,0) syscalls; glitch injection bypasses kernel capability check at random power levels - Success indicated by process spawning root-owned Telnetd; attacker connects via Telnet for root shell - Attack timeline: minutes to ~1 hour execution time despite Android boot overhead

**Results & Limitations** - Successfully achieved root shell access with `id` command confirmation - SELinux still enforced; cannot read /proc/kmem or flash memory (LSM hooks intact) - Ability to read /proc/syslog by bypassing its permission checks suggests other syscall attacks possible - Full device compromise not achieved; boot-level attacks identified as more powerful alternative

### Technical Details

- **Instruction Corruption Example**: Single bit flip in ARM64 instruction encoding (e.g., `0x21` → `0x20`) changes instruction semantics (operand or operation type) - **Fault Parameters**: Power/current magnitude drives EM field strength; precise timing and location required for reproducibility - **Kernel Protection Layers**: Capability checks, SELinux hooks, and Linux Security Modules; fault injection circumvents capability checks but not SELinux - **Device Reset**: USB power cycling used for state recovery after error conditions

### Takeaways

- Google TV Streamer's CPU vulnerable to EM fault injection despite >1 GHz clock speeds - Runtime privilege escalation via fault injection feasible on Android with ≤1 hour attack windows - Software security architectures fail when executing on hardware lacking fault injection countermeasures - SELinux provides secondary defense that withstood tested attack; full compromise likely requires kernel exploitation or alternative attack vectors - Google and MediaTek acknowledged vulnerability as inherent to platform; not device-specific - Boot-time attacks likely more efficient than runtime attacks for full compromise - Demo available at Keysite booth showing live exploitation on unmodified Google TV Streamer running latest firmware