THE SILENT
HIJACK.
Analysis of Kernel-Level Malware (Magisk / KernelSU). When the execution layer beneath the OS is compromised, the "Brain" of the device becomes the attacker.
// Use Case Analysis
Attackers gain control over the execution layer below the OS by unlocking the bootloader and modifying the kernel image. The banking app and its fraud checks run normally, but the entire system response surface is controlled.
// Foundation
The Silicon Anchor
- Private key burned into silicon (SIK)
- Immutable Boot ROM
- Outside the reach of Malware/Root
Software cannot verify
a compromised Kernel.
RASP solutions (Appdome/Guardsquare) rely on Filesystem visibility and System APIs provided by the Kernel. If the Kernel is already compromised, it intercepts checks:
"Root detection works only if the OS is honest. In kernel compromise, the OS becomes the attacker".
Hardware Attestation.
Chain of Measurements
At boot time, every stage hashes the next. Results are stored in Write-once hardware registers and TEE secure memory. They do not rely on the OS and cannot be intercepted.
The Hardware Witness
PayShield queries the TEE / Secure Enclave directly. It uses a hardware private key to sign the boot state and kernel hash.
Final Verdict.
"Appdome operates inside the system boundary. PayShield verifies outside the system boundary".