Bypassing a key switch
Reid Wightman presented a method to bypass SIS key switches at the S4 conference (https://s4xevents.com/). He showed how a malicious attacker could bypass the physical key switch lockout by gaining physical access to the SIS, reprogramming the main processor to bypass the locking mechanism, and then using the debug interface to take control of the system without requiring the use of the key switch.
The first step is to gain physical access to the SIS. Once access is obtained, a specialized debug cable is connected to the main processor on the SIS. This gives the malicious attacker access to the processor and enables them to read and write memory, as well as control any underlying processors on the SIS. The attacker then needs to reprogram and bypass the physical key switch lockout mechanism. This step is accomplished by writing a new operation code that allows the attacker to take control of the system without the use of the physical key.
The next step...
