This talk follows an investigation of the SONOS One and a Lenovo smart clock to examine ARM secure boot, secure monitor vulnerabilities, and techniques for gaining privileged access. It also explains how extracted OTP secrets can reveal the AES-XTS keys protecting the speaker’s filesystem.