Characterizing Vulnerabilities in Platform Security