Samsung Knox: History
View Latest Version
Please note this is an old version of this entry, which may differ significantly from the current revision.
Subjects: Others
Contributor:
HandWiki

Samsung Knox is a proprietary security and management framework pre-installed on most Samsung mobile devices. Its primary purpose is to provide organizations with a toolset for managing work devices, such as employee mobile phones or interactive kiosks. Knox provides more granular control over the standard work profile to manage capabilities found only on Samsung devices. Knox's features fall within three categories: data security, device manageability, and VPN capability. Knox also provides web-based services for organizations to manage their devices. Organizations can customize their managed mobile devices by configuring various functions, including pre-loaded applications, settings, boot-up animations, home screens, and lock screens. As of December 2020, organizations can use specific Samsung mobile device cameras as barcode scanners, using Knox services to capture and analyze the data.

  • mobile device
  • mobile devices
  • mobile phones

1. Overview

Samsung Knox provides hardware and software security features that allow business and personal content to coexist on the same device. Knox integrates web services to assist organizations in managing fleets of mobile devices, which allows IT administrators to register new devices, identify a Unified Endpoint Management (UEM) system,[1] define the organizational rules that govern the use of devices, and upgrade device firmware over-the-air.[2] Developers can integrate these features with their applications using Knox SDKs and REST APIs.[3]

1.1. Services

Samsung Knox provides the following web-based services for organizations:

  • To manage mobile devices: Knox Suite, Knox Platform for Enterprise, Knox Mobile Enrollment, Knox Manage, and Knox E-FOTA.[2]
  • To customize and rebrand devices: Knox Configure[4]
  • To capture and analyze data: Knox Capture,[5] Knox Peripheral Management,[6] Knox Asset Intelligence[7]

Most services are registered and accessed through the Samsung Knox web consoles,[8] with some accessed through the Samsung Knox SDK.[9]

Knox Capture

Knox Capture uses a Samsung mobile device’s camera to capture all major barcode symbologies like UPC, Code 39, EAN, and QR. Through a web console, IT admins can manage the input, formatting, and output configuration of scanned barcode data, and associate a device app (for example, an Internet browser for QR data).[10]

Knox Asset Intelligence

Knox Asset Intelligence helps organizations improve the management, productivity, and lifecycle of mobile devices. Through a web console, IT admins can monitor device battery management, app usage insights, comprehensive device tracking, and detailed Wi-Fi analytics.[11]

1.2. Software

Container

When Samsung Knox debuted with the Galaxy S3 in 2013, it included a proprietary container feature that stored security-sensitive applications and data inside a protected execution environment.[12] Device users could switch between personal and business applications by tapping a Knox icon in the lower-left corner of the device screen.[13] The proprietary container, later called the Knox Workspace, was managed by organizations through a UEM system.[14]

Samsung then spun off consumer versions of the container feature, which did not require a UEM system to manage. These consumer versions included Personal Knox, later called My Knox starting in 2014. My Knox was replaced by Secure Folder in 2017.[15]

In 2018, Samsung partnered with Google to use its Android work profile to secure applications and data, and in 2019 deprecated the Knox Workspace container.[16] Samsung continues to pre-install the Secure Folder on most flagship mobile devices, but consumers must enable it for use.[17]

Samsung Real-Time Kernel Protection (RKP)

The Samsung RKP feature tracks kernel changes in real-time and prevents the phone from booting, as well as displaying a warning message about using "Unsecured" Samsung devices.[18] This feature is analogous to Android dm-verity/AVB and requires a signed bootloader.[19]

Security Enhancements for Android (SE for Android)

Although Android phones are already protected from malicious code or exploits by SE for Android and other features, Samsung Knox provides periodic updates that check for patches to further protect the system.[20]

Secure Boot

During Secure Boot, Samsung runs a pre-boot environment to check for a signature match on all operating system (OS) elements before booting in the main kernel. If an unauthorized change is detected, the e-fuse is tripped and the system's status changes from "Official" to "Custom".[21]

Other features

Several other features that facilitate enterprise use are incorporated in Samsung Knox, including Samsung KMS (SKMS) for eSE NFC services, Mobile device management (MDM), Knox Certificate Management (CEP), Single Sign-On (SSO), One Time Password (OTP), SIM PIN Management, Firmware-Over-The-Air (FOTA)[22] and Virtual Private Network (VPN).[23][24][25][26]

Samsung has patched the kernel to prevent root access from being granted to apps even after rooting was successful since the release of Android Oreo. This patch prevents unauthorized apps from changing the system and deters rooting.[27]

1.3. Hardware

Knox includes built-in hardware security features ARM TrustZone (a technology similar to TPM) and a bootloader ROM.[28] Knox Verified Boot monitors and protects the phone during the booting process, along with Knox security built at a hardware level (introduced in Knox 3.3).[29]

e-Fuse

Rooted Samsung Galaxy S10e with tripped e-fuse. https://handwiki.org/wiki/index.php?curid=1247167

Samsung Knox devices use an e-fuse to indicate whether or not an "untrusted" (non-Samsung) boot path has ever been run. The e-fuse will be set if the device boots with a non-Samsung signed bootloader, kernel, kernel initialization script, or data. When set, the text "Set warranty bit: <reason>" appears. Rooting the device or flashing a non-Samsung Android release also sets the e-fuse. Once the e-fuse is set, a device can no longer create a Knox Workspace container or access the data previously stored in an existing Knox Workspace.[30] In the United States, this information may be used by Samsung to deny warranty service to devices that have been modified in this manner.[31] Voiding consumer warranties in this manner may be prohibited by the Magnuson–Moss Warranty Act of 1975, at least in cases where the phone's problem is not directly caused by rooting.[32] In addition to voiding the warranty, tripping the e-fuse also prevents some Samsung-specific apps from running, such as Secure Folder, Samsung Pay, Samsung Health, and Samsung Browser's secret mode. For some older versions of Knox, it may be possible to clear the e-fuse by flashing a custom firmware.[33]

Samsung DeX

Options to manage Samsung DeX were added in Knox 3.3 to allow or restrict access using the Knox platform for added control and security.[34]

Samsung Knox TIMA

Knox's TrustZone-based Integrity Measurement Architecture (TIMA) allows storage of keys in the container for certificate signing using the TrustZone hardware platform.[35]

2. Notable Security Mentions

In June 2014, the Defense Information Systems Agency's (DISA) list of approved products for sensitive but unclassified use included five Samsung devices.[36]

In October 2014, a security researcher discovered that Samsung Knox stores PINs in plain text rather than storing salted and hashed PINs and processing them by obfuscated code.[37]

In October 2014, the U.S National Security Agency (NSA) approved Samsung Galaxy devices for use in a program for quickly deploying commercially available technologies. Approved products include Galaxy S4, Galaxy S5, Galaxy S6, Galaxy S7, Galaxy Note 3, and Galaxy Note 10.1 2014.[36]

In May 2016, Israeli researchers Uri Kanonov and Avishai Wool found three vulnerabilities in specific versions of Knox.[38]

In December 2017, Knox received "strong" ratings in 25 of 28 categories in a Gartner publication comparing device security strength of various platforms.[39]

The content is sourced from: https://handwiki.org/wiki/Software:Samsung_Knox

References

  1. codeproof.com. "Samsung Knox Mobile Enrollment (KME) enrollment". https://www.codeproof.com/integrations/knox-mobile-enrollment/. 
  2. "Knox for Enterprise Mobility" (in en). https://www.samsungknox.com/en/solutions/it-solutions. 
  3. "Knox Developer Documentation". https://docs.samsungknox.com/dev/index.htm. 
  4. "Knox for Device Customization" (in en). https://www.samsungknox.com/en/solutions/device-customization. 
  5. "Knox Capture" (in en). https://www.samsungknox.com/en/solutions/it-solutions/knox-capture. 
  6. "Peripherals Overview" (in en). https://docs.samsungknox.com/dev/knox-sdk/peripherals.htm. 
  7. "Knox Asset Intelligence" (in en). https://www.samsungknox.com/en/solutions/it-solutions/knox-asset-intelligence. 
  8. "Samsung Knox Documentation Ecosystem". https://docs.samsungknox.com/admin/fundamentals/welcome.htm. 
  9. "Samsung Knox Developer Documentation". https://docs.samsungknox.com/dev/knox-sdk/index.htm. 
  10. "Samsung Knox Capture". https://docs.samsungknox.com/admin/knox-capture/welcome.htm. 
  11. "Samsung Knox Asset Intelligence". https://docs.samsungknox.com/admin/knox-asset-intelligence/welcome.htm. 
  12. "New Samsung Galaxy Note 3 software features explained" (in en-US). 2013-09-04. https://www.androidauthority.com/samsung-galaxy-note-3-software-features-explained-261976/. 
  13. Ziegler, Chris (2013-02-25). "Samsung Knox: a work phone inside your personal phone (hands-on)" (in en). https://www.theverge.com/2013/2/25/4027040/samsung-knox-a-work-phone-inside-your-personal-phone-hands-on. 
  14. "Evaluating top MDMs for Android and iOS" (in en). https://searchmobilecomputing.techtarget.com/post/Evaluating-top-MDMs-for-Android-and-iOS. 
  15. "Samsung discontinues My Knox, urges users to switch to Secure Folder" (in en-US). 2017-06-02. https://www.androidauthority.com/samsung-discontinues-knox-switch-secure-folder-777140/. 
  16. "What's new in Knox 3.4?" (in en). https://www.samsungknox.com/en/blog/what-s-new-in-knox-3-4. 
  17. "What is the Secure Folder and how do I use it?" (in en-GB). https://www.samsung.com/uk/support/mobile-devices/what-is-the-secure-folder-and-how-do-i-use-it/. 
  18. "How we cracked Samsung's DoD- and NSA-certified Knox" (in en). ZDNet. https://www.zdnet.com/article/google-project-zero-how-we-cracked-samsungs-dod-and-nsa-certified-knox/. 
  19. "Samsung RKP". https://www.samsungknox.com/en/blog/real-time-kernel-protection-rkp. 
  20. "What is SE for Android? | Samsung Support Philippines" (in en-PH). https://www.samsung.com/ph/support/mobile-devices/what-is-se-for-android/. 
  21. "Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode" (in en). Digital Investigation 24: S60–S67. 2018-03-01. doi:10.1016/j.diin.2018.01.008. ISSN 1742-2876. https://www.sciencedirect.com/science/article/pii/S1742287618300409. 
  22. "Samsung Enterprise Firmware-over-the-air". https://docs.samsungknox.com/admin/efota-common/welcome.htm. 
  23. "Samsung SSO". https://www.samsungknox.com/de/blog/improved-single-sign-on-sso-in-samsung-knox. 
  24. "Samsung CEP". https://docs.samsungknox.com/knox-platform-for-enterprise/admin-guide/certificate-management.htm. 
  25. "Samsung OTP". https://support.samsungknox.com/hc/en-us/articles/115015955587-How-do-I-disable-two-step-authentication-in-Knox-Manage-. 
  26. "Samsung Knox VPN". https://docs.samsungknox.com/whitepapers/knox-platform/virtual-private-networks.htm. 
  27. "Disable DEFEX Security to Root Samsung Galaxy Devices on Oreo". https://www.thecustomdroid.com/disable-defex-security-samsung-galaxy-oreo-root/. 
  28. "Root of Trust | Knox Platform for Enterprise Whitepaper". https://docs.samsungknox.com/whitepapers/knox-platform/hardware-backed-root-of-trust.htm. 
  29. "vTZ: Virtualizing ARM TrustZone". https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-hua.pdf. 
  30. Ning, Peng (2013-12-04). "About CF-Auto-Root". https://www.samsungknox.com/en/blog/about-cf-auto-root. "The sole purpose of this fuse-burning action is to memorize that a kernel or critical initialization scripts or data that is not under Samsung's control has been put on the device. Once the e-fuse bit is burned, a Samsung KNOX-enabled device can no longer create a KNOX Container or access the data previously stored in an existing KNOX Container." 
  31. "Just how does Knox warranty void efuse burning work?" (in en-US). https://forum.xda-developers.com/t/just-how-does-knox-warranty-void-efuse-burning-work.3407518/. 
  32. Koebler, Jason (2016-08-17). "Companies Can't Legally Void the Warranty for Jailbreaking or Rooting Your Phone". Motherboard. https://motherboard.vice.com/en_us/article/yp3nax/jailbreaking-iphone-rooting-android-does-not-void-warranty. 
  33. "Disable Knox on Samsung Galaxy Devices [4 Ways | Android More"] (in en-US). https://androidmore.com/disable-samsung-knox/. 
  34. "Samsung DeX | Apps & Services | Samsung IN" (in en-IN). https://www.samsung.com/in/apps/samsung-dex/. 
  35. "Samsung TIMA Keystores". https://docs.samsungknox.com/dev/knox-sdk/about-keystores.htm. 
  36. Ribeiro, John (2014-10-21). "NSA approves Samsung Knox devices for government use". PCWorld. http://www.pcworld.com/article/2836612/samsung-knox-devices-approved-for-government-use-by-nsa.html. 
  37. Mimoso, Michael (2014-10-24). "NSA-Approved Samsung Knox Stores PIN in Cleartext". Threatpost. https://threatpost.com/nsa-approved-samsung-knox-stores-pin-in-cleartext/109018/. 
  38. Forrest, Conner (2016-05-31). "Samsung Knox isn't as secure as you think it is". TechRepublic. https://www.techrepublic.com/article/samsung-knox-isnt-as-secure-as-you-think-it-is/. 
  39. "Introduction | Knox Platform for Enterprise Whitepaper". https://docs.samsungknox.com/whitepapers/knox-platform/samsung-knox.htm. 
More
©Text is available under the terms and conditions of the Creative Commons-Attribution ShareAlike (CC BY-SA) license; additional terms may apply. By using this site, you agree to the Terms and Conditions and Privacy Policy.
This entry is offline, you can click here to edit this entry!
ScholarVision Creations
Feedback