Samsung Knox
Samsung Group | |
Initial release | March 2013 |
---|---|
Stable release | 3.10
/ 29 October 2023[1] |
Operating system | Android and Tizen |
Website | www |
Samsung Knox (stylized as SΛMSUNG Knox) is a proprietary security and management framework pre-installed on most Samsung mobile devices. Its primary purpose is to provide organizations with a toolset for managing work devices, such as employee mobile phones or interactive kiosks.[2] Samsung Galaxy hardware, as well as software such as Secure Folder and Samsung Wallet, make use of the Knox framework.[3][4]
Knox's features fall within three categories: data security, device manageability, and
Knox provides more granular control over the standard work profile to manage capabilities found only on Samsung devices.
Overview
Samsung Knox provides hardware and software security features that allow business and personal content to coexist on the same device. Knox integrates web services to assist organizations in managing fleets of mobile devices, which allows
Services
Samsung Knox provides the following web-based services for organizations:
- To manage mobile devices: Knox Suite, Knox Platform for Enterprise, Knox Mobile Enrollment, Knox Manage, and Knox E-FOTA.[9]
- To customize and rebrand devices: Knox Configure[11]
- To capture and analyze data: Knox Capture,[12] Knox Peripheral Management,[13] Knox Asset Intelligence[14]
Most services are registered and accessed through the Samsung Knox web consoles,[15] with some accessed through the Samsung Knox SDK.[16]
Knox Capture
Knox Capture uses a Samsung mobile device’s camera to capture all major barcode symbologies like UPC, Code 39, EAN, and QR. Through a web console, IT admins can manage the input, formatting, and output configuration of scanned barcode data, and associate a device app (for example, an Internet browser for QR data).[17]
Knox Asset Intelligence
Knox Asset Intelligence helps organizations improve the management, productivity, and lifecycle of mobile devices. Through a web console, IT admins can monitor device battery management, app usage insights, comprehensive device tracking, and detailed Wi-Fi analytics.[18]
Software
Container
When Samsung Knox debuted with the Galaxy Note 3 in 2013, it included a proprietary container feature that stored security-sensitive applications and data inside a protected execution environment.[19] Device users could switch between personal and business applications by tapping a Knox icon in the lower-left corner of the device screen.[20] The proprietary container, later called the Knox Workspace, was managed by organizations through a UEM system.[21]
Samsung then spun off consumer versions of the container feature, which did not require a UEM system to manage. These consumer versions included Personal Knox, later called My Knox starting in 2014. My Knox was replaced by Secure Folder in 2017.[22]
In 2018, Samsung partnered with Google to use its Android work profile to secure applications and data, and in 2019 deprecated the Knox Workspace container.[23] Samsung continues to pre-install the Secure Folder on most flagship mobile devices, but consumers must enable it for use.[24]
Samsung Real-Time Kernel Protection (RKP)
The Samsung RKP feature tracks
Security Enhancements for Android (SE for Android)
Although Android phones are already protected from malicious code or exploits by SE for Android and other features, Samsung Knox provides periodic updates that check for patches to further protect the system.[27]
Secure Boot
During Secure Boot, Samsung runs a pre-boot environment to check for a signature match on all
Other features
Several other features that facilitate enterprise use are incorporated in Samsung Knox, including Samsung KMS (SKMS) for eSE NFC services,
Samsung has patched the kernel to prevent root access from being granted to apps even after rooting was successful since the release of Android Oreo. This patch prevents unauthorized apps from changing the system and deters rooting.[34]
Hardware
Knox includes built-in hardware security features
e-Fuse
Samsung Knox devices use an
- The device boots with a non-Samsung signed bootloader, kernel, kernel initialization script, or data.
- The device is rooted.
- Custom firmware is detected on the device (such as non-Samsung Android releases).
On Galaxy Book devices starting with the Galaxy Book 4, upgrading from one Windows version to another (from 22H2 to 23H2) will not set the e-Fuse, but upgrading to a higher edition (from Home to Pro) will.
When set, the text "Set warranty bit: <reason>" appears. Once the e-fuse is set, a device can no longer create a Knox Workspace container or access the data previously stored in an existing Knox Workspace.
Samsung DeX
Options to manage Samsung DeX were added in Knox 3.3 to allow or restrict access using the Knox platform for added control and security.[41]
Samsung Knox TIMA
Knox's TrustZone-based Integrity Measurement Architecture (TIMA) allows storage of keys in the container for
Notable security mentions
In June 2014, the Defense Information Systems Agency's (DISA) list of approved products for sensitive but unclassified use included five Samsung devices.[43]
In October 2014, a security researcher discovered that Samsung Knox stores PINs in plain text rather than storing salted and hashed PINs and processing them by obfuscated code.[44]
In October 2014, the
In May 2016, Israeli researchers Uri Kanonov and Avishai Wool found three vulnerabilities in specific versions of Knox.[45]
In December 2017, Knox received "strong" ratings in 25 of 28 categories in a Gartner publication comparing device security strength of various platforms.[46]
See also
References
- ^ "What's new in Knox 3.9". Samsung Knox Team. 23 November 2022. Retrieved 23 November 2022.
- ^ "Secure mobile platform and solutions". Samsung Knox. January 15, 2021. Archived from the original on December 23, 2020. Retrieved January 15, 2021.
- ^ "Samsung Wallet | Apps". The Official Samsung Galaxy Site. Retrieved 2023-10-04.
- ^ "Secure Folder". Samsung Knox. Retrieved 2023-10-04.
- ^ "Samsung Knox Feature Summary". docs.samsungknox.com. Retrieved 2021-01-06.
- ^ "8 Steps to Customizing Mobile Devices With Knox Configure". Samsung Business Insights. 2020-01-07. Retrieved 2021-01-06.
- ^ "App Container | Knox Platform for Enterprise White Paper". docs.samsungknox.com. Retrieved 2021-01-07.
- ^ Miller, Matthew. "Samsung Galaxy XCover Pro: Microsoft Teams Walkie Talkie experiences and Knox Capture release". ZDNet. Retrieved 2021-01-06.
- ^ a b "Knox for Enterprise Mobility". Samsung Knox. Retrieved 2021-01-06.
- ^ "Knox Developer Documentation". docs.samsungknox.com. Retrieved 2021-01-06.
- ^ "Knox for Device Customization". Samsung Knox. Retrieved 2021-01-06.
- ^ "Knox Capture". Samsung Knox. Retrieved 2021-01-06.
- ^ "Peripherals Overview". Samsung Knox. Retrieved 2021-06-28.
- ^ "Knox Asset Intelligence". Samsung Knox. Retrieved 2021-06-28.
- ^ "Samsung Knox Documentation Ecosystem". docs.samsungknox.com. Retrieved 2021-01-06.
- ^ "Samsung Knox Developer Documentation". docs.samsungknox.com. Retrieved 2021-06-28.
- ^ "Samsung Knox Capture". docs.samsungknox.com. Retrieved 2021-06-28.
- ^ "Samsung Knox Asset Intelligence". docs.samsungknox.com. Retrieved 2021-06-28.
- ^ "New Samsung Galaxy Note 3 software features explained". Android Authority. 2013-09-04. Archived from the original on 2021-01-09. Retrieved 2021-01-07.
- ^ Ziegler, Chris (2013-02-25). "Samsung Knox: a work phone inside your personal phone (hands-on)". The Verge. Retrieved 2021-01-07.
- ^ "Evaluating top MDMs for Android and iOS". SearchMobileComputing. Retrieved 2021-01-07.
- ^ "Samsung discontinues My Knox, urges users to switch to Secure Folder". Android Authority. 2017-06-02. Retrieved 2021-01-07.
- ^ "What's new in Knox 3.4?". Samsung Knox. Retrieved 2021-01-07.
- ^ "What is the Secure Folder and how do I use it?". Samsung uk. Retrieved 2021-01-07.
- ^ "How we cracked Samsung's DoD- and NSA-certified Knox". ZDNet.
- ^ "Samsung RKP".
- ^ "What is SE for Android? | Samsung Support Philippines". Samsung ph. Retrieved 2021-01-04.
- ISSN 1742-2876.
- ^ "Samsung Enterprise Firmware-over-the-air".
- ^ "Samsung SSO".
- ^ "Samsung CEP".
- ^ "Samsung OTP".
- ^ "Samsung Knox VPN".
- ^ "Disable DEFEX Security to Root Samsung Galaxy Devices on Oreo". 13 October 2018.
- ^ "Root of Trust | Knox Platform for Enterprise Whitepaper". docs.samsungknox.com. Retrieved 2018-11-13.
- ^ "vTZ: Virtualizing ARM TrustZone" (PDF).
- ^ Ning, Peng (2013-12-04). "About CF-Auto-Root". Samsung. Archived from the original on 2015-09-05.
The sole purpose of this fuse-burning action is to memorize that a kernel or critical initialization scripts or data that is not under Samsung's control has been put on the device. Once the e-fuse bit is burned, a Samsung KNOX-enabled device can no longer create a KNOX Container or access the data previously stored in an existing KNOX Container.
- ^ "Just how does Knox warranty void efuse burning work?". XDA Developers Forums. 28 June 2016. Retrieved 2021-01-05.
- ^ Koebler, Jason (2016-08-17). "Companies Can't Legally Void the Warranty for Jailbreaking or Rooting Your Phone". Motherboard. Retrieved 2018-10-27.
- ^ "Disable Knox on Samsung Galaxy Devices [4 Ways] | Android More". AndroidMore. Archived from the original on 2021-01-05. Retrieved 2020-12-14.
- ^ "Samsung DeX | Apps & Services | Samsung IN". Samsung India. Retrieved 2021-01-04.
- ^ "Samsung TIMA Keystores".
- ^ a b Ribeiro, John (2014-10-21). "NSA approves Samsung Knox devices for government use". PCWorld. Retrieved 2018-10-27.
- ^ Mimoso, Michael (2014-10-24). "NSA-Approved Samsung Knox Stores PIN in Cleartext". Threatpost. Retrieved 2018-10-27.
- ^ Forrest, Conner (2016-05-31). "Samsung Knox isn't as secure as you think it is". TechRepublic. Retrieved 2018-10-27.
- ^ "Introduction | Knox Platform for Enterprise Whitepaper". docs.samsungknox.com. Retrieved 2018-11-13.