[Galaxy S 4 General] Absolon:
Sorry for my absence and a late reply. There are things that are more important then Knox in my life.

Jeez... Where to start? I'm sorry that I have to go a bit "deep technically" but I think I need to explain my concerns and why you must act if you don't want

to have an integrated Knox-chip in your Samsung Galaxy S5.

Since I write long posts, get some coffee, and meanwhile try thislink, GeoIP Locator, and tell me if they where close or not? As an illustration.

About your assumptions

I have FULL warranty with a

written permission

that I can flash my phone 1337 times or trip my Knox from my cell provider. They don't care!

Only invalid if I happen to brick my phone because of software. They also asked me don't want me to mess with the modem (except for official upgrades)

so it doesn't mess up their network. My warranty is between me and my cell provider, not Samsung. That is something between them and Samsung if my

phone would get faulty hardware. I don't have to care about that. I will get a new phone. I can basically have CM on it and turn it in. Hell I can even have

IOS on it (and live in shame).

So I don't have any warranty "anger" but very strong concerns about my privacy and this time a huge attempt to invade it since I carry and have my phone

with me all day and night. Also, I don't think you really see the wide implications here and I don't think you really know SELinux.

SELinux it's pretty straight forward. You just have to write out rules, "directives" what to restrict or not. How much control you want to give the user of the

system.

But you are totally in the hands of those who write those rules and what they let you. *BSD has something similar with security levels. Will leave that out of this.

And the ones are Samsung. They write the rules, in more then one way here..

I didn't saw there is an option to turn off "updates" so I got an "SELinux update #16" on my Note 3 yesterday (plain vanilla, not rooted). Anyone else got it?

Can you tell me what was included in that one? Only if you work at Samsung.

It's REALLY good when it comes to mission critical computers that should not be tampered with, especially if exposed to the internet.

It's REALLY bad when you are enforced to have it in your own private phone since there is NOT A SINGLE REASON for what purpose you need it.

I saw the new nice updated webpage, with a little cure girl and all, they did a few days ago. Protection. So nice. Are you really so naive?

Isn't it YOUR choice to have a virus killer installed on your PC or is it Microsoft that should decide that for you? What more should they then decide?

This is not a criminal case. Innocent until proved?? Do you work at Samsung? If not, have you tried to talk to them about Knox at all?

Did they give they any info? At all?

If this was so innocent, why the secrecy? That you can hack it? You have a flag for it. Apparently it's so strong that they got governmental approval to use

it in USA. So it must be considered as something really hard to hack, right? And it is. I doubt that we will be able to crack it. Only if we find a weakness.

That is what they are waiting for. Us to try to circumvent it. They sit here and read it (Hello! Calling you tomorrow, btw!) so they can perfect it.

So no, in this case they are the ones that have to prove. This is not a criminal court-case. Even if it should be.

I took this from their on webpage (with that cute girl). It's from their own white-paper (highlighted the important things for your pleasure):

Secure Boot requires the device boot loader, kernel, and system software to be cryptographically signed

by a key verified by the hardware. Secure Boot uses X.509 certificates and public keys which are embedded

into the boot loader of the device. A secure hash of the certificates is fused into hardware Read-Only

Memory (ROM) at the time of manufacture. The Secure Boot loader will only continue if the authorized

secure signed binaries are present. Next, Secure Boot verifies the cryptographic signature of the Linux

kernel and system image before handing control to the OS.

So this has been planned. For a long time.

Take a look at X.509.

As you see it's a standard SSL-certificate (wonder if it's signed and how to get it and see the top signer).

Until today SSL has not cracked more then by brute force. There was some alarming scare a few months back, during Snowden that NSA might have

found a weakness in it and could crack it. But it was never verified and it's still considered as "safe".

This is the basis of all internet security today. So let's hope that NSA didn't succeed in that...

If it WOULD be hacked, the whole damn Internet security falls apart. Everything has to be rewritten. The implications of this would be enormous.

Off topic

I worked with Y2K. After that passed people said "Oh, see. That was a crying for wolfs". No it wasn't. If there wouldn't have been that HUGE investments,

new hardware, rewriting of code, millions of man (and women) hours spent it would have been bad. Really bad. We worked day and night in the end.

I saw all that. I worked with it. I consulted for several corps, like pharmaceutical etc. The nice is was that I'm a Unix specialist so I don't have to worry

until Y2047 when those clocks turn around (32-bit int, seconds since 1970-01-01). I hope I will still have time to be moved into The Matrix, :D

That is why Y2K didn't had more serious implications (except for an emergency shutdown of 6 nuclear reactors in Japan (that should have been

an wake up call to see over the security....). Developing countries had problems. Of course. But that drowned in the "It was a big scam". news.

Some "funny" things like a someone older then 100 year old started to get commercial for baby products.

A bit on topic

We have now a successor that will replace X.509 and that is AES.

It's much stronger then X.509. It's so strong that it is the approved standard to the highest classified documents "Top secret" in USA and basically all

over the world.

Today's CPU's (younger then 5-6 years) has a special instruction for calculating it (AES-NI). It doesn't slow down your machine much (think it takes just 5

or 6 clock cycles compared to 69 in the software implementation in the Linux kernel). Using Truecrypt? You should.

This is a magnitude stronger and it wouldn't surprise me is the Knox-chip will not replace scramble it with AES as well in the Galaxy S5.

Get to the point, dammit!

So what does it mean? Every phone has an UNIQUE certificate for each phone. Think they have a list corresponding to the serial number? You bet.

When you buy your phone, do you sign the paper for your "plan"/warranty with the phones serial number written out? Of course you do. You want your warranty.

But this means also that they can MATCH you and your phone. Serial -> You. Easy. Same with everything. No big deal, right?

It would not be if you didn't have Knox on it. This is the KEY here.

And you are WRONG. The system is indeed locked.

SELinux can do this (among other things)

You have a MAC-implementation in the kernel. The rules can deny access to different parts of the kernel.

You can hook on ANYTHING to it. It's a matter of config. That is their framework we see in the /system etc.

It controls running programs, file systems, files, sockets, network interfaces etc.

And it can

run whatever application it wants, without disclosure to the user

, hooked on 3rd party implementation with FULL network access.

If's sandboxing you in in user space, with limited access to system space, just like jalis but worse. You are locked out on SYSTEM level.

Basically you have total visualization of your machine and all you do is like being in a virtual machine.

Oh, look, how nice of NSA to help out: SEAndroid

They even implement it with Xen.

So you might think you are in your phone but you are in the Matrix. You are never in your phone.

And that means that you don't know what it's going on in your REAL phone. You don't know what your phone are sending for information since few can

afford their own base station and build a Faraday's cage to really see what it does.

They have you through your serial, and they can install what they want on your phone. Nice to target people, not? I'ts not only about general population

control anymore. It's about that they can know that YOU have this phone with unique id and who you are. They can start to track people, groups, whatever.

You can compare it with Windows. Windows desperately tries to contact to the 192.88.99.1 that is the standard "6to4 any cast" (RFC 3068), but from

there where? There are pages with people who try to figure out why "SYSTEM" really wants that and where it goes. Please, take a look yourself. Google.

Turn on Skype. It tries to make a tunnel through ICMP. A bit sneaky but I CAN see this because I have full access to my network.

But I don't have a base-station and I'm betting nor does you.

So where is my faulty logic? You have a phone that you are sandboxed in. You have no control because you are locked inside user space.

I'ts so strong the government in USA can use it. They have already a flag that warns if it's tampered with.

There is many unanswered questions about Knox and why doesn't Samsung disclose them if it's so innocent? To protect from tampering that you can't?

So if there will be no pressure and people will not get the finger out of their butts S5 will have a Knox-chip in it. That I'm 100% certain of.

Knox is way more the a bootloader that people tries to circumvent for their warranty situation, well, good for them. I see that part as insignificant

since Knox is a whole framework that nobody really knows what it does.

Read the white paper. Many pretty words but sift through the purpose to why you should have it, why it's enforced on your phone so desperately?

There is none.

And as soon as you trip it, the phone is NOT the same as it was before if I compare how it was before the Knox. It acts differently. I can't say what really,

but having experience, now 20+ years of Unix you get a "feel in your guts" that something is not as they should be. I can't (yet) put my finger too it but

it's a subtle change. Not the same phone. But probably it's because the thing I wrote. I'm not in my phone. I'm in a virtual space.

Now they rushed and released that i9506 that has replaced the i9505. You can get that anymore. With the new phone, that has so much more in common

with Note 3 that I think it's the same production line and that they fork quite late to the two platforms. I have not seen the inside of it so I can't check but

it can be a cost-saver or it can be that you don't have any other choice for a boot loader that isn't from the "pre-Knox".

Get a rocket phone but make it incompatible with any pre-Knoxed firmwares. Nice move, Samsung!

I haven't tried it yet, as said, a bit much IRL right now but I'm pretty sure that no bootloader that isn't "pre-Knox" will work on the '06 but that also, that

firmwares from Note 3 will boot. Are there some pre-Knox there?

You compare it with other companies. Where do they have the lockup?

You can unlock your HTC FULLY. You couldn't make an S-OFF in the HTC One X but you can that in the HTC One.

Sony has similar solutions.

Only Samsung goes the other way and close up. Possibility of a remotely controlled phone? 100%!

If you think it's ok that you have a phone that can run applications that you don't even see, don't know what it does, who it communicates with then it's fine

with me. I don't accept it, since I think it's sinister. I don't buy that Samsung want to protect me. If so, write a free virus killer instead.

Don't make my phone a virtual machine!

So yet again. I don't whine over warranty since that is not an issue. The issue is that your phone is totally controlled by a 3rd party at their discretion.

SELinux rules update #16

I'm curious. What did they "perfect" this time?

If you or anybody else doesn't have concerns after this I will stop writing about it, because it takes up my time and I will buy a HTC next year instead. But

is you all ARE concerned you have to start to voice that and spread it all over the user forums, not this special place, but the ones where the masses sit

and read. If not, Samsung Galaxy S5 will have a Knox-chip integrated. Maybe they even smack AES on it for fun.

Then we don't even have to start a forum about it. We can just link them over to some of those user ones....

When Intel made it's unique ID on each CPU there was a huge outcry. They withdraw it.

When Microsoft tried to do a chip called Palladium that would only allow certified programs to run there was a huge outcry. They withdraw that.

When Samsung takes over your phone, can control it 100% or sell that control to some government you sit and talk about bootloaders and warranty....

So THINK for a moment. And hopefully act.

/Abs