[Security Discussion] E:V:A:
The Main Problem with KNOX

Is that end-users are left-out cold without any form of privacy control.

As cool as MDM is to the "enterprise" developer and from a hacker's

perspective, there's nothing attractive with this to the end-user. How

can the end-user be certain that his store-bought KNOX enabled device,

hasn't already been compromised by some "enterprise"?

Without fully transparent, open source and public KNOX documentation,

this will be practically impossible to answer. As far as we know from

recent past experiences, on how "curious" enterprises like Google,

Samsung and NSA have been, why should we trust them this time? Or what

about the mobile service providers themselves? We know from many recent

examples how companies like Verizon and AT&T have been spying on their

customers before.

What follows is a few enlightening excerpts from the latest KNOX

white-paper. Before reading this and having recent major KNOX related

developer issues, I have gone from a "KNOX-who-cares" person, to a vivid

Anti-KNOX-er! I will most likely stay that way, at least until our

devices are sold without KNOX, and only available as a voluntary device

add-on/feature, using open source as it's basis.

What about you? Would you be happy to walk around the streets with a

laptop that has a remote access tool that constantly tracks your every

move, picture, sound and friends you meet and call, all while not

informing of any of that? While being way beyond you control? In fact,

you will not even have any choice, if Godzilla and Samsung gets their

way, in the next year.

Attestation

Attestation offers verification of a mobile device's core system

software i.e, the boot loaders and the kernel, at runtime based on the

measurement data collected during trusted boot. Attestation can be

requested at any time by the enterprise's Mobile Device Management (MDM)

system. All security critical operations of attestation are performed in

Trustzone.

When requested, the Attestation feature reads the previously stored

measurement information and the fuse value (see Trusted Boot above) and

combines these data to produce an Attestation "verdict". This verdict,

which essentially an indicate for whether tampering has occured, is

simply returned to the requesting MDM. The Attestation result is

returned to the requesting MDM server with a signature based on the

device's unique "Attestation Certificate" that is configured in the

device during the manufacturing process. This ensures that the

Attestation verdict cannot be altered during transfer.

Any further action is determined by the enterprise's MDM security

policy. It might choose to detach from the device, erase the contents of

the secure application container, ask for the location of the device, or

any of many other possible security recovery procedures.

The KNOX Container

...

The enterprise can manage the container like any other IT asset using an

MDM solution. Samsung KNOX supports many of the leading MDM solutions on

the market. Container management is affected by setting policies in the

same fashion as those traditional MDM policies. Samsung KNOX Container

includes a rich set of policies for authentication, data security, VPN,

email, application blacklisting, whitelisting, etc.

...

The new container also allows enterprise IT administrators to control

the flow of information between the container and the rest of the

device. This allows enterprises to strike the right balance between

security and user productivity. Users can also control the data sharing

capability based on their personal preferences, within the limits

specified by the enterprise IT administrator.

Mobile Device Management (MDM)

Enrolling an Android device into a company’s MDM system typically begins

with the user downloading the agent application from the Google Play

store and then configuring it for work. Enterprises are facing

increasing help desk calls as more and more users are activating mobile

devices for work and run into issues during this process. In addition

the user is presented with prompts, privacy policies and license

agreements at various stages resulting in a poor overall experience.

The KNOX platform provides a unified enrollment solution that is simple

and intuitive, and eliminates many steps in the enrollment process.

The process begins with the employee navigating to a web page and

clicking on an enrollment link. The link to the original web page may be

provided to the employee via an e-mail or SMS, or via the company’s

internal or external website. Clicking on the enrollment link brings up

a screen that prompts for the user’s corporate email address. The device

then displays all notices for the user to accept, which include privacy

policies and agreements from Samsung, the MDM vendor and the enterprise.

Upon accepting the terms, the user is directed to a screen to enter the

password for the corporate account. If authentication is successful the

enrollment is complete. Any agent application required by the MDM server

is automatically downloaded and installed, without user intervention.

MDM vendors can take advantage of this feature and simplify the

onboarding process for enterprise users and significantly improve the

user experience and reduce support costs.

​

In a nutshell, this is legalized control and spying.