[Android General] Silberpfeil3110:
Dear community,

I know there are also some threads with some vague similarities to my one - especially in some Samsung forums, but just keep on reading. I thought to put that in the Android General section would be the best way to adress more people, despite most of you probably don't even own a Samsung device.

Let me introduce me!

I own a Samsung Galaxy Note 3 SM-N9005 international variant since it was released (and probably will sell it in the near future) and I read a lot intresting things concerning especially this phone, as also other Samsung devices. The KNOX topic was the most interesting one in particular. It was present all the time from the beginning on. Also today people are worried because they trigger the KNOX flag, when flashing modded software to their phone, but what is KNOX?​

What is Samsung KNOX?

Before I introduce you to my personal expertise I just want to cite Samsung.

So in short, Samsung Knox should deliver some functions related to IT-security to Android, to make Android more compatible to secured business environments. Samsung introduced KNOX with the Galaxy S4 in a stadium, where Android was already about to evolve in things of security. As we all know, things like storage encryption, remote access (although through Google), multi-user capability and VPN access are already present on most of our android phones, so there's not the real need for Samsung KNOX but nevertheless they developed that software package and released it. It was Samsung's way to compete with Google, which is - as most of us know - Samsung's main target nowadays. Although the idea of KNOX is not very bad - indeed it is very good - rumours about this software began when people start to recognize, that they modify some flag - showing up in the so-called "Download Mode" when flashing modified software packages through a custom recovery or the PC software-flasher Odin. Just give the following picture a look.

There's a line telling you KNOX WARRANTY VOID: 0x1. If you buy a new phone, the last phrase would be 0x0. After flashing some modded software, this line (furthermore called "KNOX flag") gets changed (or "triggered"). Maybe you know from the good ol' days of the Samsung Galaxy S or S2, to used your JIG (that you maybe built yourself) and resetted the flash counter of the device and also set the phones state back to "Official". This is not possible with the KNOX flag. Till today is no way known - or at least confirmed - how to do that job.​

Why this flag bothers anyone at all?

People were discussing, why Samsung injected this flag and even though the flag's name clearly identifies it as something working with Samsung KNOX, people were convinced, that this has to have a higher sense. Most of us were afraid to flash software, because it will void our device's warranty.

...was one of many posts occuring at the SGN3's beginning of life concerning the KNOX trigger. This KNOX thingy was the most important reason for a bunch of people not to harm the software integrity of our phones. Of course Samsung never revealed this secret and kept us believing our adoption.​

What to do now?

So today, I have a new adoption for you all. Furthermore I would say, that this is more a credible statement, than a simple adoption. I had some quite informative conversations with some engineers at Samsung Austria and Samsung resellers, that gave me some nice conclusions. In summary I would say: Do nothing. Explanation as following.

[IMG="SamsungKNOX_structure"]http://i57.tinypic.com/263byts.png[/IMG]

You see in a more detailed way, how Samsung KNOX works. The most interesting part concerning this topic is the base layer. There is the so-called "TrustZone".

So this is very logical if you think about how to secure your data in an effective way. If someone wants your data, there are many ways how to get them and little ways how to protect them. So to complete this security puzzle, there also must be some hardware involved to this procedure, to ensure hardware integrity. I am not 100% sure about the next words, because the amount of people or companies using Samsung KNOX is very small, but I think that triggering the KNOX flag would make the secure Android container unusable, or at least would inform the user or system administrator that the system is compromised.

As I said, I am not aware of any cases, where such circumstances happened, so just take my words as a light breeze for your working brain. At least there is one reason for the KNOX trigger I am sure about and later on, also the technician told me something similar. As Samsung delivers their new phones with this security software, they could also be held responsible, if anything wrong goes on there. Maybe they have a disclaimer and you need to accept that before using KNOX, but nevertheless if some data leakage occurs and that causes some damage to the company or could harm people, someone has to be liable. One useful way to get Samsung out of the firing line of such possible facts, is to implement a simple mechanism to detect if your system changed in any way, according to the statement:

If your phone really tells you that or only shows that information in "Download mode" is not ensured, but in legal ways thats enough.​

Summary for the normal XDA user:

Flash your new ROM on your phone. Softbrick and Unbrick it as often as you like, root it, back it up, restore it, love it. Samsung gives a sh*t about the KNOX trigger when it comes to warranty for the individual user. Samsung also claimed that the trigger could be mistakenly triggered when using KIES for a "emergency reset". If your phone is softbricked, or unusable (for whatever reason) you can use KIES to revive to phone again. I think thats caused of the way KIES has to handle the phone, but that's also a guess, cause I never got into need of using it. Samsung's people told me the same. They said most of the time they don't even check the binary state if it's "Official".

It only get's tricky if you have problems with data integrity and KNOX. So if you or your company want to use Samsung KNOX to save your data from prying eyes, stick with KNOX and beware of flashing custom firmware on your phone.​

That was a more or less short summary of what KNOX is, what it does and how it affects our user experience. If I made any mistakes concerning some technical details I would appreciate it, if you correct me. As I am not an english native, spelling, typing oder grammatical mistakes could appear. Just protect and shelter them :D!

All the best

Gerhard