Secure Containers in Android: The Samsung KNOX Case Study

Bring Your Own Device (BYOD) is a growing trend among enterprises, aiming to improve workers' mobility and productivity via their smartphones. The threats and dangers posed by the smartphones to the enterprise are also ever-growing. Such dangers can be mitigated by running the enterprise software inside a "secure container" on the smartphone. In our work we present a systematic assessment of security critical areas in design and implementation of a secure container for Android using reverse engineering and attacker-inspired methods. We do this through a case-study of Samsung KNOX, a real-world product deployed on millions of devices. Our research shows how KNOX security features work behind the scenes and lets us compare the vendor's public security claims against reality. Along the way we identified several design weaknesses and a few vulnerabilities that were disclosed to Samsung.

[1]  Yuval Elovici,et al.  Intrusion detection for mobile devices using the knowledge-based, temporal abstraction method , 2010, J. Syst. Softw..

[2]  Trent Jaeger,et al.  Sprobes: Enforcing Kernel Code Integrity on the TrustZone Architecture , 2014, ArXiv.

[3]  Srinivas Devadas,et al.  Intel SGX Explained , 2016, IACR Cryptol. ePrint Arch..

[4]  Peter Teufl,et al.  Do you think your passwords are secure? , 2014, 2014 International Conference on Privacy and Security in Mobile Systems (PRISMS).

[5]  Yuan Zhang,et al.  AppIntent: analyzing sensitive data transmission in android for privacy leakage detection , 2013, CCS.

[6]  Jeremy Andrus,et al.  Cells: a virtual mobile smartphone architecture , 2011, SOSP '11.

[7]  Yuval Elovici,et al.  Google Android: A Comprehensive Security Assessment , 2010, IEEE Security & Privacy.

[8]  Siani Pearson.  Trusted Computing Platforms , the Next Security Solution , 2002 .

[9]  Bernhard Kauer.  OSLO: Improving the Security of Trusted Computing , 2007, USENIX Security Symposium.

[10]  Juan Julián Merelo Guervós,et al.  Corporate security solutions for BYOD: A novel user-centric and self-adaptive system , 2015, Comput. Commun..

[11]  Fernando C. Colón Osorio,et al.  “TrustDroid™”: Preventing the use of SmartPhones for information leaking in corporate networks through the used of static analysis taint tracking , 2012, 2012 7th International Conference on Malicious and Unwanted Software.

[12]  Eran Tromer,et al.  DroidDisintegrator: Intra-Application Information Flow Control in Android Apps , 2016, AsiaCCS.

[13]  Quan Chen,et al.  Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World , 2014, CCS.

[14]  Yuval Elovici,et al.  “Andromaly”: a behavioral malware detection framework for android devices , 2012, Journal of Intelligent Information Systems.

[15]  Gabi Nakibly,et al.  Gyrophone: Recognizing Speech from Gyroscope Signals , 2014, USENIX Security Symposium.

[16]  Antonio Scarfò,et al.  New Security Perspectives around BYOD , 2012, 2012 Seventh International Conference on Broadband, Wireless Computing, Communication and Applications.

[17]  Nima Zahadat,et al.  BYOD security engineering: A framework and its analysis , 2015, Comput. Secur..

[18]  Robert H. Deng,et al.  Efficient Virtualization-Based Application Protection Against Untrusted Operating System , 2015, AsiaCCS.

[19]  Yuval Elovici,et al.  Evaluation of Security Solutions for Android Systems , 2015, ArXiv.

[20]  Zhenkai Liang,et al.  DroidVault: A Trusted Data Vault for Android Devices , 2014, 2014 19th International Conference on Engineering of Complex Computer Systems.

[21]  Mohammed Ketel,et al.  Bring Your Own Device: Security technologies , 2015, SoutheastCon 2015.

[22]  Yuewu Wang,et al.  DeepDroid: Dynamically Enforcing Enterprise Policy on Android Devices , 2015, NDSS.

[23]  Mohammed Ketel,et al.  Bring Your Own Device: Benefits, risks and control techniques , 2014, IEEE SOUTHEASTCON 2014.

[24]  Michael Backes,et al.  Boxify: Full-fledged App Sandboxing for Stock Android , 2015, USENIX Security Symposium.