MDM allow businesses to customize their devices for their needs. IT administrators can register new devices, identify a unified endpoint management (UEM) system, define the organizational rules that govern the use of devices, and upgrade device firmware over-the-air.[7] Knox's MDM services are registered and accessed through the web,[8]APIs, or proprietary SDKs.[9]
A few Samsung devices with Knox were approved for US governmental use in 2014, as long as they're not used to store classified data.[10]
Since Android 8, Knox is used to prevent root access to apps even after a successful rooting.[11]
In October 2014, a security researcher discovered that Samsung Knox stores PINs in plain text rather than storing salted and hashed PINs and processing them by obfuscated code.[12]
In May 2016, Israeli researchers Uri Kanonov and Avishai Wool found three vulnerabilities in specific versions of Knox.[13]
Samsung Knox devices use an e-fuse to indicate whether or not an "untrusted" (non-Samsung) boot path has ever been run. The e-Fuse will be set in any of the following cases:
The device boots with a non-Samsung signed bootloader, kernel, kernel initialization script, or data.
The device is rooted.
Custom firmware is detected on the device (such as non-Samsung Android releases).
On Galaxy Book devices starting with the Galaxy Book 4, upgrading from one Windows version to another (from 22H2 to 23H2) will not set the e-Fuse, but upgrading to a higher edition (from Home to Pro) will[citation needed].
When set, the text "Set warranty bit: <reason>" appears. Once the e-fuse is set, a device can no longer create a Knox Workspace container or access the data previously stored in an existing Knox Workspace.[16] In the United States, this information may be used by Samsung to deny warranty service to devices that have been modified in this manner.[17] Voiding consumer warranties in this manner may be prohibited by the Magnuson–Moss Warranty Act of 1975, at least in cases where the phone's problem is not directly caused by rooting.[18] In addition to voiding the warranty, tripping the e-fuse also prevents some preinstalled apps from running, such as Secure Folder and Samsung Pay.[citation needed] For some older versions of Knox, it may be possible to clear the e-fuse by flashing a custom firmware.[19]
↑ Ning, Peng (2013-12-04). "About CF-Auto-Root". Samsung. Archived from the original on 2015-09-05. The sole purpose of this fuse-burning action is to memorize that a kernel or critical initialization scripts or data that is not under Samsung's control has been put on the device. Once the e-fuse bit is burned, a Samsung KNOX-enabled device can no longer create a KNOX Container or access the data previously stored in an existing KNOX Container.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
