In response to a blog post on Samsung Knox | Hacker News Reader

In response to a blog post on Samsung Knox

samsungknox.com

58 pointsrobin_reala25 comments

The original post was updated:

http://mobilesecurityares.blogspot.co.uk/2014/10/why-samsung...

Not with a retraction.

Has anyone had any luck reporting vulnerabilities to the security@samsung.com e-mail box? I found a couple high-risk vulnerabilities with the KNOX EEM app and haven't got a response with an acknowledgement of e-mail receipt or directions on how to submit vulnerability reports to Samsung. Any company that takes security seriously needs to have an easy way for reporting vulnerabilities without the need to go through a third-party like CERT.

I use president@sta.samsung.com for serious issues. It's a U.S. specific address for the mobile phone group.

Looking at their updated 'My Knox' app, it requires a Galaxy S5 or Note 4. One of those devices was released less than a month ago. Do they simply not care about customers on older devices?

Why would they? Those customers have already paid for their old device. There's no more value to be had there.

Except repeat business from happy customers, but who cares about that?

> The My KNOX console provides password reset functionality, thus removing the need for password hints.

Wait, doesn't that mean Samsung has a way to decrypt your data without the original password then? (Though I'm not familiar with MyKNOX so I'm not sure if that's what they're promising at all)

No ...

> KNOX does save the encryption key required to auto-mount the container’s file system in TrustZone. However, unlike what is implied in the blog, the access to this key is strongly controlled. Only trusted system processes can retrieve it

LOL no. If your security is predicated on the underlying OS perfectly enforcing permissions, then you're insecure.

> KNOX 1.0’s Personal containers, designed to let consumers experience the KNOX container, were not managed by an MDM agent. Therefore, they either store an alternative PIN or use a Samsung account to recover forgotten passwords. This KNOX 1.0 Personal container is not a part of the KNOX enterprise solution and was discontinued early this year.

My takeaway: unless you've had a 100% staff turnover this calendar year, at least some of the designers and implementers who thought it'd be OK to store a PIN in cleartext are still on the team. That's enough to make me run screaming from it.

They're talking about ARM TrustZone (http://www.arm.com/TrustZone) here, which can do these kinds of things securely. However, I'm not sure if Samsung uses it correctly.

'Securely' is relative. While a TrustZone kernel is supposed to be isolated from the main OS, it can still be compromised, which would allow the key to be retrieved. I don't know why they are storing the key at all, considering that it's supposed to be derived from the password; other systems certainly don't. (Apple's goes farther than that by attempting to prevent parallelized cracking using hardware encryption keys.)

  I don't know why they are storing the key at all, 
  considering that it's supposed to be derived from the 
  password

A lot of people secure their phone with comparatively weak passwords of 4 to 6 numeric digits - I know I do!

While you'd certainly want to hash that and include it in the key, using it as the sole source to derive the key wouldn't be enough. I can understand also trying to work in some sort of trusted hardware that imposes a rate limit and prevents performing attacks in parallel.

You'd still hash the user's password into the encryption key, of course. And shether Samsung has managed to get the trusted hardware right is of course another matter...

The KNOX technology really isn't there to protect you. That's just an afterthought. The real justification for KNOX is in the e-fuse that gets blown when you try to flash a custom recovery onto a Galaxy device. It's Samsung's way of punishing you for fucking with their carefully crafted (yeah right) TouchWiz user experience, by irreparably voiding your warranty and "disabling important security features".

Wasn't knox discontinued?

Only the personal edition. Knox as an enterprise product is still active.

You can use m.security@samsung.com if you want to email Samsung about any security issues.

To be clear I'm working for Samsung on the KNOX project.

I may be racist or something, but I don't trust software written outside of US, Europe and Australia. I know Samsung now has labs around the world, but the important decisions are still made in Seoul. In my humble experience those guys are never agile, never able to say "i was wrong", etc. That attitude works well for devices, based on other's designs (ARM, Google) but leads to really bad, insecure software.

Agile is not good for security, which requires up-front design if you're going to get it right. TDD isn't good enough for security testing, and doing thorough security testing at the end of each sprint that changed security-enforcing code is neither practical nor cheap.

Agile is totally orthogonal to security. Its more about tailoring the work done to what is actually needed and effective teamwork. In no sense does agile dispense with up front design. Similarly TDD still has to start with a specification. Designing tests on the requirements frequently cause them to be tightened significantly. If you mean 'TDD tests will never protect you from random chaos monkey coders' you are right, but it never claimed to.

You're absolutely right. The great unwashed doesn't view agile that way though.

Sad but true.

You trust software written in the US, Europe and Australia? Do we read the same HackerNews?

I can confirm a similar cultural/organisational resistance to admitting you FUBARed something. I'm not sure our spies are any more competent than Russia/China/Korea/India/etc. Actually recent revelations seem to imply a certain sense of unreality, an overconfident, bureaucratic, overtly political and un-scientific juggernaut.

Have you got a car made in Asia somewhere? Chances are you have, and rely on it everyday ... there's hundreds of thousands of lines of code running on it.

Having read actual Samsung code I would guess it was written in India by someone who uses copy/paste instead of a small library. I understand that runtime dependencies are a problem in embedded programming, but the Bada platform suffers because it was written by lots of people who were all not talking to each other.

Reply on news.ycombinator.com