Samsung Knox approved by US Government for classified use but is it really safe ?

Samsung Knox Validated and Approved For U.S. Gov Classified Use

Samsung Electronics announced its solutions have been approved by the United States government as the first NIAP-validated consumer mobile devices to handle the full range of classified information. After completing ten Memoranda of Agreements (MOAs), the government added the Galaxy S4, Galaxy S5, Galaxy Note 3, Galaxy Note 4, Galaxy Note 10.1 (2014 Edition), Galaxy Note Edge, Galaxy Alpha, Galaxy Tab S 8.4, Galaxy Tab S 10.5 and the Galaxy IPSEC Virtual Private Network (VPN) Client to the Commercial Solutions for Classified (CSfC) Program Component List.

This accomplishment is the direct result of Samsung’s successful testing and certification under the U.S. government’s Common Criteria Mobile Device Fundamental Protection Profile (MDFPP) and VPN Protection Profile (VPNPP) programs. The listed Samsung devices are available for use with classified government networks and data. All devices and capabilities incorporate security features powered by Samsung KNOX.

Samsungs own description of its Knox service also points out to the same facts


The DISA Approved Products List may be found at:

Does that mean the Samsung Knox is the most secure way to store important and personal images /videos /docs

With the breaches and hacks taking place almost everyday, a user entails serious risks to save personal images/docs or videos online in the clouds.  With the iCloud Hacks it was proved that even Celebrities are not safe from hacking.  The SnapChat leaks proved that images of 13 to 17 year old kids were prone to being vulnerable to such leaks.  The Dropbox leaks proved that saving to Dropbox also entails a relatively high risk.

So what do the users do with their images and videos taken in those private moment.  With the approval of the US Government for classified use, the Samsung Knox became the first mobile device to be guaranteed as safe from hackers, no less then by the Big Sam himself.

With unlimited storage (upto 64GB) capacity aboard many of the Samsung products, you are safe on the space option but is the Samsung Knox really the Fort Knox of storing your private documents/images and videos securely.  While the US Government thinks so, a security researcher, Eingestellt von Ares doesnt think so.

Infact Ares has demonstrated on his blog as to why Samsung’s Knox is vulnerable and quite easily too.

How is Samsung Knox vulnerable

Ares has given a full PoC about the vulnerability on his blog, which is reproduced here :





|- cache

|- databases

|- extracted

|- lib

|- shared_prefs



<?xml version=’1.0′ encoding=’utf-8′ standalone=’yes’ ?>
<string name=”code”>123456789</string>

Now the Samsung Knox gives a user a maximum of 2o tries for username and password.

Samsung Knox



public boolean setData(String paramAnonymousString) {

this.keyGenInput = DataService.this.mPasswordUtil.getInputForKeyGenerate();

String str = SecureKeyLoader.getKeyForPassword(this.keyGenInput, this.bit_size);

return DataService.this.mEncryptDecrypt.encryptAndSave(paramAnonymousString, str);

Let’s have a look at each line and the corresponding methods:
public long getInputForKeyGenerate()
private String getAndroidID()
return Settings.Secure.getString(this.mContext.getContentResolver(), “android_id”);
public class SecureKeyLoader
public static native String getPartialString(String paramString);

Ok, Samsung is obfuscating it more and more to hide the real key generation. The method getKeyForPassword is placed in a C written shared library called “mealy”. Let’s grab the library from the device and put it into a disassembler like IDA:
The binary has one hardcoded string called “out_char” with the following value: eu>q5b0KPlLwyb@*#j9?!*ehjl(LHukkA(di^S4UXAChr3B`_xf+@h*#S&wpfv&# . By looking at the code the method getKeyForPassword gets as an argument the long value of getPartialString(getAndroidID()), holding as variable the out_char String and passes both of them to the subroutine ‘mealymachine’. Let’s have a look at the function getKeyForPassword and the subroutine mealymachine in pseudo code:
function Java_com_sec_knox_store_SecurityManager_SecureKeyLoader_getKeyForPassword {
r4 = r0; //partialString androidID as long value
r0 = r2; //integer = 16
r0 = mealymachine(r0, var_8, next, “eu>q5b0KPlLwyb@*#j9?!*ehjl(LHukkA(di^S4UXAChr3B`_xf+@h*#S&wpfv&#”, STK29);
r3 = *r4;
r2 = *(r3 + 0x29c);
return r0;
function mealymachine {
r6 = r0; //partialString androidID as long value
r5 = r1; //var_8
r7 = r2; //next
if (r1 <= 0x64) {
r4 = 0x0;
memset@PLT(0x2144, 0x0, 0x64);
r1 = r4;
do {
if (r4 >= r5) {
r0 = r6 & 0x1;
r6 = r6 >> 0x1;
r4 = r4 + 0x1;
} while (true);
r0 = 0x2144;
return r0;
else {
r0 = 0x0;
return r0;
return r0;


In conclusion Ares points out that Samsung Knox is not as secure as it is pointed out to be.


The key should be derived from a Password-Based Key Derivation Function 2(PBKDF2) which generates a much stronger key with more randomness.

Recommendation from Ares

Instead of Samsung Knox, use the built-in Android encryption function and encrypt the whole device. Android is using a PBKDF2 function from the encryption password you choose and never persists it on the device. Obviously you can never access the data if you forget your password, but that’s the point of a good encryption.

Resource : Mobile Security Blog


Please enter your comment!
Please enter your name here