Threat Intelligence

Samsung KNOX Takes Some Knocks

Researcher at Black Hat USA will reveal Samsung KNOX 2.6 vulnerabilities and bypass techniques, and notes that new KNOX 2.8 may be at risk as well.

Samsung last year touted its enterprise mobile security platform KNOX 2.6 aimed at protecting corporate data as well as the software's underlying Linux kernel.

But a researcher at Black Hat USA next month will demonstrate how he was able to bypass some of the key features in KNOX 2.6, such as data flow integrity (DFI) to keep information flowing to its intended destination, and the Kernel Address Space Layout Randomization (KASLR) that plays a game of cat and mouse with attackers by continually hiding the address location of the kernel.

Di Shen, a senior security researcher with Tencent Keen Security Lab, plans to share his Knox bypass techniques in his "Defeating Samsung Knox with Zero Privilege" session at Black Hat. And while his techniques were applied to a Knox platform that Samsung has since patched and is two versions old, Shen says Samsung's new and recently released KNOX 2.8 is not entirely out of the woods.

"My exploit chain was finished in June 2016, so it was working on KNOX 2.6 at that time," Shen says. "Since the vulnerabilities I used have been fixed in Samsung's latest firmware, the exploit chain will not affect an updated Samsung device with KNOX 2.8. However, the bypass techniques that I'm going to give out at Black Hat may still be useful in KNOX 2.8 if you got new kernel vulnerabilities for the latest firmware."

Although Shen has not yet analyzed KNOX 2.8, he did note that according to Samsung's KNOX change-log, the handset maker has added a control-flow protection feature, or control-flow integrity (CFI), to protect the kernel in its latest version of KNOX. And that CFI security feature has shown that it can be bypassed on a Windows system, according to Shen. The CFI is designed to prevent the attacker from hijacking the control-flow of a kernel's operating system.

"It could be a new challenge to exploit some particular kernel vulnerabilities," Shen says.

Knocking Down KNOX 2.6

And Shen should know. Last summer, before Samsung issued its firmware update, he used an exploit chain to slap down the KNOX Android kernel.

With a malicious application installed on a Samsung Galaxy S7, two vulnerabilities were found in KNOX 2.6, which allowed Shen to create an exploit chain.

"There are two vulnerabilities in this exploit chain, both of them are Linux kernel vulnerabilities. One is an information leaking vulnerability, helping me bypass KASLR; the other one is a use-after-free in perf subsystem of Linux kernel, helping me achieve arbitrary kernel memory overwriting," says Shen.

The vulnerabilities allowed Shen to first bypass KASLR so he knew exactly where the kernel was located. He then moved on to manipulating the Linux kernel data memory to bypass the DFI using Linux's own feature. That maneuver allowed Shen to gain the holy grail, root privilege. Shen's next move was to manipulate the Security Enhanced Linux (SELinux) database which is located in the kernel's memory, and with that manipulation he was able to bypass additional restrictions made by SELinux, he says.

This would allow an attacker to gain root privilege on a Samsung device and engage in nefarious activities from accessing private data on the phone to hijacking Web browsers, or to commandeering the phone's camera and recording capabilities, according to Shen.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

The most difficult part of punching into the KNOX 2.6 kernel was bypassing the DFI, he notes, which is carried out by a hypervisor that works with multiple operating systems within the same device. Shen plans to offer more details on how he tackled this greatest challenge in his Black Hat session.

In response to questions regarding KNOX 2.8 and its security, a Samsung spokesperson said: "Samsung KNOX is built in to our mobile technologies to ensure your hardware, software and apps are as secure as possible. Customers are encouraged to keep their software and apps updated and can download updates wirelessly. Samsung was made aware of this particular vulnerability (in KNOX 2.6) and a fix was deployed in February."

Despite being able to defeat KNOX 2.6 with zero privilege, Shen says he has great respect for Samsung's security team.

"You know every vulnerability mitigation may be bypassed someday and somehow, so is KNOX," Shen said. "KNOX still can make your devices safer than other devices, as the KNOX team is the best security team of smart phone vendor I've ever knew. They understand exploit techniques, they keep improving KNOX, and they can make it better." 

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Free Tool Scans for Chrome Extension Safety
Dark Reading Staff 2/21/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9015
PUBLISHED: 2019-02-22
A Path Traversal vulnerability was discovered in MOPCMS through 2018-11-30, leading to deletion of unexpected critical files. The exploitation point is in the "column management" function. The path added to the column is not verified. When a column is deleted by an attacker, the correspond...
CVE-2019-9016
PUBLISHED: 2019-02-22
An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demonstrated by the /mopcms/X0AZgf(index).php?mod=column&ac=list&menuid=28&am...
CVE-2018-20784
PUBLISHED: 2019-02-22
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.
CVE-2019-9003
PUBLISHED: 2019-02-22
In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.
CVE-2019-9004
PUBLISHED: 2019-02-22
In Eclipse Wakaama (formerly liblwm2m) 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak. Processing of a single crafted packet leads to leaking (wasting) 24 bytes of memory. This can lead to termination of the LWM2M server afte...