6

On many of its Android devices, Samsung encourages the user to accept updates for Security Enhancements for Android.

Here is Samsung's official page on the updates:

The user is presented with the following message encouraging them to allow updates to to SE for Android:

Security policy updates

Security Enhancements for Android policy update

Samsung Electronics Co., Ltd ("Samsung") offers an automatic update service for its Security Enhanced for Android (SE for Android) policies to enhance security for your device.

These continuous and automatic updates can help to avoid or counteract new malicious code, software bugs, and other security risks on your device, and improve overall software performance.

The updates may add new security policies and delete any existing policies, if necessary. The service may detect and delete downloaded software which contains malware.

Updates are performed wirelessly, without a USB connection, and you may incur a mobile data charge from your carrier. For the update service, the following User Information is necessary and will be collected.

Your device's unique identification number, model name, carrier code, security policy records, your device's current software version, MCC (Mobile Country Code), MNC (Mobile Network Code)

The collected information is only used internally by Samsung pursuant to our privacy policy. Unless stated otherwise herein, your data will be collected, processed and used in accordance with Samsung's Privacy Policy at [https://account.samsung.com/membership/pp]. By installing the update, you agree to the terms of our privacy policy.

Obviously, there are privacy implications to the data collected.

One review was not favorable:

Note that these "enhancements" are not the security patches offered by new releases of the Android OS. Those are delivered via OTA (Over The Air) updates.

For enterprise devices, these "enhancements" seem like they may be valuable. But do they offer anything for consumers who do not install software from unknown sources?

Improve this question

1 Answer 1

Reset to default
1

Ostensibly, the update in question should be a positive thing. This is a security tool, and Samsung is asking for automatic updates to be turned on so the tool can stay up to date and take steps to keep its protections current. However...

  • The update itself "may add new security policies and delete any existing policies"

    "may detect and delete downloaded software which contains malware"

    "the following User Information is necessary and will be collected"

    "collected information is only used internally by Samsung pursuant to our privacy policy. Unless stated otherwise herein, your data will be collected, processed and used in accordance with Samsung's Privacy Policy"

    from the privacy policy:

    "We may share your information with: • Affiliates - the Samsung family of companies. • Business partners - trusted companies that may provide information about products and services you might like. • Service providers - companies that provide services for or on behalf of Samsung. • Law enforcement - when we are required to do so or to protect Samsung and its users."

Basically, you're agreeing that they can do anything at any time to your device, including deleting things, installing software, changing policies, etc... and can share your collected information with basically anyone that they care to. Relatively par for the course for a mobile device these days, really.

  • The Security Enhancements for Android

    This is part of Samsung KNOX - http://www.samsung.com/us/business/security/knox/

    KNOX is several layers of security tooling, including:

    • trusted hardware (unique device key, secure boot key, hardware fuses for rollback prevention)

    • secure boot and trusted boot (multiple layers to prevent unauthorized bootloaders)

    • anti-tamper e-fuse (blows the fuse if the device is suspected of tampering, even if restored to the original state)

    • security enhancements for android (a set of security policies that restricts application access)

    • trustzone-based integrity measurement architecture (TIMA) (tries to maintain security even if the kernel is compromised)

    • realtime kernel protection (leverages TIMA to prevent attacks against the kernel)

    • remote attestation (enables an MDM to verify device integrity)

    • several application security bits

Quite a bit more detailed info can be found in the whitepaper here:

https://kp-cdn.samsungknox.com/5ef8fc5a58971c019a4b0fe6607b4585.pdf

I find the hardware and software fuses particularly interesting.

Ultimately, KNOX represents many layers of security to keep the device from being compromised. If you want a walled garden device (the route Apple went), this takes many steps in that direction. If you want an Android device that you can tinker with, this is likely a bad thing for you. Also, there have a been a number of serious issues with the implementation of KNOX over the last couple years:

https://forum.xda-developers.com/showpost.php?p=52329946&postcount=76
http://www.zdnet.com/article/google-project-zero-how-we-cracked-samsungs-dod-and-nsa-certified-knox/
http://seclists.org/bugtraq/2016/Jan/79
http://seclists.org/bugtraq/2016/Jan/80
http://seclists.org/bugtraq/2016/Apr/95

Yes, you'll likely not see the benefits of these security measures to as great an extent if you don't install software from unknown sources, but this is not the only way that nasty things may make their way onto your device. KNOX is a set of security tools that comes with many of the issues common to such hardware and software components, i.e, YMMV.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .