Remember last month when researchers at Ben-Gurion University claimed to have found a vulnerability with Samsung's Knox security software? Well today Samsung addressed the situation with an official statement, and the good news for folks that rely on Knox is that as long as the software is configured correctly, the exploit won't be an issue.
On its official Knox blog, Samsung explains that the "exploit" uses legitimate Android network functions in a way that they're not meant to be used in order to intercept unencrypted connections from apps on the device. Known as a "Man in the Middle" attack, Samsung's research showed that the issue has nothing to do with Knox or Android, but is actually made possible by unencrypted app data and user-installed programs.
Samsung goes on to say that Knox has a few Knox tools to help protect against Man in the Middle attacks, including Mobile Device Management, Per-App VPN and FIPS 140-2. "Proper configuration of mechanisms available within Knox appears to be able to address the previously published issue," explained Professor Patrick Traynor, an expert on security at the Georgia Institute of Technology. "Samsung should strongly encourage all of their users to take advantage of those mechanisms to avoid this and other common security issues."
Any type of software vulnerability is a big deal that should be taken seriously, but the fact that this purported vulnerability was found in Samsung's security software that's meant to protect against these types of exploits made the matter an even bigger deal. The good news is that Samsung was on top of the matter and found that there's no issue with Knox, which I'm sure puts both the company and its business customers at ease. Samsung's full statement on the situation can be found at the link below.
Via Samsung Knox
- Log in to post comments