Abstract

Introduces Samsung KNOX protection technology, a representative security technology in the hypervisor environment of Android devices, and demonstrates an attack that bypasses kernel protection (or mitigation) technology.

• Linux kernel-based attack and protection, protection bypass technique trends
• Hypervisor-based linux kernel protection and bypass technique trends
• Demonstrated the case of Samsung KNOX (2.x ~ 3.2) bypass attack
• KASLR / PXN / RKP / JOPP / EPV Bypass attack