How Fast and Deliberate Swiping Gave Us Access to Very Sensitive Data

The talk recounts an internal penetration test for a company that gave field nurses rugged Samsung phones locked down with VMware Workspace One in fully managed mode. Samsung Knox policies blocked Wi-Fi, Bluetooth file transfer and phone settings. Because the phones arrived fully configured, the tester looked at whether the lockdown software itself could be leveraged, rather than only the medical app in scope.

The key observation was timing. While the phone was still booting, before the management launcher's overlay took effect, a few apps could be opened and interacted with. Repeated attempts eventually surfaced Samsung's Edge Panels, a system side menu that stayed usable and kept the launcher paused. With Edge Panels open, the app switcher worked again, so the tester could kill the launcher and remove its permission to draw over other apps. Knox still blocked some features, but Bluetooth restrictions lapsed once the launcher was gone, allowing files to be pulled to a PC, including a system state dump.

The vendor reproduced the issue and worked with Google and Samsung over several months on a fix, which was released with a CVE but not shared with the tester. The speaker suspects Edge Panels is now disabled through Knox policy and that the launcher startup was changed. The practical takeaway is that vendor customizations can open unexpected paths, built-in controls are harder to bypass, and physical devices are preferable to emulators for mobile testing because gestures and hardware buttons behave as in real use.