Cheating KNOX by cracking stock ROM certificate

Question

I had some thoughts about KNOX and the fact that flashing stock ROM doesn't trip my KNOX flag. I did some research about the topic and I learned that KNOX checks ROM file's certificate or something like that. The files within a zip archive have .md5 file extension. Knowing a fact that MD5 is flawed hashing function which is considered broken so I can theoretically crack the password which it used to create md5 file checksum. Having this password I can sign a custom ROM with it and KNOX should be bypassed successfully. Are my thoughts correct and it's feasible or I misunderstanded something?

Answer 1

If it was that simple it would have been broken long back. Knox is almost fool proof and prevents any such attempts

Samsung KNOX addresses security using a comprehensive, hardware-rooted trusted environment:

• Hardware Root of Trust

• Secure Boot and Trusted Boot

• Security Enhancements for Android (SE for Android)

• TrustZone-based Integrity Measurement Architecture (TIMA)

• TrustZone-based Security Services

Source: White paper on Knox by Samsung

You can see the technical details but to summarise any changes made trigger a fuse that would flag tampering

(Fuse is)...one-time programmable memory area (colloquially called a fuse) is written to indicate suspected tampering.

Next, hardware root of trust is specific to each device and that verification would fail

Even flashing an older version of stock ROM would trigger the fuse

Rollback prevention fuses are hardware fuses that encode the minimum acceptable version of Samsung-approved executables. These fuses are set at manufacture time in the Samsung factory. Because old images may contain known vulnerabilities that can be exploited, this feature prevents approved-but-old versions of boot executables, from being loaded.

To summarise, you would see that it won't work