com.samsung.android.bbc.bbcagent Copy

A Samsung system component that every observation on this site reports under the terse label "BBCAgent", untranslated in every locale recorded, so the label is a code name rather than a description. It is preinstalled, Samsung-signed with certificates this site also records as signing the framework, has no launcher entry on any of the 44 devices that report it, and is not marked Play-eligible on any observation, so it changes only with firmware. Samsung lists it by name and package in its Common Criteria mode application lists as far back as the Galaxy Note9 on Android 8, which establishes that it is a standard part of the Samsung image, but those lists are inventories rather than descriptions. No Samsung documentation was found that says what it does, so this note does not expand the abbreviation and does not guess at it. Consumer sites state its purpose confidently, but the ones found were app catalogues and content pages with no evidence behind them, so they are not cited. What the manifest does establish is the area it works in. Per this site's provenance record it declares BIND_DEVICE_ADMIN, MANAGE_DEVICE_ADMINS, MANAGE_USERS, INTERACT_ACROSS_USERS, INTERACT_ACROSS_USERS_FULL, BROADCAST_PACKAGE_ADDED, INTERNET, ACCESS_NETWORK_STATE and RECEIVE_BOOT_COMPLETED, alongside a block of Samsung enterprise permissions: com.samsung.android.knox.permission.KNOX_ENTERPRISE_DEVICE_ADMIN, KNOX_CONTAINER, KNOX_KIOSK_MODE, KNOX_CUSTOM_SYSTEM and KNOX_CUSTOM_SEALEDMODE, plus com.sec.enterprise.knox.permission.KNOX_SEAMS and com.sec.enterprise.permission.MDM_PROXY_ADMIN_INTERNAL. Those names are not incidental: Samsung's own Knox SDK tutorial for kiosk mode tells developers to declare KNOX_KIOSK_MODE among the permissions an application needs to drive kiosk mode. So this component sits squarely in the device administration and Knox namespace. Whether it is granted any of these at runtime, or exercises them, is not something this site records, and no claim about its behaviour is made here from the permission list alone. One oddity is worth recording because a reader comparing manifests will see it. This site records a requested permission written as android.Manifest.permission.INJECT_EVENTS. A string in that form is the Java constant reference rather than the permission name the platform matches on, which is android.permission.INJECT_EVENTS, so as written it corresponds to no defined permission. It reads as a manifest authoring mistake rather than a granted capability, and it is reported here as an observation rather than as a finding about what the component can do. Version note: this component has been carried across many releases rather than reworked. Samsung's application lists record version 3.2.00.2 on the Galaxy Note9 on Android 8, 5.0.00.4 on an Android 10 Galaxy S20+, and 5.0.00.16 on Android 11 devices, and a Nougat era Galaxy S8 list records "BBCAgent" at 2.8.00-27 in a table that carries no package column. This site's sample runs API 28 to 37 with versions 5.0.00.25 to 5.0.02.0, target SDK 29 to 36, and package sizes from roughly 69 KB to 381 KB. A version series that has stayed in the 5.0.x range from Android 11 to the present suggests maintenance rather than redesign. Whether its role changed in any recent Android or One UI release could not be sourced, and the wide size spread within one version series is not explained by anything published. For Android Enterprise, EMM and kiosk use, no evidence was found that this package takes part in enrolment, in Android Management API policy, or in any documented Knox administrator workflow, and nothing suggests an EMM interacts with it directly. The practical read for a managed fleet is that it declares permissions in the same namespace as Knox device administration and kiosk control, and Samsung publishes nothing about what depends on it, so removing it blind on a Knox-managed or kiosk device risks breaking something that will not be obvious until it fails. Because its function could not be established, no confident assessment is possible beyond that. Where a Samsung preinstalled app genuinely has to go, Samsung documents blocking it by package name through Knox Manage's application policies rather than removing it; test on a single device before applying it to a fleet.

• Galaxy Note9 (SM-N960N, Android 8) Common Criteria mode application list - Samsung Knox Documentation →
• Galaxy S20+ 5G (SM-G986U1, Android 10) Common Criteria mode application list - Samsung Knox Documentation →
• Galaxy S21+ 5G (SM-G996B, Android 11) Common Criteria mode application list - Samsung Knox Documentation →
• Galaxy S8 (SM-G950U1) Common Criteria mode application list - Samsung Knox Documentation →
• Declare permissions for kiosk mode - Knox SDK - Samsung Knox Documentation →
• Enable or disable a specific system app - Knox Manage - Samsung Knox Documentation →
• Package provenance for com.samsung.android.bbc.bbcagent - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 17 permissions: 5 signature or system-level, 3 install-time and 9 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.