com.samsung.android.da.daagent Copy

The on-device package for "Dual Messenger", Samsung's One UI feature for running two accounts in the same messaging app. Samsung makes it, and it is signed by a Samsung OEM key in our sample. Samsung's own Common Criteria mode application lists for the Galaxy S20 5G record this package under the name "Dual Messenger" on both the Android 10 and Android 11 builds (versions 3.0.00.0 and 3.1.00.0 respectively). Samsung documents the feature itself under Settings, Advanced features, Dual Messenger, where a user switches on a supported app, installs a second copy of it, and signs in with a second account. The duplicate appears as its own icon marked with a Dual Messenger badge. Samsung notes that only selected models and selected apps support it. For Android Enterprise, EMM and kiosk work, Samsung's position on managed devices is unusually direct: its Knox knowledge base states that the Dual Messenger team no longer supports the Knox framework in device owner or profile owner mode, as it is designed as a consumer feature, and advises that on a device enrolled in either mode the user should sign in to only one account per messaging app. In other words, do not plan around Dual Messenger on a corporate device, and do not expect duplicated app instances to behave predictably under management. A historical security note: in a blog post published in March 2019, researchers at Advania reported that version 2.0.00.0 of this app exported two activities that forwarded unvalidated intents with system-level privileges, letting a third-party app escape the Android sandbox and, among other things, install APKs without user consent. They reported that Samsung addressed it, but that the version number was not incremented, which makes patched and unpatched builds hard to tell apart by version alone. That finding is recorded here as history; whether current builds carry any related exposure was not established during this check. Samsung treats the feature as consumer-only on managed devices, so removing it on a corporate fleet takes away something Samsung does not expect to work there. Confirm the effect on a test device before applying it widely, particularly where a user has already created a duplicate app.

• How do I set up Dual Messenger? - Samsung UK →
• Dual Messenger is not working on corporate-enabled devices - Samsung Knox Documentation →
• Galaxy S20 5G (G981U) application list, Android 11 - Samsung Knox Documentation →
• Galaxy S20 5G (G981U) application list, Android 10 - Samsung Knox Documentation →
• Samsung Dual Messenger Sandbox Escape and Privilege Escalation - Advania →
• Package provenance for com.samsung.android.da.daagent - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 11 permissions: 1 runtime (user-granted), 3 signature or system-level, 2 install-time and 5 vendor or uncatalogued.
• APK size ranges from 2.7 MB to 5.4 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.