com.samsung.android.server.wifi.mobilewips Copy

Labelled "MobileWips", this is the on-device piece of Samsung's Wireless Intrusion Prevention System (WIPS) on Galaxy devices. Samsung documents WIPS as an administrator-facing capability: the Knox Service Plugin exposes an "Enable WIPS control" policy to "enable WIPS enforcement and protection options for the device", an enforcement policy that when set "disallow[s] a device user from bypassing WIPS protection", and an advanced-protection policy that stops a user changing the WIPS configuration. Samsung's own description of the user-facing side is that the device alerts people to suspicious networks so they can decide whether to connect. The mapping from this package to that feature rests on the package itself rather than on a Samsung page naming it: it is Samsung platform-signed, sits in the Wi-Fi server namespace, and its permissions include Samsung's com.samsung.permission.WIFI_WIPS along with KNOX_DEVICE_CONFIGURATION, LOCAL_MAC_ADDRESS, CHANGE_WIFI_STATE and SYSTEM_ALERT_WINDOW, which is the permission set a Wi-Fi monitoring and alerting service needs. It has no launcher icon. For Android Enterprise, EMM and kiosk deployments this is a security control rather than bloat, and it is one an administrator may already be configuring through the Knox Service Plugin. Disabling it would remove that protection and make the corresponding Knox policies meaningless on the device, so treat it as caution, particularly on estates that rely on Wi-Fi in public or shared spaces. Where the aim is to change behaviour rather than remove it, the Knox Service Plugin policies are the supported route. Version note: Samsung states that the feature alerting users to suspicious networks, built on top of its WIPS, arrived with Knox 3.5 (February 2020) and was available from the Galaxy S10 onwards, so behaviour on older Knox versions differs. Samsung's Knox Service Plugin policy documentation does not state a minimum Knox version for the WIPS policies themselves, so that specific detail is not asserted here. This site records the package on API 31 through API 37 devices.

• Advanced Restriction policies - Knox Platform for Enterprise, Samsung Knox Documentation →
• What's new in Knox 3.5? - Samsung Knox →
• Package provenance for com.samsung.android.server.wifi.mobilewips - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 11 permissions: 1 runtime (user-granted), 3 signature or system-level, 4 install-time and 3 vendor or uncatalogued.
• APK size ranges from 0.4 MB to 3.5 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.