Carrier IQ: Researcher Trevor Eckhart Outs Creepy, Hidden App Installed On Smartphones

[onehandle]

Source: Huffington Post

A security researcher has posted a video detailing hidden software installed on smart phones that logs numerous details about users' activities.

In a 17-minute video posted Monday on YouTube, Trevor Eckhart shows how the software – known as Carrier IQ – logs every text message, Google search and phone number typed on a wide variety of smart phones - including HTC, Blackberry, Nokia and others - and reports them to the mobile phone carrier.

The application, which is labeled on Eckhart’s HTC smartphone as "HTC IQ Agent," also logs the URL of websites searched on the phone, even if the user intends to encrypt that data using a URL that begins with "HTTPS," Eckhart said.

The software always runs when Android operating system is running and users are unable to stop it, Eckhart said in the video. "Why is this not opt-in and why is it so hard to fully remove?" Eckhart wrote at the end of the video.

Read more: http://www.huffingtonpost.com/2011/11/30/carrier-iq-trevor-eckhart_n_1120727.html

[pennylane100]

1. Well in a waty, this is good news for me.

I cannot find my phone, I know it is somewhere in the house, and the battery is out so I cannot locate it. Maybe Google can help me find it.

[TheWraith]

2. Makes me glad I have Samsung phones, then. nt

[onehandle]

20. Samsung too --->

http://www.forbes.com/sites/andygreenberg/2011/11/30/phone-rootkit-carrier-iq-may-have-violated-wiretap-law-in-millions-of-cases/

[Name removed]

3. Deleted message

Message removed by moderator. Click here to review the message board rules.

[Ian David]

4. I mostly use mine for porn. n/t

[The Doctor.]

44. Yeah, we know.

And so do they.

[EFerrari]

5. I'm with you. I'm hanging onto a phone that is years old,

works fine for phone calls and that will never go on the net. Got the idea from Egyptian activists who had multiple phones with different tech capabilities.

[Name removed]

10. Deleted message

Message removed by moderator. Click here to review the message board rules.

[rox63]

6. This makes me appreciate my simple, pre-paid phone

I use it to make phone calls, and send the occasional text message. I spend more than enough time in front a computer. I don't need one in my pocket.

[pnorman]

7. I'm gettng onto the internet by

"tethering" my Samsung 'Droid' to my netbook. Would I also be subject to that invasion of privacy?

On edit: The App is called "Easy Tether:". It makes for a reasonably sturdy connection, and with fairly good data throughput.

[TheWraith]

16. They don't mention Samsung phones as being affected. nt

[LiberalArkie]

18. It is any phone running the Android system

[TheWraith]

25. No, since they mention Blackberry and Nokia as well.

Neither of those has anything to do with Android.

[denem]

28. Apple? Since Carrier IQ is a US Corporation, it should be

relatively easy to find out if Apple is one of its customers.

[onehandle]

56. They're not. Apple is not one of them. Samsung, HTC, Nokia and RIM are. nt

[Kali]

29. what carrier do you use? and have they bitched about your data usage?

[pnorman]

54. Sprint, and my data plan while not the unlimited one

still handles my normal load, But I guess that if it goes through the phone, I'm sill at risk!

[bobthedrummer]

8. Cui bono? K&R

RECALL WALKER/KLEEFISCH!!!

[greiner3]

9. I'm of the mind;

That if a technology exists, it will be used.

[EFerrari]

11. Yep.

[Ezlivin]

12. Is this the party to whom I'm speaking?

[potone]

13. Thanks!

I needed a laugh!

[Chipper Chat]

14. I used to work one of those switchboards in the 50s.

It was fun. All that plugging and unplugging. And of course if someone called your boss's extension you could flip a lever and listen in. Oh, the shame!

[louis-t]

15. My office keeps insisting I get a smart phone.

No thanks, I'll keep the stupid one. At least, that's what I call it every time it drops a call.

[Atman]

17. I hate Apple!

Oh, wait. This wasn't about the iPhone. Never mind.

[LiberalArkie]

19. I think it was Sprint that said it was worried the the iPhone would use way too much

of its bandwidth, after the iPhone hit the Sprint network they said that Androids used a tremendous amount more than the iPhone did.

Now we know why.

[jbnow]

36. Who knows. Remember ipad was trracking people's location

without them knowing.
Who knows who does what to what
Maybe it just isn't found yet

[onehandle]

21. LOL! Happy in my 'walled garden.' nt

[LiberalArkie]

23. Yep, me too.. Too many techies look at the IOS for anyone to get something like that in.

And Carrier IQ is a private company... I wonder who the investors of it are?

[TheWraith]

26. Not really.

We're talking about carrier installed software, here. If something like this were on the iPhone, there would be relatively little chance of it being found. Remember, the only way it was found out that iOS was logging your GPS coordinates all the time was because of a bug where the logfile got too big.

[tinrobot]

31. Can you tether from your walled garden?

I thought not.

[onehandle]

33. Yes.

But I don't. Free WiFi is so common these days, I just don't need it.

[tinrobot]

34. Looks like that permission was just revoked.

Apple Pulls iTether App From Store

As a hangover follows a night reading Instapaper in bed with a bottle of whisky, so a rude ejection follows the approval and sale of a data tethering app in Apple’s App Store. This time it’s iTether, which we advised you to to snap up yesterday for a rather steep $15, despite the fact that it may not work so well.

Unlike last year’s Handy Light, which sneakily sequestered a tethering function inside an iPhone flashlight app, iTether comes from a company–called Tether–that already has some pedigree in mobile applications. Specifically, it makes a tethering app for the Blackberry. The company’s blog details the story.

According to Tether’s Patrick Hankinson, Apple contacted the Halifax-based company yesterday at around 12PM EST to let it know the app would be pulled. The reason given was that the app “burdens the carrier network.” This comes despite Hankinson’s assertion that his company submitted a video demo of the app, and also made “very clear when listing the app what the primary function was.”

The real reason is likely that Apple has agreements in place with its carriers not to allow such applications. Hankinson says that Tether’s average users consume no more than 200MB per month when using its apps. And given that all but the earliest iPhone and iPad users are on metered data plans, the excess use excuse seems flimsy.

http://www.wired.com/gadgetlab/2011/11/apple-pulls-itether-app-from-store/

[onehandle]

35. Because the carriers have their own tethering plans.

I don't jailbreak either. The walled garden is a nice place.

[tinrobot]

46. The walled garden is comfortable, freedom is often uncomfortable

I'm always amazed as to how quickly people cede their freedoms for the sake of comfort. Not just in the digital realm, either.

I'm sure you've studied democracy and know that freedom requires responsibility. Our personal freedoms are very much tied to freedom of information, among many things. If you want to maintain freedom over your information, you also need to take responsibility for it, rather than cede that responsibility to one of the largest corporations in the world.

They call it 'jailbreak' for a reason, you know.

[LanternWaste]

58. I imagine that reason is simply

"They call it 'jailbreak' for a reason, you know..."

I imagine that reason is simply a trendy and melodramatic cynicism.

[Atman]

38. You thought not. But you thought wrong.

Yes, I can tether my iPhone account. Hater.

[tinrobot]

39. How much does that cost?

[Indydem]

43. The same as it costs Android users

No carrier allows free tethering of phones to other devices any longer. Even those using the feature on Androids must add the tethering option to their data plans - usually $20.

[tinrobot]

47. It's still free on T-Mobile

It was also free on Sprint... that is, until they offered the iPhone.

Hmmmmm.

[Name removed]

27. Deleted message

Message removed by moderator. Click here to review the message board rules.

[ashling]

22. and reports them to the mobile phone carrier.

oh, yes, and to News Corp as well. :evilgrin:

[denem]

24. and then relayed to the NSA?

[caseymoz]

30. I'm in a minority. I prefer dumb phones. Dumber than I am, preferably.

Think about it, why should you carry something in your pants or in your purse that could outsmart you? Especially when the government or corporations can take command of it at any time.

[tinrobot]

32. Just install a clean version of Android - problem solved.

Here's a good one : http://www.cyanogenmod.com/

No spyware, no walled gardens, and the phone is all yours.

[backscatter712]

41. ++

I've got Cyanogenmod running on my HTC G2 - I've got no complaints.

And no rootkit!

It did take a little technical know-how to figure out how to root my phone so I could install CyanogenMod...

[carlos3k]

53. also rooted

Cyanogenmod running on my 2 year old Aria :)

If you want to get rid of the bloatware and secret spy stuff wipe the OS on your phone by rooting it!
Check out XDA-Developers, a community of phone gurus that do this for fun.
If you like their work donate to the EFF and keep the open source open.

thanks for your time.

[Psephos]

45. Best answer by far. n/t

[peacebird]

37. Is there anything like that on my ipad2?

[backscatter712]

40. Very likely - Carrier IQ has software for Androids, Blackberrys and iPhones/iPads.

[Indydem]

42. WRONG

The Carrier IQ software is NOT included in iOS.

This is an Android / Blackberry / Nokia problem.

[backscatter712]

61. Nope. It's on iPhone as well.

http://news.cnet.com/8301-13506_3-57334575-17/carrier-iq-tracking-iphone-customers-too-hacker-says/

[Indydem]

65. Read the article you linked to.

"However, Chpwn seems to believe that Carrier IQ works much differently on the iPhone. In fact, disabling its tracking in iOS is as simple as tapping over to the "Diagnostics and Usage" menu in the settings pane and toggling it off. Upon doing so, Chpwn says, no information is shared with Carrier IQ.
For those who don't turn the feature off, Chpwn claims Apple's Carrier IQ installation shares much less information than Android devices. He found that iOS shares "your phone number, your carrier, your country, active phone calls, and your location." However, unlike Android, Apple's installation doesn't share the phone number a user has dialed and only includes location information when "location services are enabled."
"I am reasonably sure it has no access to typed text, web history, passwords, browsing history, or text messages, and as such is not sending any of this data remotely," Chpwn wrote."

Ability to disable, no logging, etc. This isn't even the same kind of software.

[onehandle]

55. No. This is a Samsung, HTC, Nokia and RIM problem. Apple is clear.

If this was Apple, it would be major headlines everywhere.

[MellonCollie]

59. Apple iPhone linked to Carrier IQ 'spyware'

http://www.telegraph.co.uk/technology/apple/8928053/Apple-iPhone-linked-to-Carrier-IQ-spyware.html

It looks like it might be in iOS, but crippled/disabled.

[backscatter712]

60. Nope, Carrier IQ is running on iPhone too.

http://news.cnet.com/8301-13506_3-57334575-17/carrier-iq-tracking-iphone-customers-too-hacker-says/

[onehandle]

62. Not on mine. There is no 'Diagnostics and Usage' menu. Maybe they mean in Europe.

European carriers are more likely to put 'crapware' on your phone than American companies for some reason.

[backscatter712]

64. It's certainly running on some iPhones.

Definitely a concern.

[DissedByBush]

48. And then they threatened to sue to shut him up

And then the EFF stepped in.

They have since apologized.

[boppers]

49. Technical Failures Abound.

1. Thinking a GUI controls running processes.... FAIL.
2. Thinking that "displayed applications" is the sum of all binaries.... FAIL.
3. Thinking that computer devices don't log the shit out of everything in various debug modes.... FAIL.
4. Thinking that apps don't log and cache https URLs..... FAIL.

Seeing as how his desktop/laptop is running Ubuntu, he's going to blow a fuse when he finds /var/log, or looks at top.

That being said, at least all the breathless (if mis-informed) reporting is raising awareness about how computing works.

[SoapBox]

50. I solve a bunch of this...I have a dumb phone...I don't text...I don't do Facebook...

there is a lot of shit that I just don't do...I don't have time.

But all this crap with phones...no problem. I hate phone calls and
I don't waste my time with texting. Email has become a total pain
in the ass and I've always got hundreds of mails piled up in multiple
accounts...it is simply now an overwhelming bother.

[garybeck]

51. FYI, your ISP for your desktop computer also gets that info.

every website you access gets routed through your ISP and they record it.

this phone thing is a little more creepier but essentially the same thing is already happening on our desktops.

[mwooldri]

57. With a VPN it's harder.

All your ISP will see is a connection between you, the VPN (virtual private network) and a stream of scrambled data if you so chose to encrypt the connection.

Still, it is traceable... but it can make things interesting for those trying to...

[AllyCat]

52. Every day, another reason surfaces that makes me glad I have a dumb phone

Like someone else has said...I spend enough time on the computer. I don't need one in my back pocket. I don't need to be connected every minute of every day.

[pscot]

63. Every breath you take...

I'm surprised that anyone is surprised at this.

[Name removed]

66. Deleted message

Message removed by moderator. Click here to review the message board rules.

[bvar22]

67. Don't Worry.

Big Brother LOVES you,
and only wants to keep you safe.
If you have nothing to hide,
you have nothing to worry about.







Solidarity99!
--------------------------------------------------------------------------------------------------------------------------------