Carrier IQ Update

Carrier IQ’s secret mobile phone tracking software is headed to court. Three separate class-action lawsuits have been filed against the company and some of its business partners as of Friday, including mobile giants Samsung and HTC.

  TPM

Totally expected.

Mobile phone intelligence company Carrier IQ’s self-named tracking software doesn’t record the contents of a user’s data and is being unfairly targeted by the media and hysterical users, according to several security researchers who have conducted further analysis on the software.

“It records the fact that a keystroke occurs, not the specific key the user entered,” Becky Bace, a former National Security Agency computer engineer and founder and CEO of security consulting firm Infidel, Inc., told TPM via email. “Any keystrokes monitored are limited to the user interactions with the numeric keypad, not the alphanumeric keyboard, and are filtered on input for specific sequences that trigger specific diagnostic actions.”

  TPM

Sounds kinda fishy to me.

“The Carrier IQ app simply doesn’t meet the requirements in terms of functionality or intent to be classified as a ‘keylogger,’” Jon Oberheide, a co-founder of Ann Arbor, Mich.-based Duo Security, said in an e-mail to CRN News.

“The application does not record and transmit keystroke data back to carriers,” Dan Rosenberg, a security consultant at Virtual Security Research, told CNET on Friday. “They’re not recording keystroke information, they’re using keystroke events as part of the application.”

Am I supposed to understand that?

“After reverse engineering CarrierIQ myself, I have seen no evidence that they are collecting anything more than what they’ve publicly claimed: anonymized metrics data,” Rosenberg wrote in a post on Pastebin on Wednesday.

Or that?

That said, Rosenberg also added that “the fact that there are hooks in these events suggests that future versions may abuse this type of functionality, and CIQ should be held accountable and be under close scrutiny so that this type of privacy invasion does not occur.”

Now that, I understand.

...but hey, do what you want...you will anyway.

Even Faster Than I Expected

The Carrier IQ scandal has drawn the ire of at least one lawmaker. U.S. Senator Al Franken (D-MN) published a letter to Carrier IQ on Thursday saying he’s “very concerned” about reports of the company’s software tracking a staggering amount of user information.

Franken also demands that the company and its CEO, tech veteran Larry Lenhart, provide answers to a list of 11 questions about just how Carrier IQ operates, what information it collects and to whom the information is transmitted. Franken wants answers within two weeks, by December 14.

  TPM

Al must be using an Android system cell.

...but hey, do what you want...you will anyway.

UPDATE

In the Land of the Free

I just bought an Android system smartphone.  Ooops.

An alarming new video published to YouTube this week by a 25-year-old security researcher seems to reveal a piece of hidden software included on virtually all new Android smartphones that records every last keystroke users make, sending the data back to its creator in secret later on.

Called “Carrier IQ,” the software is supposedly meant to help mobile carriers monitor and diagnose problems with their devices. The company that makes the software insists it does not log keystrokes, but 25-year-old Trevor Eckhart seems to have proved that claim quite wrong.

Not only did he demonstrate the software capturing his keystrokes from a text message, it was being recorded even before the message he typed was displayed.

“It should be noticed that, if we scroll down a little further [in the logs], here’s where the message is actually being displayed in the end user’s inbox,” he explained. “So, all of the IQ agent processes is happening before the end user even sees the [text].”

Eckhart also demonstrated how the software can read Internet searches over secure connections, meaning that not even encrypted communications are completely private on Android phones.

“We can see that Carrier IQ is querying these strings over my wireless network [using] no 3G connectivity, and it is reading [a secure communication],” Exkhart explained.

He also showed how, even after opting out of using location identification services, Carrier IQ still sends phone location data to its creators. Additionally, Eckhart illustrates how the software keeps itself hidden, is impossible to remove through stock toolsets, and gives the user no choice in whether it may run in the background.

[...]

“Our action was misguided and we are deeply sorry for any concern or trouble that our letter may have caused Mr. Eckhart,” the company later said. “We sincerely appreciate and respect EFF’s work on his behalf, and share their commitment to protecting free speech in a rapidly changing technological world.”

All of the above was enough for Wired magazine to call Carrier IQ one of the top reasons to “wear tinfoil hats” this holiday season.

  Raw Story

I guess I won’t be contacting Venezuela on my cell.

Android, however, is not the only smartphone operating system with security concerns. Earlier this year, researchers Alasdair Allan and Pete Warden discovered that Apple’s iPads and iPhones contain a database with thousands of location points that gets downloaded every time the device syncs with a PC or Mac.

[...]

It includes latitude, longitude, a time stamp, and the IP address for the wireless network the phone was currently accessing.

And as we all know, criminals use burn phones, so what’s the point? Uh-huh. Brave New World.

...but hey, do what you want...you will anyway.

UPDATE:  Al Franken to the rescue