Slashdot Mirror

It's repulsive the sort of tactics that commie chinamen will stoop to, putting backdoors into their products like that. Why, here in America, those are 'features' that you consent to by opening the package, as documented on page 46 of the EULA, as interpreted in mandatory binding arbitration by the company's legal team! It must suck to live in such a benighted, unfree, country, where your cellphone is probably spying on you and may well come preloaded with malware...

Make your software send it...

I recommend call information, web history, and keystrokes. For more information check out CarrierIQ
(this time I'm logged in)

Fact is: They sold you a phone with a rootkit installed that could record and transmit anything without your notice or your consent.

My phone was not purchased from Carrier IQ.

I think he meant "they" as in "The Man," not as in "Carrier IQ."

It may just be counting them. From a press release [pdf] Carrier IQ issued about this issue:

While we look at many aspects of a device's performance, we are counting and summarizing performance, not recording keystrokes or providing tracking

If they count keystrokes they probably do that by adding an eventhandler to the appropriate event and have it add 1 to a counter on each keystroke. If you let a debugger show those method calls I would expect to see exactly what the video shows. The SMS and HTTPS search URL look similar to me: event handlers being called with event data.

Carrier IQ may be doing nothing more than they claim they do: count things. Perhaps they are doing nastier things, but I don't see anything that convinces me of that in this video. The video shows methods being called, not what is being done with the data.

Having said that, I think that a user should be the user's choice to have statistics being collected about him/her. It should be possible to disable Carrier IQ, it shouldn't even be enabled without the user's permission.

Looks like CarrierIQ is trying to save face in their PA http://www.carrieriq.com/Media_Alert_User_Experience_Matters_11_16_11.pdf I wonder, I'm not entering a contract with CarrierIQ, are they collecting this data to their own servers then sending the data to the carriers or are the carriers collecting the data?

Check them out at http://www.carrieriq.com/

I'm going to go with everyone else here and wonder where you got that information. As one of the AC's pointed out, the best I can find directly saying it is the following sentence:

Currently, Trevor has found CarrierIQ in a number of Sprint phones, including HTC and Samsung Android devices. CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well.

That grammar is screwed up and makes the most sense by adding in a "not" to read "CarrierIQ is not confirmed to be found on the iPhone or on feature phones".

At http://www.carrieriq.com/company/careers.htm, under the Senior Software Engineer position, it does give this as well for Job Requirements:

1+ years of application development experience on at least one other mobile platform (iPhone, Windows Mobile, BREW, Symbian, and so on.)

That's the best that I can find supporting that it is on the iPhone.

Personally, I wouldn't doubt for a second that something like this is on the iPhone (I would almost be more surprised if there wasn't, actually), but I'm not really seeing any strong evidence.

Tons of jobs on offer at CarrierIQ

Android is clearly the target
"Design, implement, extend and port our Java and C/C++ components of our mobile software technology for Android. ... Integrate our library onto new Android releases and OEM hardware platforms."

"The embedded device agents are currently shipped on more than 75 million devices across numerous device manufacturers and models. The solutions can be deployed across multiple wireless technologies such as CDMA2000, GSM, UMTS/WCDMA, WiFi, and device types such as feature phones, smart phones, PDAs, data cards."