CarrierIQ: Most Phones Ship With "Rootkit"

First time accepted submitter Kompressor writes "According to a developer on the XDA forums, TrevE, many Android, Nokia, and BlackBerry smartphones have software called Carrier IQ that allows your carrier full access into your handset, including keylogging, which apps have been run, URLs that have been loaded in the browser, etc." Since this was submitted, a few more details have come to light. The software was designed to give carriers useful feedback on aggregate usage patterns, but the software runs as root and the privacy implications are pretty severe.

Comments

Doesn't Matter

[Anonymous Coward]

It doesn't matter because Android is open.

That's all that matters.

Re:Doesn't Matter

[Anonymous Coward]

In open source, the user can do whatever he or she wants with the software.
In proprietary software, it's the other way around.

Re:Doesn't Matter

[WorBlux]

But many of the drivers and first stage bootloaders aren't

Re:Doesn't Matter

[circletimessquare]

in soviet software land, software programs you!

Re:Doesn't Matter

[ByOhTek]

I think the GPs point is that, in this case, the latter can also be true for open source software.

Re:Doesn't Matter

[Anonymous Coward]

The Android that you can get from Google's websites may be open but the software you physically get on phones is usually closed (it's neither FSF-free nor DFSG-free). If you're not convinced, read Stallman's article on it.

Re:Doesn't Matter

[bmwEnthusiast]

You're right, it doesn't matter. My rom developer strips carrierIQ from his roms as part of his cooking process. I'm freeeeeeeeeeeeeee!

Re:Doesn't Matter

[Bert64]

But the point is that an open version is available, and thanks to third party mods like cyanogen if you don't like the version shipped with the phone you can replace it...

Re:Doesn't Matter

[marcosdumay]

Or maybe his point was that, if Android was really open such things would be easy to fix.

Re:Doesn't Matter

[Anonymous Coward]

So, toss us a clue here. Which ROM do you like?

Re:Doesn't Matter

[Anonymous Coward]

PRECISELY, because you can install on your device a version of the OS that has been inspected by the community and does not include this kind of malicious behavior. This is the difference from an iPhone, where you might obtain evidence of the presence of such rootkit by looking at the data sent by the phone, but you will never be able to remove it. Btw, according to the article that "rootkit" is also installed on iPhones.

So... YOUR IRONY IS TOTALLY MISLED...

Re:Doesn't Matter

[Anonymous Coward]

It's free. That's what matters.

Re:Doesn't Matter

[Tharsman]

I'll tell my grandma to go do that right away! She is always paranoid about her privacy, I'll tell her all she needs to do is get cyanogen and replace her OS!

Re:Doesn't Matter

[Anonymous Coward]

The next question is: when you install cyanogen, are you installing it, in Xen-speak, to Dom0 or to DomU?

Re:Doesn't Matter

[zill]

Android smartphones uses proprietary software and hardware. Film at 11.

Even the so called "open source phone", the Neo FreeRunner, relies on a proprietary baseband OS. The sad reality is that the open source philosophy does not lend well to the hardware world, where the hardware equivalent of "compilation" costs few million dollars each time and can only occur at a few dozen select locations on Earth.

Re:Doesn't Matter

[Runaway1956]

What Marcos said. Android is not "open source". It's "kinda sorta open to downstream proprietors, but not to end users", which is not open source at all.

I'm one who likes a lot of what Google does, but I'm no blind fanboi. Google dropped the ball when they permitted downstream customers to close their source. And, that's why I'm using a "dumb phone"*, with no plans to upgrade. I'm not about to pay the phone company hundreds of dollars, PLUS an exorbitant contract fee, so that they can spy on me.

* It should be noted that even old "dumb phones" are pretty easy to spy on, albeit to a lesser extent than is exposed in this and other recent articles.

Re:Doesn't Matter

[Tharsman]

Ironically, the process of jailbreaking iOS to allow such removals is generaly easier to than the process of installing a new virgin version of the Android.

Re:Doesn't Matter

[zill]

No, you cannot replace the first stage bootloader and the baseband, so they will forever remain proprietary. There is no way to have a working Android phone without running proprietary code unfortunately.

You can, however, get Android running without relying on proprietary code. It just won't work as a phone unfortunately.

Re:Doesn't Matter

[gauauu]

What Marcos said. Android is not "open source". It's "kinda sorta open to downstream proprietors, but not to end users", which is not open source at all.

Well, it's not "free" according to GPLv3 (android devices can be Tivo'ised preventing you from running modified code), but anyone can download the android source and modify and rebuild it. If your device supports it (many do), you can run your modified code on your device. I'm not sure how you can say Android isn't open source, as that's pretty much the definition of open-source.

Now you could argue that it's not "free" as defined by RMS and the FSF, and you'd have a decent argument. But claiming it's not open source is just incorrect.

Re:Doesn't Matter

[Ossifer]

I disagree. The very real risk (result!) is from the carriers putting crapware/spyware/etc. that you can't remove. I don't fear Google or Apple in this respect. Consider that yesterday it was revealed that Japan's largest carrier doesn't sell the iPhone precisely because Apple won't allow them to install such things.

Secondly, I don't consider it truly open source, unless I can reasonably make changes, which you can't do with Android phones currently on the market.

Re:Doesn't Matter

[zill]

And, that's why I'm using a "dumb phone"*, with no plans to upgrade. I'm not about to pay the phone company hundreds of dollars, PLUS an exorbitant contract fee, so that they can spy on me.

So you think they can't spy on you with the proprietary code on your dumb phone?

Re:Doesn't Matter

[Archeopteryx]

And the number of people capable of doing a brain transplant on an Android phone is probably in the 10,000s. Millions and millions of people are vulnerable and there isn't much they can do about it other than taking a hammer to the phone.

Re:Doesn't Matter

[Kral_Blbec]

Yup. And anyone who runs android can get a rom with CiQ stripped from it.

Re:Doesn't Matter

[Drakino]

Only parts of Android are open source. Other parts, including key infrastructure pieces and the majority of apps people use that ship on the devices are closed.

And open source here is a license that doesn't require Google to disclose the source when shipping, leading to every Android Honeycomb tablet that shipped this year being a closed platform until this week.

Google has severely muddied the meaning of open and open source compared to what we are used to from the GPL and Linux worlds.

Never let your hatred of Apple, Microsoft or whoever to cloud your judgement of the companies you do cling to. Google's "open" message is eerily similar to FUD messages Microsoft was spreading in the 90s when it came to Java and "open computing". The quicker we hold these companies accountable, the quicker it improves. Getting stuck in fanboy wars and putting on the blinders helps no one.

Re:Doesn't Matter

[Runaway1956]

Either I forgot to put an * and a disclaimer in my post - or you failed to read it.

Re:Doesn't Matter

[symbolset]

You do know that it's a tracking device, right? That's how they know which tower to route the call from? If the battery is in the phone they know who you are and where you are - even with a dumb phone.

Re:Doesn't Matter

[Anonymous Coward]

Now you could argue that it's not "free" as defined by RMS and the FSF, and you'd have a decent argument. But claiming it's not open source is just incorrect.

Actually, you wouldn't have a decent argument. "Free software" and "open source", as defined by the FSF and OSG respectively, are as near semantically equivalent as you can get, including a whole slew of permissive licenses like Apache. The term Stallman uses for GPL (and similarly restrictive licenses) is "copyleft", which is either a horrible pun or a misunderstanding of what "copy" in copyright means (it's a noun, as in "copywriter", referrring to the work, not a verb meaning to duplicate)

And of course Android is not copyleft, and nobody would argue it is. Then again, neither is netBSD, and I somehow do fine with that on my home desktop with no worries of rootkits. Conversely, even copyleft doesn't prevent tivoisation per se, which is why GPLv2 is still considered a copyleft license.

The big problem is tivoisation, implemented as locked-down bootloaders in many phones, preventing you from compiling and installing your own non-rootkitted software. If the only thing stopping the vendor from rootkitting you is the trust that they will really comply with the GPL and release full source (including the big-brother patches, which may well be "protected" as state secrets, if they're sharing collected info with the right people), you should assume you're rootkitted already. A secondary problem is the proprietary platform-specific drivers and codecs, making it difficult to get full functionality of the hardware with your own non-rootkitted software (and copyleft does help alleviate this, by making it more effort to separate binary blobs far enough to comply), but between reverse-engineering and dropping these blobs wholesale into your new system (on the theory that, say, an h.264 DSP codec is unlikely to be a spy platform), this is less of an issue than the locked-down bootloaders.

Re:Doesn't Matter

[Anne Thwacks]

Do your duty: The best reason to have grandchildren is so they can install Cyanogenmod for you.

Re:Doesn't Matter

[lindi]

cyanogenmod claims to have 745,259 users currently. I am not sure if it is completely free or not but clearly more than 10000 users are using unofficial and modified version.

Re:Doesn't Matter

[dannys42]

I think what Runaway was trying to say is that Android is open source, but Android-based phones are not generally a very open platform because of the carrier's Tivo'ization.

Re:Doesn't Matter

[KingMotley]

I'm not sure how your definition makes your complaint any less valid. Those are the same 10,000 people that could recompile the source if it was your version of open source, or does being able to get the exact source from motorola somehow make it easier than to get it from google?

Re:Doesn't Matter

[PoopCat]

If she's that paranoid, she'll learn how, or find someone to do it for her. Good thing she has an android where this sort of thing is out in the open, and she has the option of changing her software!

Re:Doesn't Matter

[kruhft]

That's the first thing I did when I got my Nexus S. Wiped it, built Android and installed it. Then I was quite sure I had a clean phone.

Re:Doesn't Matter

[Anonymous Coward]

Well, it's not "free" according to GPLv3

Neither is Linux, and that's a good thing.

Re:Doesn't Matter

[bberens]

There's a few small businesses in my city that will root your phone for you, install cyanogenmod, etc. Some of their services are completely legal, some are in the gray area.. but you can get it done by someone for about $100.

Re:Doesn't Matter

[HereIAmJH]

If your grandma was truly paranoid about her privacy, she'd know any number of people who could load a replacement OS on her phone for a few dollars.

When my niece had her iPhone she paid to have someone jailbreak it. It wasn't hard to find some one, and it wasn't expensive. And with it, every time Apple pushed a new release she had to pay to do it again. With cyanogen you wouldn't have to update the phone OS as long as you didn't need a feature fixed. Many 'feature' phones go from birth to death with the factory installed image.

Does your grandma change her own oil in her car?

Re:Doesn't Matter

[adolf]

There is no spoon.

Re:Doesn't Matter

[Nemyst]

Android is open source. That non-essential applications using the platform are not is unrelated to the subject at hand. If you can run Android in a functional manner without the closed-source applications installed, then Android is by definition open source.

That's like saying Linux isn't open source because it can have proprietary drivers.

Re:Doesn't Matter

[amRadioHed]

You don't need to install a new version of Android to remove this software. The Android equivalent to jailbreaking is rooting.

Re:Doesn't Matter

[Anonymous Coward]

But many of the drivers and first stage bootloaders aren't

This is akin to saying that the fglrx driver means that Linux is not open source.

Linux is not responsible for fglrx, and Google is not responsible for what people do with/to android.

Just get a phone that allows you to easily install Cyanogen or other alternate ROMs. Done.

Re:Doesn't Matter

[farble1670]

android is open source, it's just that you don't know the definition of open source. OSS is software where the source is available, period. it doesn't mean users of the OSS are bound to GLP-like agreements, unless the OSS is GPL (which android is not). if you don't like the non-OSS that carriers are adding to their android dists, then switch carriers. oh wait, they ALL add their own non-OSS software.

p.s., *all* smart phones from all manufacturer across all carriers spy on you.

Re:Doesn't Matter

[amRadioHed]

What do you mean by reasonably? Of course you can do it with Android phones currently on the market. CM wouldn't be so popular if you couldn't use it.

Re:Doesn't Matter

[farble1670]

leading to every Android Honeycomb tablet that shipped this year being a closed platform until this week.

yes, so can you drop it then?

Re:Doesn't Matter

[WorBlux]

The first stage could be replaced, say if the Open Cores projects came up with and ASIC, however the base band will likely remained locked (even in the small chance it were opened) for legal and financial reasons. Wouldn't be a huge contender in the graphics performance but could be adequate.

Re:Doesn't Matter

[mollymoo]

That's a very precise number. I wonder how they gather those statistics?

Re:Doesn't Matter

[evilRhino]

Not entirely sure, but they have opt-in analytic during the install process.

Re:Doesn't Matter

[Ossifer]

CynaogenMod? Seriously?

Here's sample instructions on deploying: http://wiki.cyanogenmod.com/wiki/HTC_Aria:_Full_Update_Guide

And that's just deploying a supplied image, not building. Cf. building & deploying a GNU desktop/server app, or even the Linux kernel...

Re:Doesn't Matter

[MrNiceguy_KS]

Oh, they have their ways...

Re:Doesn't Matter

[evilRhino]

That's actually 745,668 *installs* which is very different, especially with the prevalence of nightly installs. Source: http://stats.cyanogenmod.com/

Re:Doesn't Matter

[Anonymous Coward]

But why are people complaining until now?...

Why the hell do you think that Richard Stallman complains so loud about this kind of "open" software?

Re:Doesn't Matter

[Anonymous Coward]

Well, it's not "free" according to GPLv3 (android devices can be Tivo'ised preventing you from running modified code)

The GPL doesn't define "free", even in the FSF's eyes. The GPL has some restrictions to try and keep the software free, but the restrictions aren't required for the software to be free in the first place.

Now you could argue that it's not "free" as defined by RMS and the FSF, and you'd have a decent argument.

As far as I understand, the FSF's problem with Android is that most if not all devices rely on extra proprietary modules beyond the OS itself - device drivers, the Google apps suite (including the Market), manufacturer/carrier customisations, etc. Android per se is considered fine.

Re:Doesn't Matter

[MrNiceguy_KS]

I'm obviously not the OP, but as soon as I got my Samsung Epic, I installed SyndicateROM Frozen, found here: http://forums.acsyndicate.net/showthread.php/923-ROM-ACS-SyndicateROM-Frozen-1.2?p=4540#post4540

I spent some time browsing the available ROMs for my phone - nearly all of them had "No more CarrierIQ!" in their feature list.

Re:Doesn't Matter

[Bucky24]

Default Android is open. The versions that handset makers put on phones tends to be more closed off because they've made it that way.

Re:Doesn't Matter

[amRadioHed]

I don't see anything I would consider difficult on that page. Certainly easier then installing Linux 10 years ago, did you not consider Linux Open Source back then?

Re:Doesn't Matter

[Ossifer]

I built my own kernels in '95, and have contributed to open source projects years earlier, and yes, I would consider building (which you conveniently ignored) and deploying Android significantly more difficult than building and deploying the Linux kernel was in '95.

Re:Doesn't Matter

[Drakino]

If you want to nit pick meanings, fine, though to get stuck doing so misses the larger picture. To most people, Android means a phone, running Google's Android OS, and Google's Android applications such as the marketplace, Gmail, Maps, etc. The marketplace, maps, Gmail and other common apps that come with every Google Android certified device are not open.

The reason I make a distinction between open and closed here is that yes, on Linux, almost the entire stack is open, from the proper Linux kernel, to the Gnome/KDE windowing environment, to the browsers, e-mail apps and other common programs bundled with a typical Linux distribution.

Yes, Android is functional without the closed bits Google doesn't ship, but only functional to engineering minded people who need a good OS to build their own mobile platform or device.

One interesting part that changed from open to closed is the handling of AGPS location caching. Remember, that same thing everyone blew up at Apple over last year? Yeah, Android does the same, and the open code revealed it, and the complete hiding of it inside some closed location API Google provides with Google Certified devices.

Re:Doesn't Matter

[Drakino]

Why should I drop it? Most people don't forgive other companies (Apple, Microsoft, etc) for grievances done over a decade ago, and yet Google gets a free pass after a week?

I'm not bringing it up to use as a fanboy attack like many others do. I'm bringing it up to illustrate the dangers of blindly believing Google's "open" message. It's open until they decide it's closed. There is nothing stopping Google from doing the exact same trick for future Android devices. I want to see Google do good, and keep Android open. The Honeycomb situation should not be forgotten, so we can try and pressure Google to stay on message more frequently.

Part of me (call it the tin foil hat part of my mind) has to wonder if Honeycomb was closed for as long as it was to prevent Amazon from using it to fork for their Fire tablet. Ultimately I think that if it was part of the motivation, it;s more damaging to Android as a whole in the tablet space. Some devs are going to be targeting 2.3 for the Fire, and doing lowest common denominator ports to 3.0/4.0 Android tablets, leading to a poorer experience for everyone.

Re:Doesn't Matter

[Killjoy_NL]

Google may be slow, but so far they are quite consistent.
They have opened up the sources, that doesn't mean we don't need to keep pressure on the company, but so far they have not disappointed me in this regard.

Re:Doesn't Matter

[Anonymous Coward]

Android is open source, it not free software.

If you've been developing back in the 70's (when there were open source projects, like System V), there's a difference between OSS and F/OSS.

Re:Doesn't Matter

[c 0xFF]

If all code were GPL, handset makers couldn't close off the phones. Then this problem would be easy to fix.

(Just to head off the GPL vs BSD vs whatever debates, I'm not trying to take sides here, just sharing a thought I had.)

Re:Doesn't Matter

[Killjoy_NL]

Now now play nice, allow other people their hobbies.
We're not complaining about your anal sex fixation with iPhones, that's just fine with us.

Re:Doesn't Matter

[Bucky24]

Doesn't the later version of GPL allow for this? I seem to recall someone on /. saying Android was under GPLv3

Re:Doesn't Matter

[amRadioHed]

Android is a whole distribution, not just a kernel. Obviously building the whole OS is more difficult then just building the kernel. The difficulty of deploying Android depends on the hardware, but the same goes for Linux.

Re:Doesn't Matter

[zill]

My apologies.

Re:Doesn't Matter

[Ossifer]

Sure, the comparison isn't total, but is similar in terms of the "bare metal" layer nature of it...

Switching to the oft-used RMS car analogy, Android phones are like having the shop manuals for the engine, but the hood is still intentionally welded shut...

Re:Doesn't Matter

[Anonymous Coward]

You're right. Because Android is open, I am running a custom firmware and custom kernel on my phone, which means it doesn't have this carrier "rootkit".

Re:Doesn't Matter

[Anonymous Coward]

n9 ?
for years i've used cheapest phone i could get. i think i'm getting n9 next week or so. not sure about n9/carrieriq relationship, but i'd expect it to be easier to deal with if it's there :)

Re:Doesn't Matter

[farble1670]

Why should I drop it?

because it's not a valid grievance. google didn't sign some binding agreement with the users of the world to make all android open source, all the time, immediately. compared to apple or msft they are freaking saints (w/ regard to OSS), but it's never good enough huh? can't you be just as little positive about the fact that a company is pouring millions of dollars of resources into a platform and then just giving it away? of course not, because they aren't going about it on your time table.

OSS is *expensive* for a company. it's not just throwing it over the fence. they have to manage the community, manage contributions, keep the code clean and clear and keep everything perfectly documented for moron consumption. it's much, much more expensive for a company to open source their code than to just keep it internal.

there are good reason why they didn't release 3.0. for one, there were in the middle of restructuring the source code merging the 2.x and 3.x branches. releasing the code in this state would have been confusing to users, but mainly, cause them more work and resources in the long run. that's their prerogative- they are a public company that reserves the right to make make financial decisions.

Re:Doesn't Matter

[nurb432]

It doesn't matter since you are on their network, under contract and being subsidized, so its really not your device to do with as you please anyway.

If want your own machine to do with as you please, buy a device outright and don't sign up with a cell carrier. Of course it wont be as useful, but you get FULL control that way.

Expect the same requirements soon from your ISP.

Re:Doesn't Matter

[nurb432]

Google dropped the ball when they permitted downstream customers to close their source

And if they hadn't, no manufacturer would have adopted it.

Re:Doesn't Matter

[sveinungkv]

The newest version of the GPL, version 3, forbids it. GPLv2, the license of the Linux kernel, may allow it. Android is mostly Apache 2.0.

Re:Doesn't Matter

[Anonymous Coward]

And even then, it's easy to flash new firmware. Install ROM Manager, flash CWM, boot into CWM, select wipe cache/dalvik & factory reset, then flash a new ROM from SD card.

Re:Doesn't Matter

[Anonymous Coward]

You really think dumb phones are harder or less likely to be used to collect your information? I guarantee you similar functionality is built into your dumbphone. You just can't see it

Re:Doesn't Matter

[nevermore94]

You are right. It doesn't matter. I am not a tinfoil hat wearer because I am a Computer Systems Engineer and Network Administrator and I know how much data they can gather from you if they want to and have pretty much just stopped caring. They don't need any special app hidden on your phone to spy on you. They could record every single URL that you visit from their server end. Unless you are taking some extraordinary measures on your phone like running through proxies (which can then log everything you do themselves) or Tor they can already track all of your online activity. Does this make something like CIQ right, hell no, and I have already verified that my Android phone doesn't contain it. But, it also doesn't mean that I have any allusions that every URL I visit isn't being recorded somewhere. I just don't care because I don't do anything on my phone that I wouldn't want the world to know about anyway. That is why burner phones were invented ;-)

PS, if you want an interesting look into which Android apps are tracking you when you use them, check out the app:
Addons Detector

Re:Doesn't Matter

[Anonymous Coward]

It isn't hard to fix. Custom ROMs come with Carrier IQ already taken out.

Re:Doesn't Matter

[Anonymous Coward]

So what you're saying is that it's "free as in beer" and "open as in goatse"?

Re:Doesn't Matter

[Hotweed Music]

http://imgur.com/33Ll6

It's an opt-in notification that you get the first time you turn on the phone, then it never bothers you again.

Re:Doesn't Matter

[Anonymous Coward]

This is actually true. Because it is open you can flash your phone with CyanogenMod and it won't have this on it.

Re:Doesn't Matter

[TheInternetGuy]

>Well, it's not "free" according to GPLv3 Well that's because, according to RMS code can't be truly free unless its bits are showing.

Re:Doesn't Matter

[TheInternetGuy]

Wow, I can't believe that I messed up an otherwise excellent joke by crappy formatting.

Insert your own CR LF (or alternate new line sequence) after GPLv3 above.

Re:Doesn't Matter

[Anonymous Coward]

If you want a true FOSS mobile phone OS, just wait until Kubuntu Mobile is released. (From memory, Meego, like Maemo, has some closed binaries.)

Re:Doesn't Matter

[Anonymous Coward]

Google has severely muddied the meaning of open and open source compared to what we are used to from the GPL and Linux worlds.

People like you have muddled the meaning of Free Open Source which is a licence, and Open Source which is a development model. There is a difference (and it's got bugger all to do with Richard Stallman).

Re:Doesn't Matter

[Anonymous Coward]

Only parts of Android are open source. Other parts, including key infrastructure pieces and the majority of apps people use that ship on the devices are closed.

Oh MY GOD. An open source operating system let's people run closed source apps? Get outta town!

There is absolutely nothing muddied about what Google has done. They have obeyed all the relevant licences used commonly throughout the open source community. They have shipped a 100% open source operating system. The key-infrastructure pieces are apps just like they are in Linux, or Unix, and just like they may be open or closed source on those systems too.

The only thing here that is being muddied is you trying to define open source as somehow being GPL only and forcing all code to always be open. That's not how it works. Actually the GPL is came a few years after many other popular open source licences. Also for the record Wikipedia lists 12 licences on the open-source page. As far as I can see less than half of those require downstream code to remain open source.

There's no need to hold Google accountable. They have held true to every word they've uttered.

Re:Doesn't Matter

[thegarbz]

Why should I drop it? Most people don't forgive other companies (Apple, Microsoft, etc) for grievances done over a decade ago, and yet Google gets a free pass after a week?

Lol most of us couldn't care less what the companies did a decade ago. The grievances with the companies you listed (probably including the generic etc) is that they keep doing the same bullshit today.

Re:Doesn't Matter

[Anonymous Coward]

http://www.cyanogenmod.com/

Do people consider Cyanogenmod "open source"? What about "FSF free"?

It says "Based on the Android Open Source Project", which means they've made a functional phone from Android, which surely means that Android is "open source" if not "free".

There are also instructions on how to compile cyanogenmod, which I seem to remember RMS saying that software isn't free unless you can find out how to compile it, so that's a good thing.

Presumably cyanogenmod will be better for privacy. Another reason I should probably get round to installing it?

Re:Doesn't Matter

[bmcage]

That's a very precise number. I wonder how they gather those statistics?

There is a rootkit in cyanogenmod that phones home with these statistics. You can read it in the code.

Re:Doesn't Matter

[tehcyder]

I'm one who likes a lot of what Google does, but I'm no blind fanboi. Google dropped the ball when they permitted downstream customers to close their source. And, that's why I'm using a "dumb phone"*, with no plans to upgrade. I'm not about to pay the phone company hundreds of dollars, PLUS an exorbitant contract fee, so that they can spy on me.

That's why I don't use the internet. I'm not about to pay hundreds of pounds for computer hardware PLUS an exorbitant broadband contract just so that websites like Google and Facebook can spy on me, simply in return for providing unimaginable amounts of information.

TANSTAAFL

Re:Doesn't Matter

[Lennie]

Google does do a lot of other open source work. Like Chromium (the base for Google Chrome) is fully developed in the open.

Chrome includes a few closed parts like mp3 and H.264 support but that has obvious reasons.

Re:Doesn't Matter

[RoFLKOPTr]

Most people don't forgive other companies (Apple, Microsoft, etc) for grievances done over a decade ago, and yet Google gets a free pass after a week?

That's a problem with the stubborn fucks who refuse to let anything go... not a problem with the people who are too forgiving. I love open source software, but this zealotry that you're expressing is a little overkill.

Re:Doesn't Matter

[FredFredrickson]

It does prompt you when you first install, asks if it can send anon usage stats. You can decline.

Re:Doesn't Matter

[richcj10]

Android smartphones uses proprietary software and hardware. Film at 11. Even the so called "open source phone", the Neo FreeRunner, relies on a proprietary baseband OS. The sad reality is that the open source philosophy does not lend well to the hardware world, where the hardware equivalent of "compilation" costs few million dollars each time and can only occur at a few dozen select locations on Earth.

eeeh worong... eaver heard of OSH? I know phones are not there yet but some day maybe...

Re:Doesn't Matter

[cynyr]

ICS is a GPL kernel and a Apache 2.0 everything else. I hear rumors that google even wrote their own libc for android so they could license it that way.

Re:Doesn't Matter

[cynyr]

the second thing you did, was realize that you suck at packaging android and installed cyanogenMod.

Re:Doesn't Matter

[shmlco]

"Then I was quite sure I had a clean phone."

I find this sort of thing rather amusing. You didn't trust the Android software shipped on the phone...

So you download ten million or so lines of source code, build it, and install it all using tools running on yet another OS with it's own drivers and on hardware with its own BIOS and roms and controllers. Hundreds of millions of lines of code you've never seen, and never will see...

And yet the end product of THAT result is somehow more trustworthy.

Right.

Re:Doesn't Matter

[shmlco]

"Some of their services are completely legal, some are in the gray area... but you can get it done by someone for about $100."

So... we don't trust the carrier. So we should go to some anonymous person who specializes in proving services in the "gray" areas, and trust THEM to install a perfectly clean version of Android on your phone, thus eliminating all spyware and rootkits.

Hilarious.

Re:Doesn't Matter

[shmlco]

And who knows what else added back in...

Re:Doesn't Matter

[khipu]

It is so open, your data falls right out of it!

(Sorry, couldn't resist. If you use proprietary operating systems on your phone, you are, of course, just as screwed.)

Re:Doesn't Matter

[exomondo]

And the number of people capable of doing a brain transplant on an Android phone is probably in the 10,000s. Millions and millions of people are vulnerable and there isn't much they can do about it other than taking a hammer to the phone.

Then why would it matter if the OS is open source or closed source at all? By your own measure it only benefits a very tiny percentage of users anyway.

Re:Doesn't Matter

[Fjandr]

That's not necessarily true. Just because the source is available doesn't mean that the combination of hardware and compiled binary will allow you to access it once the binary is installed.

Re:Doesn't Matter

[Fjandr]

What, exactly, do you mean by "this?"

Re:Doesn't Matter

[Fjandr]

"Open source" is a very specific descriptor. Just because the ecosystem of a particular project is not very open does not change the definition of "open source." It's not a nitpick to call a grape a grape, even if it's part of the bigger fruit salad "picture."

Re:Doesn't Matter

[bratwiz]

And, you bought it.

Re:Doesn't Matter

[jbolden]

GPL wouldn't solve the problem necessarily. The handset maker could not put restrictions on but the carrier could. "We won't allow the phone on our network unless it is using a signed version...".

but but but... Apple

[Anonymous Coward]

With a walled garden, Apple keeps the carriers out too.

Re:but but but... Apple

[Anonymous Coward]

oh boy you are so naive and wrong about that

Re:but but but... Apple

[Anonymous Coward]

That's an interesting assumption. Who pays the piper?

Re:but but but... Apple

[Pieroxy]

With a walled garden, Apple keeps the carriers out too.

Yes, walled gardens have pros and cons. This is definitely a pro in my book.

Re:but but but... Apple

[Tr3vin]

Unless, of course, those walls have security cameras mounted on them.

Re:but but but... Apple

[CastrTroy]

This is the best thing that the iPhone has done for the cell phone industry. Apple doesn't bow down and let the carrier load whatever crap they want to on the phone. This makes the iPhone a much better experience, because an iPhone from Verizon is exactly the same as an iPhone from AT&T and it exactly the same as an iPhone you purchase directly from Apple. The only difference is that the carrier specific phones have been locked to that provider, but that's acceptable since you're getting the phone at a huge discount. I wish more handset makes, especially the big ones (HTC, Motorola, Nokia) would do the same to offer their customers a much better and more consistent experience.

Re:but but but... Apple

[Pieroxy]

Unless, of course, those walls have security cameras mounted on them.

With everything, there are pros and cons. Sometimes the pros outweight the cons, sometimes it's the other way around. And it"'s certainly not the same for everyone.

What was your point again?

Re:but but but... Apple

[P-niiice]

And your freedom.

Re:but but but... Apple

[Kazin]

Right, you're ok with Apple spying on you but not AT&T or Verizon? Fascinating.

Re:but but but... Apple

[RyuuzakiTetsuya]

i love my iphone, and i'll never pick up a windows phone 7 device...

I just wish that Apple would install a catflap like Microsoft did with WP7.

(The ADD inducing Metro UI can stay though)

Re:but but but... Apple

[Anonymous Coward]

Yes definitely a pro - I mean instead of having all these different companies stealing your data you only have one. Thanks Apple for making things easier!

Re:but but but... Apple

[Anonymous Coward]

Let me guess: you've NEVER seen a Nokia smartphone, have you?

Re:but but but... Apple

[sribe]

...but that's acceptable since you're getting the phone at a huge discount.

I don't even believe that. As long as you continue to pay your contract, you should be able to unlock the phone.

Re:but but but... Apple

[Anonymous Coward]

What?

Re:but but but... Apple

[Unoriginal_Nickname]

Has anyone?

Re:but but but... Apple

[Anonymous Coward]

Sterility?

Re:but but but... Apple

[Anonymous Coward]

There is no evidence of any keyloggers or sending browsing history back to Apple built into the iPhone.

Re:but but but... Apple

[dead_user]

Not having to worry about birth control?

Re:but but but... Apple

[Anonymous Coward]

What are the "pros" to pounding yourself in the crotch with a sledgehammer?

Going on Apple's example, you'd be trendy among self-deluded hipster types and have a disturbingly disproportionate amount of media attention. Next question?

Re:but but but... Apple

[jeffmeden]

Unless, of course, those walls have security cameras mounted on them.

With everything, there are pros and cons. Sometimes the pros outweight the cons, sometimes it's the other way around. And it"'s certainly not the same for everyone.

What was your point again?

His point is that there very well could be the exact same "features" present in iOS devices, as you seem to allude that there are not (given that this is one way they are "better"), but do not have any actual evidence to prove it...

Re:but but but... Apple

[Anonymous Coward]

No, which is why you go to and disable it in diagnostics and usage?

Re:but but but... Apple

[TheGratefulNet]

answer: the person holding the handle still controls the swing.

(wait, what?)

Re:but but but... Apple

[Relayman]

I know /. is the home of the paranoids, but I send all my diagnostics and usage to Apple. I even file bug reports. If it helps Apple improve the experience for the paranoids, it's a win-win situation.

Re:but but but... Apple

[Anonymous Coward]

...aand fan boys in 3...2.. --fuck i need to lower my count down.

Re:but but but... Apple

[oakgrove]

The only difference is that the carrier specific phones have been locked to that provider, but that's acceptable since you're getting the phone at a huge discount.

What discount? You actually think you aren't paying full price and then some for your "free" phone? By that logic, I put $20,000 down on a $200,000 house. I got a hell of a "discount" didn't I? Oh, wait...

Re:but but but... Apple

[kiwimate]

Right, you're ok with Apple spying on you but not AT&T or Verizon?

I think the information Apple can potentially glean off of my iPhone data is a heck of a lot less revealing than the information Google can and does glean from Google Search, maps, youtube views, GMail...

Anyway...with Apple, is it spying if you click "I accept" on the EULA? Read it carefully sometime. Seriously.

Re:but but but... Apple

[chomsky68]

CarrierIQ was also found on iPhones so there goes your nice speach out the window. Next time RTFA.

Re:but but but... Apple

[strech]

And you're sure of this why?
And from geek.com (http://www.geek.com/articles/mobile/how-much-of-your-phone-is-yours-20111115/):

Currently, Trevor has found CarrierIQ in a number of Sprint phones, including HTC and Samsung Android devices. CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well.

This may just be a terribly worded sentence and CarrierIQ isn't on the iPhone (and I can't find any other cites), but even if this specific software isn't there, that doesn't mean other software that does the same thing under the excuse of "improving the network" isn't. Further, "Apple doesn't engage in abuse <x>" is a bullshit excuse for other problems.

Re:but but but... Apple

[Baloroth]

Anyway...with Apple, is it spying if you click "I accept" on the EULA?

Yes.

a)Burying something in a 20-page EULA (or however long it is) in legalese doesn't make it obvious. And more importantly b) spying is still spying even if you know about it. Spying usually implies secrecy, but it by no means requires it.

Re:but but but... Apple

[sootman]

You don't even need to go as far as the EULA -- iOS 5 actually asks you during setup if you want to allow usage data to be sent.
http://www.thewwwblog.com/wp-content/uploads/2011/10/ipad-ios-5-diagnostics-7.jpg
(From http://www.thewwwblog.com/apple-ios-5-setup-steps-apple-ipad.html )

Re:but but but... Apple

[Anonymous Coward]

It appears that the sentence in the article claiming this software was found on the iPhone was a typographical mistake. The sentence clearly does not make sense as written, and the most likely presumption is that a "not" is missing.

Re:but but but... Apple

[Anonymous Coward]

Where does it say that? I can't find it.

Re:but but but... Apple

[popoutman]

EULAs are not contracts. They are a wishlist by the software writers, and such are part of an honour system. They are not legally binding in sane jurisdictions.

Re:but but but... Apple

[Anonymous Coward]

The iPhone isn't even mentioned (like not at all) in any of the linked articles, so I don't know where you're imagining you read this.

Also, the word you're looking for is spelled "speech".

Re:but but but... Apple

[pancake_lover]

[citation needed]

Re:but but but... Apple

[zoloto]

Care to explain how it doesn't keep the carriers out of the phone? Last I checked, and yes employing traffic monitoring is standard on my network, there was no remote access nor capabilities to do so.

Re:but but but... Apple

[Anonymous Coward]

I read the article. Both of them. Saw nothing in either one about this software being used on the iPhone. The software sounds like an Android only thing.

Re:but but but... Apple

[Anonymous Coward]

you did read where the software is on Iphone as well.
http://www.geek.com/articles/mobile/how-much-of-your-phone-is-yours-20111115/
"When CarrierIQ was dubbed one of the Fierce 15, they were working with seven of the top ten major OEM’s, as well as Verizon Wireless, AT&T, and Sprint. Currently, Trevor has found CarrierIQ in a number of Sprint phones, including HTC and Samsung Android devices. CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well. CarrierIQ can be seen on your Android handset by installing an app from the Market called AnyCut. From here you will notice IQRD and IQAgent, which are both parts of the CarrierIQ system on the device"

Re:but but but... Apple

[CastrTroy]

It's a discount, because you end up the same feeds to the carriers even if you own your phone outright. This is my biggest objection to the whole racket. Your monthly bill is the same whether or not you are on a contract, and whether or not you bought the phone at a subsidized price. So, unless you are planning on switching carriers in the next few months (in which case, why are you using them to begin with?) you'd be stupid not to take the subsidized phone, because you'll end up paying the same every month anyway. I could see some advantage from someone who moves around a lot, who doesn't know if they will have good coverage (or if the carrier will offer service at all) in the next place they move to, but for most people who intend to stay in the same city, they get nothing by choosing to pay for their own phone.

Re:but but but... Apple

[Anonymous Coward]

Did not see any mention of whether CarrierIQ is on iPhones in any of the linked articles. Could you provide a citation please?

Re:but but but... Apple

[hawguy]

Care to explain how it doesn't keep the carriers out of the phone? Last I checked, and yes employing traffic monitoring is standard on my network, there was no remote access nor capabilities to do so.

How did you check when you have no access to the IOS source code and no idea what it's really doing? Would you really know it if AT&T had some code buried in the kernel that sends your tracking data in some GSM control messages that aren't accessible in user-land on the phone? Making a phone work with a new carrier is more than just slapping a new radio in it -- there's software involved as well.

Re:but but but... Apple

[oakgrove]

Your monthly bill is the same whether or not you are on a contract

Mostly true however T-Mobile does give a 10 percent service price reduction when you bring your own device.

Re:but but but... Apple

[LoverOfJoy]

CarrierIQ is confirmed to be found on the iPhone

Not directly in the article but in the links within the article.

Here's the direct link: http://www.geek.com/articles/mobile/how-much-of-your-phone-is-yours-20111115/

Re:but but but... Apple

[LordLimecat]

Article is a load of crap, they give no details on how they know its there. They show screenshots of 2 android phones with visible GUIs which show CIQ, and then claim its on iPhone and Blackberry as well. Sorry, Ive dug through all the servicebooks on several blackberries (8250, 9600, 7200) and Ive never seen a CIQ service book.

And as for this statement...

According to TrevE, the software is installed as a rootkit software in the RAM of devices where it resides. This software basically is completely hidden from view and in it virtually invisible,

Someone doesnt understand the volatile nature of RAM, or is terrible at communicating. Rootkits dont reside in RAM, because then they would be removable with a battery removal. As for "completely hidden", why then does he have screenshots of a CIQ GUI where theres a "disable CIQ" checkbox?

The credibility factor of this story is in the negatives, especially when they really dont explain what their proof is and they have one guy on a forum claiming this-- its not even a researcher with a known real name. Who says this isnt a massive troll?

Re:but but but... Apple

[Tharsman]

No it wasnt. RTFA.

Re:but but but... Apple

[Anonymous Coward]

Take your own advice. There is no mention of Apple or the iPhone in either of the two linked articles.

Re:but but but... Apple

[zill]

What you don't know can't possibly hurt you, right?

Re:but but but... Apple

[GameboyRMH]

iOS is mostly closed and analysis tools can't be installed without jailbreaking, how do we know what's going on in there?

Besides, does nobody remember the iPhone location privacy fiasco?

Re:but but but... Apple

[Anonymous Coward]

"Getting the phone at a huge discount", my ass. The discount they give is 0%.

Re:but but but... Apple

[Anonymous Coward]

"CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well."

This makes it seem that it is to be expected to be found on the iPhone and feature phones.

Re:but but but... Apple

[Anonymous Coward]

Neither article contains that sentence.

Re:but but but... Apple

[Microlith]

A walled garden would not have prevented this.

Google or the device vendors selling directly to end users and not being forced to route through the carriers probably would have.

Re:but but but... Apple

[spire3661]

wow, a whole 10%. Around here we call that a marketing bullet point.

Re:but but but... Apple

[Anonymous Coward]

No, they aren't contracts. They are licenses. Like with any other license, failing to comply negates your usage rights. And I assume they can be enforced, though it might be quite difficult to actually detect a violation.

Re:but but but... Apple

[oakgrove]

My bad. It's actually 10 dollars which comes out to 240 dollars over the two years. Strangely just about enough to cover the usual subsidy. Funny how that works.

Re:but but but... Apple

[kiwimate]

Disclaimer: I don't know what Baloroth's opinions in general are, so this isn't necessarily aimed at you. And I hope this doesn't sound too snide.

That said, this is where I see a double standard in Slashdot from time to time. Go back to stories about broadcasting SSIDs and setting up computers and so forth. Most Slashdotters tend to say it is on the part of the consumer to understand, read manuals, etc. Setting up encryption, for example - the prevailing opinion on here is that that that is just part of the modern world in which we live, and if consumers can't be bothered to read and understand, then they get what they deserve.

I think that's a pretty cavalier and smug attitude. Beyond that, however, if the same attitude doesn't work both ways, then I'm not terribly sympathetic. I don't understand all the legalese when I sign a mortgage, say...so I make sure I ask someone. And if I don't understand, I don't sign until I do. (And it's been pretty amazing. Example a - watching the glib sales girl who breezily said "read everything, take your time" and then got visibly cooler in her attitude when I proceeded to do just that. Example b - the Wells Fargo reps who responded "umm, we don't know" when I asked them what a particular phrase in their mortgage paperwork meant, and didn't think it was a problem to say "but it's standard language, so it's okay to sign anyway".)

Re:but but but... Apple

[yankeessuck]

Well if we want to go down this hypothetical path then Android could have Google + Device Manufacturer + Carrier spying. That would be three Android spies vs iPhone's one.

Re:but but but... Apple

[crazycheetah]

I'm going to go with everyone else here and wonder where you got that information. As one of the AC's pointed out, the best I can find directly saying it is the following sentence:

Currently, Trevor has found CarrierIQ in a number of Sprint phones, including HTC and Samsung Android devices. CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well.

That grammar is screwed up and makes the most sense by adding in a "not" to read "CarrierIQ is not confirmed to be found on the iPhone or on feature phones".

At http://www.carrieriq.com/company/careers.htm, under the Senior Software Engineer position, it does give this as well for Job Requirements:

1+ years of application development experience on at least one other mobile platform (iPhone, Windows Mobile, BREW, Symbian, and so on.)

That's the best that I can find supporting that it is on the iPhone.

Personally, I wouldn't doubt for a second that something like this is on the iPhone (I would almost be more surprised if there wasn't, actually), but I'm not really seeing any strong evidence.

Re:but but but... Apple

[The Moof]

They are not legally binding in sane jurisdictions.

That, right there, is the catch. If you're in the US, you're not in a sane jurisdiction. Have you seen some of the egregious things they've been putting in EULAs these days that are actually being held up in court?

Re:but but but... Apple

[BitZtream]

iOS is mostly closed and analysis tools can't be installed without jailbreaking, how do we know what's going on in there?

Uhm ... Its been jailbroken so we can just look, just like you would on a rooted android device?

Besides, does nobody remember the iPhone location privacy fiasco?

No, cause there wasn't one. It wasn't anything even slightly malicious. The only person with direct access to it was the phone owner and the person with unencrypted backups of the phone, which was also likely the owner. I'm pretty sure the owner knew where the phone was anyway, which makes the whole thing a nonpoint.

It's just idiots like you who keep pretending it was some big deal because your to ignorant to realize it wasn't a threat.

Re:but but but... Apple

[Drakino]

You mean the smartphone location fiasco where it was discovered that *gasp* AGPS caches data on phones, including Android, Blackberry, iPhone and WebOS? Yep. Typical internet echo chamber amplification that turned it into an attack point for fanboys who didn't actually do any research.

Apple did have one legitimate bug in the situation. The cache was in a folder marked for backup to computers, due to it living in the same location as the settings file to toggle what apps can use location data. This was fixed, and the cache was reduced. I personally preferred the old cache time, since it meant my phone found my location when I wanted it to quicker. But they bowed to the pressure from the echo chamber anyhow.

Re:but but but... Apple

[MobileTatsu-NJG]

Would the gov't approach Apple to spy on your phone?

Re:but but but... Apple

[Anonymous Coward]

I'd have said so a month ago, while pointing to my direct-from-Nokia N900, running Maemo 5 Linux with no trace of carrier bloatware or spyware.

This month, I have a direct-from-Nokia N9, running Maemo 6/"MeeGo Harmattan" (not to be confused with mainstream MeeGo), with a nice security framework forbidding such dangerous actions as chroot to the user, and rendering huge chunks of system configuration non-modifiable. The promised "open mode", where you would own your own device, but not be able to access DRMed apps and media, never materialised, even though the DRM also never materialised, so Aegis is hindering my device usage in the name of protecting exactly fuck-all.

Just the same sort of crap as a typical Android phone, and just as open to abuse -- only now, Nokia gets to be the middleman and get a cut for handing the information over to the carriers, or for giving them signing keys to slip their own applications in.

Re:but but but... Apple

[CockMonster]

This is the best thing that the iPhone has done for the cell phone industry. Apple doesn't bow down and let the carrier load whatever crap they want to on the phone. This makes the iPhone a much better experience, because an iPhone from Verizon is exactly the same as an iPhone from AT&T and it exactly the same as an iPhone you purchase directly from Apple. The only difference is that the carrier specific phones have been locked to that provider, but that's acceptable since you're getting the phone at a huge discount. I wish more handset makes, especially the big ones (HTC, Motorola, Nokia) would do the same to offer their customers a much better and more consistent experience.

If you purchase a phone directly from Nokia you get the clean firmware.

Re:but but but... Apple

[Anonymous Coward]

No, they aren't contracts. They are licenses. Like with any other license, failing to comply negates your usage rights.

No, they can't negate my usage rights unless the company I bought it from already has the legal right to restrict my usage completely for no reason. They can stop distribution, that's called copyright, but there's no legal mechanism for them to stop my use of a legally obtained copy.

Re:but but but... Apple

[Doctor Memory]

The only difference is that the carrier specific phones have been locked to that provider

Well, that and they have totally different radios with different drivers and different network management code and different WiFi drivers and...

Re:but but but... Apple

[Anonymous Coward]

Riiiiiiightt!! And you think it actually accepts your answer? The variable is hard-coded to yes, regardless of what you click.

Apple stores everything you do, every click, swipe, spread, url, etc.. and they sell it to pirates and ninjas both.

Re:but but but... Apple

[ceoyoyo]

And you can tap no.

Re:but but but... Apple

[Anonymous Coward]

At least the scope of the transaction is explicitly clear.

Apple: Pay $XXX to step into our walled garden.

Google: Here take it! It's Freeeeeeeeeeeeee. It's open (not really)! It's transparent (not really!). Oh, and when we said "free", what we actually meant was that we're giving it to you so that we can collect information about you and then sell that information to the highest bidder.

Re:but but but... Apple

[bill_mcgonigle]

Would the gov't approach Apple to spy on your phone?

They might, but without being a wireless carrier, there aren't already laws that force them to do so.

They might cooperate, the government might go USAPATRIOT on them, but it's not quite so cut-and-dry.

Re:but but but... Apple

[bill_mcgonigle]

Get a used phone and sign up for Page Plus Cellular.

Re:but but but... Apple

[Anonymous Coward]

EULA are contracts, you just have to remember that not all contracts are legal or enforceable.

Re:but but but... Apple

[Anonymous Coward]

http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/
this is what should have been sourced. It has clients, training videos, documents, everything here.

Re:but but but... Apple

[Anonymous Coward]

Just btw, since Apple wrote/provide the necessary OS on the devices they sell, they get a free pass on it being a rootkit, cos you know... operating systems work like that and all; they get no choice about it being 'root'

ffs

Re:but but but... Apple

[Anonymous Coward]

http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/

Re:but but but... Apple

[mollymoo]

> Your monthly bill is the same whether or not you are on a contract, and whether or not you bought the phone at a subsidized price.

Wow, you have some seriously shitty networks. Over here (UK), SIM-only contracts are significantly less than you'd pay if you wanted a fancy smartphone with your contract. You can ever go further and get a "free" PS3 or laptop with your "free" phone by paying more for your contract.

Re:but but but... Apple

[Anonymous Coward]

Some parts of EULAs are not legally binding---generally the most obnoxious clauses. Most restrictions/requirements are reasonable and can be enforced.

Re:but but but... Apple

[WorBlux]

No, many jurisdiction ignore EULA's (and rightly so as they are not signed), and rather use the standard implicit license on all copyrighted works.

Re:but but but... Apple

[WorBlux]

Though there are informal methods such as DRM or server side verification.

Re:but but but... Apple

[Goaway]

"A is X. B could be X but there is zero evidence of it. Therefore, B is just as bad as A."

This is not a terribly convincing argument.

Re:but but but... Apple

[Anonymous Coward]

Having your 3 year old click the answer works... No *sane* or *insane* court allows underaged minors to enter into contracts.

Re:but but but... Apple

[MikeUW]

I think the main difference is intent - it's one thing to chastise users for being careless about security, when the information needed to do so in a particular circumstance is readily available. In contrast, I've never heard of CarrierIQ before - I'm pretty sure there's no mention of it in the manuals that came with the BB or Android phones that are being sold (certainly not mine), so in this case the onus is on the providers be forthcoming about what their technology is doing and how it's being used. By not doing that, they are deliberately deceiving their users. But we all this is par for large corporations, for which social and ethical responsibilities are at best an afterthought.

So...while I understand why someone might feel that there is a double standard being applied here, that's not quite the case as I see it.

Re:but but but... Apple

[sabt-pestnu]

Could you cite some cases of EULAs being held up in court? Have any of them made it to the level of precedent?

Re:but but but... Apple

[Bucky24]

Isn't T-Mobile being bought up by AT&T? I wonder if they'll keep that discount around.

Re:but but but... Apple

[Bucky24]

Wow, you have some seriously shitty networks

Yes. Yes we do. That's what happens when there are only three major networks in the entire country (at least this country).

Re:but but but... Apple

[Bucky24]

But if you purchase it from Nokia does it work with the network you want it to? I'd prefer to keep Verizon as my provider. If I buy a phone from Nokia can I be sure that it will work on Verizon's networks?

Re:but but but... Apple

[Anonymous Coward]

ignorance of the law is not a valid excuse. however i've noticed that google law lookup sites have incorrect data about the laws -- so when your info tool is lying to you about the law then obeying them is almost impossible.

Re:but but but... Apple

[nurb432]

I don't even believe that. As long as you continue to pay your contract, you should be able to unlock the phone.

Until you have paid off the subsidy its not really your phone. You are on in effect a 'lease to own' contract.

Re:but but but... Apple

[multipartmixed]

> Making a phone work with a new carrier is more than just slapping a new radio in it
> -- there's software involved as well.

Funny, I just stick in a new SIM chip.

Re:but but but... Apple

[shutdown -p now]

Making a phone work with a new carrier is more than just slapping a new radio in it -- there's software involved as well.

There's no carrier-specific software involved in GSM phones - that's what SIM cards are for. That's why you can buy those unlocked phones from Europe and use them with AT&T with no modifications.

The only case in which there would be any AT&T code running on iPhone is if Apple specifically took that code from them and incorporated it. Which I find very dubious - what's in it for Apple, other than a broader exploit surface and potential liability for privacy issues?

Re:but but but... Apple

[Beryllium Sphere(tm)]

>The only person with direct access to it was the phone owner

The other people with access would be the pickpocket who stole the phone, the author of the malware stealthy enough to pass Apple's App Store vetting, the phone owner's abusive spouse, and the police department that claims the right to examine phones at traffic stops.

>your to ignorant

My irony meter just exploded.

Re:but but but... Apple

[buchanmilne]

\

This month, I have a direct-from-Nokia N9, running Maemo 6/"MeeGo Harmattan" (not to be confused with mainstream MeeGo), with a nice security framework forbidding such dangerous actions as chroot to the user, and rendering huge chunks of system configuration non-modifiable. The promised "open mode", where you would own your own device, but not be able to access DRMed apps and media, never materialised,

The open mode is implemented, and apparently as of the beta2 for N950 the intended mechanism works. Users with N9's on PR1.0 are reporting that they can boot a minimally patched kernel into open mode.

Aegis is hindering my device usage in the name of protecting exactly fuck-all.

Just the same sort of crap as a typical Android phone, and just as open to abuse

Really? You mean preventing user apps from doing dangerous things without the user's knowledge is just as open to abuse as allowing everything?

Too many ambitious but clueless users on N900 have had to have their hands held through manually fixing or flashing their devices because they thought installing rootsh was cool. If it had been a mainstream device, I think there would have been a lot of exploits for it ...

Since the N9 was intended (until Feb 12) to be a mainstream device, it really wouldn't have been a good idea to have gone with the totally open mode of N900.

Re:but but but... Apple

[gl4ss]

it's not a discount though. discount is when you get it at half price because the store wants to get rid of them.. getting it on a 2 year lease arrangement on launch day is not discounting at all.

Re:but but but... Apple

[thejynxed]

Money. Lots and lots of money.

Re:but but but... Apple

[thejynxed]

Autodesk decision maybe? I don't know, as I ignore what EULAs say to start with. Once it's on my machine, I do what the hell I want with it.

Re:but but but... Apple

[sribe]

Until you have paid off the subsidy its not really your phone. You are on in effect a 'lease to own' contract.

I understand that. However I am also in a legally binding contract, which in order to terminate early, requires me to pay a hefty fee which will more than cover the subsidy. So explain to me again why the hell the contract should not allow me to unlock the phone?

Re:but but but... Apple

[nurb432]

Until you exercise that option and pay the fee its still not your phone.

After you pay it off its yours and sure you should ( and as far as i know can, as there are no legal restrictions ) be able to unlock it and 'move on'. Of cousre having to root/jailbreak to do it means you are potentially violating the TOS of your new carrier when you sign up with them.....

Re:but but but... Apple

[The Moof]

Really need to check responses sooner than a days later..

Anyhoo, the AT&T decision in the Supreme Court has allowed companies to force you to waive your right to class actions. They're required to allow an opt-out, but the last real example I've seen is the PSN EULA, which removes the right to class action with a click, but requires that you write a form letter to their legal department within 7 (or 14, I forget) days to reinstate the right to class actions. They also state that they get to choose the arbitrator for any non-class action suits. Other fallout from this decision has had EA put in that you wait ALL rights to sue, but this was recent, and so far untested in courts.

Blizzard has had it's fairly abusive EULA held up in court so far. Theirs states that you do not own a copy of the games you purchase from them, but your $60 entered you into a contract that they can change or terminate at any time for any reason, revoking your rights to the software. They also specify that regardless of where you physically are, the jurisdiction for all legal matter is the County of Los Angeles. I'm quite sure this was chosen because it'd be more friendly to their cause. So far, they've won the case(s?) that have been brought using the "contract revocation" reason.

Re:but but but... Apple

[cynyr]

it is still 2 for the iPhone as it is not produced in house but sent to foxconn to be manufactured.

Re:but but but... Apple

[cynyr]

Don't Sprint and Verizon use the same bands? how about (for the most part) T-Mobile and ATT?

Re:but but but... Apple

[Anonymous Coward]

N900 FTW, smartass.

Re:but but but... Apple

[shmlco]

"Would you really know it if AT&T had some code buried in the kernel that sends your tracking data in some GSM control messages that aren't accessible in user-land on the phone?"

How do you know that ANY phone is not doing that?

Re:but but but... Apple

[squeakyneb]

The only person with direct access to it was the phone owner and the person with unencrypted backups of the phone, which was also likely the owner.

With the way Siri's been revealed to work, I would highly doubt this. Apple also wants to build their own telecom. Good luck with that privacy of yours.

Re:but but but... Apple

[khipu]

This is the best thing that the iPhone has done for the cell phone industry. Apple doesn't bow down and let the carrier load whatever crap they want to on the phone.

Apple doesn't rely on the carriers screwing you, Apple just screws you themselves!

This makes the iPhone a much better experience, because an iPhone from Verizon is exactly the same as an iPhone from AT&T

True, in the US, the iPhone is a little better that way than other phones, but that's a quirk of the US market. In much of the rest of the world, most phones work on most carriers, and the iPhone is a lot more restrictive (not to mention expensive) than other phones.

Re:but but but... Apple

[MobyDisk]

http://en.wikipedia.org/wiki/Vernor_v._Autodesk,_Inc.
Check out the See Also section for some other landmark cases.

Re:but but but... Apple

[Anonymous Coward]

Nokia has done just that and refused to provide "custom phones" for us-operators for years.. and look what it got them. A 1% marketshare in the US despite being the biggest phone manufacturer by volume in the world.. eh, I guess the nokia phones were not as irresistible as the iphone then?

From what has been said Nokia has changed their ways now and is right at this moment customizing the windows phones for at&t and maybe verizon.. I'm pretty sure CIQ was one of the "planned customizations" at the carriers but thanks to the unfortunate publicity it might be left out:)

Re:but but but... Apple

[thunderclap]

Show me, because everyone time some has sued on a eula and had a leg to stand on, the company has settled out of court. No company wants eulas to be declared a wishlist.

Cyanogen

[Tsingi]

Nice.

Buy a phone you can root and put CyanogenMod on it. It works great!

Re:Cyanogen

[Pieroxy]

Tell that to my Mom. You're in for a rough ride, I'll tell you that much!

Re:Cyanogen

[gparent]

I'm always in for a rough ride with your mom. Oh, you mean to install Cyanogenmod?

Re:Cyanogen

[Anonymous Coward]

if this indeed a rootkit then that might not work.

though it seems it was written with known quantities (e.g. handset model, OS) in mind so it may not be particuarly robust.

i've not read the article thoguh.

Re:Cyanogen

[Anonymous Coward]

Your mom loves rough rides, I'll tell you that much.

Re:Cyanogen

[leon.gandalf]

Opera claims the site for that is Malware...

Re:Cyanogen

[dkleinsc]

Plus, as any Aussie can tell you, rooting a phone is more than little bit kinky.

Re:Cyanogen

[leon.gandalf]

AVG shows "Pheonix Exploit" Perhaps the site has been compromised? http://www.cyanogenmod.com/

Re:Cyanogen

[Anonymous Coward]

Kinky? As far as I understood it it is actually very common, so common people should think twice about acquiring used cellphones if the last owner was female or gay.

It is only kinky if a straight male tries to do it...

Re:Cyanogen

[oakgrove]

I put Cyanogen on my Samsung Vibrant. It has "removed carrier iq" in the release notes.

Re:Cyanogen

[oakgrove]

Pro tip: Never utter the words "...my mom..." on Slashdot. Wait...doh!

Re:Cyanogen

[Anonymous Coward]

Not if the implementation on your phone is incomplete, like that of the original motodroid, and others.

Re:Cyanogen

[Crudely_Indecent]

My wife was against me modding her phone, until she got fed up with the glitchy behavior. Noticing how well CM works on my phone, now she's begging me to upgrade hers. It's really not much different than the factory roms, it is just more stable and doesn't have all of the integrated garbage. Not much of a learning curve.

Re:Cyanogen

[Anonymous Coward]

> Not much of a learning curve.

Hint: a shallow learning curve means that the user never learns much.

Re:Cyanogen

[element-o.p.]

Yeah...but a steep learning curve means the user never learns anything, because most of them just say "screw it" and don't bother.

Re:Cyanogen

[Anonymous Coward]

That was the point. There isn't much to learn.

Re:Cyanogen

[Anonymous Coward]

Plus, as any Aussie can tell you, rooting a phone is more than little bit kinky.

lol haha my friends and I will root for you

Re:Cyanogen

[kesuki]

i wasn't in time to save you but using 'decrypt:rot13'(zl zbz) is perfectly acceptable

Re:Cyanogen

[shutdown -p now]

Or, just don't buy your phones from carriers.

Better yet, buy a Nexus device.

Re:Cyanogen

[Tsingi]

Yeah, I have a Nexus One.

Re:Cyanogen

[oakgrove]

Heh heh. Thanks anyway!

Re:Cyanogen

[Crudely_Indecent]

My point was that there isn't a fundamental difference between roms like Cyanogen and factory roms. Sure, there is some eye-candy that some love and some hate - but that eye-candy doesn't add any real functionality and can make the phone more difficult to use/learn. Once my wife realized that putting a different rom on the phone doesn't make it an alien environment, she was hip to the idea.

Cyanogen is really nice! It's fast, consistent, reliable and not something that should be feared. It's not really a new environment - it's just a really cleanly implemented environment.

Re:Cyanogen

[theangryswede]

now that the galaxy nexus is being sold through verizon there may be no hope.

Really?

[Moheeheeko]

I assumed people allready knew this. I mean phone companies know who, where, when, and for how long you call anyone, you would have to be pretty naive to belive that they arent tracking your web useage just as closely.

Re:Really?

[Anonymous Coward]

Yes, but most of the data you describe can be derived from network usage.
Something you can not avoid, since that data is being used to calculate how much money they can extort from you.
Being able to see everything I do on my phone is quite a different thing, and I don't see how they can expect to have any business with how much I use software X,Y,Z on my phone.

Re:Really?

[MightyMartian]

I'm unclear here. Why isn't senior management and the board being hauled into court, forced to pay bail of a million bucks and the FBI seizing every single document within the United States? I mean, every time some fucking dipshit downloads a copy of some piece of Hollywood excrement, Congress and the courts are bending over backwards to punish the evildoer, but when major companies start throwing rootkit spyware on their phones, it's like "oh well."

If I was in charge, those companies would be facing destructive fines (hundreds of millions of dollars), senior management and the board would be cooling it in prison cells and facing stripping of every single asset they own and years of jail time ahead of them. I would make those fuckers so terrified that they'd wake up three times every night of the rest of their lives fearing that some marketing fuck had put something like that on the phones they're selling.

Re:Really?

[Anonymous Coward]

If software X,Y,Z crashes your phone, or interferes with performance (data/voice or battery) they phone company likes to be able to tell you how to fix it (instead getting returns on perfectly good hardware.)

Re:Really?

[gstoddart]

you would have to be pretty naive to belive that they arent tracking your web useage just as closely.

In fact, they are also doing things in such a way as to cost you more money on your data plan.

A bunch of years ago, a co-worker was trying to figure out why the ability to directly go to an URL from his cell phone wasn't working as it was described in the manual.

It turns out the carrier (Rogers/AT&T) had tweaked the settings so that *every* request you did more or less went through one of their servers. It had the net effect of effectively doubling the amount of data needed for any request ... I don't recall the specifics, but he spent a good portion of a weekend working it out.

And, as much as we know they have all of the calling info ... keylogging, for example, might be a little too far over the line for them. They only need what they need for billing purposes.

Re:Really?

[Anonymous Coward]

You can't just haul people into court, etc because it suits your whim. You need this thing called a 'law'. What law would allow what you suggest?

Re:Really?

[Smallpond]

" By entering this Agreement, you consent to our data collection, use and sharing practices described in our Privacy Policy available at verizon.com/privacy." -- from Verizon Customer Agreement

That's why.

Re:Really?

[Anonymous Coward]

I'm unclear here. Why isn't senior management and the board being hauled into court, forced to pay bail of a million bucks and the FBI seizing every single document within the United States? I mean, every time some fucking dipshit downloads a copy of some piece of Hollywood excrement, Congress and the courts are bending over backwards to punish the evildoer, but when major companies start throwing rootkit spyware on their phones, it's like "oh well."

Good point. Why hasn't the FBI gone after TrevE for stealing the property of CIQ?

Oh, and in case you are wondering, the first image is from a “virgin” copy of CIQ. Our beloved dev found a pristine copy of this along with a ton of information, including training videos, guides,

Re:Really?

[biodata]

Most places have some form of misuse of computers act, data protection act, and others. Maybe it's time to start requesting copies of all personal data from the phone carriers in the same way as has been done recently with FB.

Re:Really?

[Jeng]

I'm all for torturing executives, placing them in jail, fining them till they have no money, etc, etc.....

It's just that China goes above and beyond that by actually killing the people responsible and yet corruption is still rampant so I don't think that doing any of the above will actually change anything.

Don't get me wrong I am still for it even if it is ineffective. It would just make me feel good knowing that the people who screw so many people get screwed.

Re:Really?

[Anonymous Coward]

" By entering this Agreement, you consent to our data collection, use and sharing practices described in our Privacy Policy available at verizon.com/privacy." -- from Verizon Customer Agreement

That's why.

"By accepting my business and taking my money, you consent that you will give me the promised service and not gauge me for private information or throttle my experience below anything but the promised unlimited service, whether selectively by e.g. protocol or not." -- from my Service Provider Agreement

Re:Really?

[mcvos]

I thought you meant: You need this thing called 'law', but it's owned by the corporations.

Re:Really?

[Anonymous Coward]

If I was in charge, [...]

You can't just haul people into court, etc because it suits your whim. You need this thing called a 'law'. What law would allow what you suggest?

The law that put him in charge.

Re:Really?

[oakgrove]

You can't just haul people into court, etc because it suits your whim.

Joke sure is on you!

Re:Really?

[Anonymous Coward]

"... which may change at any time at our discretion and those changes are effective immediately or, where allowed by law, retroactively"

Re:Really?

[filthpickle]

When I am king you will be first against the wall.....
With your opinion which is of no con-se-queeence aaaaat allllllllll
What's thaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaat?

Re:Really?

[gstrickler]

There is a HUGE difference between knowing who you call or what websites you visit (available from network info) and knowing which apps you're using or monitoring your key strokes. The latter is none of their business, and key logging can allow them to access your passwords. That's completely inappropriate and probably a crime.

Re:Really?

[element-o.p.]

That's why you will never be in charge.

If you don't have the financial backing from the corporations, you will never even make the news headlines, much less actually get elected to anything. Not saying I disagree, mind you, just that it's a pipe dream.

Re:Really?

[zill]

Except both Bush and Obama enacted laws to give those telecoms retroactive immunity. What now?

Re:Really?

[ArsonSmith]

Yes, in order to fairly bill you they have to be able to show how much air time you have "extorted" from their network.

Re:Really?

[gl4ss]

america sucks in this regard it seems then.

you know whats REALLY funny? THE CUSTOMER IS PAYING for these data transfers.

Re:Really?

[Anonymous Coward]

It's a nice hook into your favorite congressperson's personal information. Exploit, publish, advertise.

Anonymously of course.

Then see how long before congress restricts the installation of rootkits into their phones. Of course, they'll go after the "hacker" as well, but with sufficient care and anonymouty, they should only be left with the carrier and CIQ to go after.

Lather, rinse, repeat.

So

[leon.gandalf]

How to identify and remove this application would be nice...

Re:So

[WorBlux]

ADB is probably the best bet.

Re:So

[Rootkit]

http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ The bottom of this page has a section about detection including an app to detect hidden UIs.

Re:So

[P-niiice]

It's tightly integrated into your rom. You have to install a CIQ-free rom or flash an add-on to remove it Go to XDA, read, learn, profit.

Re:So

[slider2800]

you forgot to put "???" in front of profit.

Re:So

[Andy Dodd]

Identify - not too hard, the linked articles have a good number of ways.

Remove - that's a LOT harder. It's got hooks all over the system, so often removing the libraries causes everything to start crashing. As time progresses, CIQ implementations become more and more invasive, to the point where on recent leaks for the Samsung Infuse 4G, it appears that they even modified wpa_supplicant with CIQ hooks! (I don't have the logcat with me now - but it's obvious that CIQ is trying to phone home when I try to associate with my access point. This may be why wifi fails on that leak if you're running without a SIM card.)

"Smart" phones are a dumb buy.

[WorBlux]

This is why I'm not buying a "smart" phone until until they release one with a fully open software stack (excluding the little bit of firmware that controls the cellular modem.)

Re:"Smart" phones are a dumb buy.

[Tragek]

But if you're worried about privacy and control, doesn't it worry you about what can be hidden in the baseband?

If I were a government of power, trying to add surveillance tech, that's where I'd put it!

Re:"Smart" phones are a dumb buy.

[mlts]

Probably your best bet will be a Nexus series with CyanogenMod ROM. That is as close to open as you will find on any smartphone since the N900.

Re:"Smart" phones are a dumb buy.

[Tragek]

But if you were worried about privacy and control, why exclude the baseband firmware? If one is powerful and malicious, wouldn't that be the ideal place to put surveillance tech?

Re:"Smart" phones are a dumb buy.

[Anonymous Coward]

You make the assumption that your "dumb" phone doesn't contain something similar. I'd be surprised if it doesn't. People dig into smart phone OSes more and so find more of these things out. One could argue that by using a smart phone you might at least be better educated (through reading /. and tech blogs) about the stuff carriers are loading onto your phone that you may/may not want. With a "dumb" phone, you may just have the same problems but sitting in ignorance of them. And you may find that preferable. To each his own.

Re:"Smart" phones are a dumb buy.

[GReaToaK_2000]

Anyone that complains about personal info / privacy concerns and uses hotmail, yahoo, gmail, facebook, twitt-head-er, etc. etc. has NO leg to stand on.

Re:"Smart" phones are a dumb buy.

[Anonymous Coward]

Have you tried the Nokia N900?

Re:"Smart" phones are a dumb buy.

[WorBlux]

Sure, but you can encyrpt communications point to point. (ssh tunnel, GPG, or a SIP provider the supports encryption).

Re:"Smart" phones are a dumb buy.

[WorBlux]

Because It's fairly implausible any carrier would let you set some of the data in it, and again you can encrypt the data-stream.

Re:"Smart" phones are a dumb buy.

[JDG1980]

Anyone that complains about personal info / privacy concerns and uses hotmail, yahoo, gmail, facebook, twitt-head-er, etc. etc. has NO leg to stand on.

Oh, please. With Facebook, anyone with half a clue knows going in that you shouldn't post anything you don't want seen in public. Same goes for Twitter.

Phone calls are very different. You have an expectation of privacy when calling someone. Laws going back decades prohibit wiretapping without a warrant.

Re:"Smart" phones are a dumb buy.

[surgen]

has NO leg to stand on.

YEAH! You're so right, just because privacy implications of using service X are well understood means you have NO excuse not to understand the privacy implications of Y. Even if X makes it clear by the inherent nature of X, and Y hides it from the user as much as possible, there is exactly no difference.

Re:"Smart" phones are a dumb buy.

[Sloppy]

doesn't it worry you about what can be hidden in the baseband?

As long as the baseband really just includes the radio (i.e. microphone, keys/touch, screen, etc drivers aren't included in that) then it can be treated as being part of the network. And the network is already untrusted, i.e. your own radio being compromised is no worse than your ISP (or a backbone, or the person-you're-talking-to's ISP) being compromised.

Re:"Smart" phones are a dumb buy.

[Tragek]

Fair point.

Re:"Smart" phones are a dumb buy.

[zill]

What part of a "fully open software stack" don't you understand?

Re:"Smart" phones are a dumb buy.

[zill]

Ooops, disregard that. I didn't read his baseband exception. Baseband is software, so it's part of the software stack.

Re:"Smart" phones are a dumb buy.

[Anonymous Coward]

A better place to put this would be in the cellphone tower. That way *every* device can be snooped upon.

Re:"Smart" phones are a dumb buy.

[spire3661]

And I would say you are naive. Expectation of privacy is dead everywhere. It died when Congress made the telcos exempt from prosecution. Expect everything you utter over infrastructure to be intercepted.

Re:"Smart" phones are a dumb buy.

[Tragek]

Kudos on retracting. Manners on the internet. Whoda-thunk.

Re:"Smart" phones are a dumb buy.

[The Moof]

All of which does nothing to protect you from the keylogger.

Re:"Smart" phones are a dumb buy.

[Anonymous Coward]

why exclude that?

Re:"Smart" phones are a dumb buy.

[WorBlux]

But controlling the software on the main processor does.

Re:"Smart" phones are a dumb buy.

[Bucky24]

Not if you have a physical keyboard (which a lot of phones do these days) and the keylogger is embedded in the chipset.

Re:"Smart" phones are a dumb buy.

[Anonymous Coward]

and if the keylogger has a union and demands 1000 extra keyloggers to handle all the keylogging? whos to pay for that?

Re:"Smart" phones are a dumb buy.

[WorBlux]

Sure, but it would add to the hardware costs (which manufacturers are loathe to do), and introduce some odd traces. Sure it's possible, but when 95% of people fall for the software tricks, why would they bother?

Re:"Smart" phones are a dumb buy.

[Bucky24]

That's a good point.

Re:"Smart" phones are a dumb buy.

[shutdown -p now]

Why would Nexus with CM be more open than Nexus with stock firmware?

Re:"Smart" phones are a dumb buy.

[mlts]

More options -- you can customize access roles per app with CM. With stock rooted firmware, options are more limited for limiting access to apps, mainly using DroidWall so apps that don't need to phone home don't have that ability.

Re:"Smart" phones are a dumb buy.

[Anonymous Coward]

and just how would you suggest the tower get access to your typed in passwords (assuming that data is sent over https)? The whole point of having it installed on the device is so it can collect data that can't be obtained by monitoring the network.

Re:"Smart" phones are a dumb buy.

[shmlco]

"This is why I'm not buying a "smart" phone until until they release one with a fully open software stack (excluding the little bit of firmware that controls the cellular modem.)"

You do realize, of course, that your dumb phone ALSO has a processor and software inside of it? You realize that your carrier already has access to all of your calls and texts? That they already have access to your location thanks to 911 location services?

Your illusion that your dumb phone is any safer... AT ALL... is just that. An illusion...

Re:"Smart" phones are a dumb buy.

[WorBlux]

You realize that your carrier already has access to all of your calls and texts?

Ya because they have to bill you, and be able to route calls. However the carrier may not record or analyze calls due to wiretapping laws. Smart phones open up a lot wider domain of data as well that has virtually no legal protection or restrictions.

Which reminds me...

[JustAnotherIdiot]

...I need to root my phone and install a mod onto it.
Here's hoping there's a stable mod for the Incredible 2, because last time I looked they were all pretty flakey.

Re:Which reminds me...

[dingo_kinznerhook]

It might be flakey, but there's a CyanogenMod build for the Incredible 2. http://www.cyanogenmod.com/devices/htc-incredible-2

Re:Which reminds me...

[JustAnotherIdiot]

Which is more than I could find last i looked, the only thing i could find before was terribly made user mods released in forums, and often in the same thread many users reported them not working. Thanks for the link. I'll be messing it more after work.

What about Nokia N9?

[IYagami]

An open terminal with great reviews

Data Cap

[BradleyUffner]

I bet the bandwidth it uses to send this data back to the carrier is deducted from our monthly cap too...

Re:Data Cap

[stackOVFL]

Ooooo now there's a good point. Those communist heathens better send there key logging, data sniffing, packets grabbing, app logging data back on their own dime!

Re:Data Cap

[Bucky24]

Ya know that's an interesting point. My housemate just got an iPhone 6 days ago and already it tells him he has used 0.5 GB of traffic. He has no idea why, since he's not a heavy web user at all (though he does have Facebook/Twitter installed on it so that might be the reason...).

Re:Data Cap

[vaporland]

iOS 5 introduced wireless updating. 500mb seems like it could be the iOS 5.01 update...

and if your friend has an iPhone 6, please post photos...

Re:Data Cap

[Bucky24]

My friend got an iPhone, 6 days ago. Not an iPhone 6. :P

So?

[Anonymous Coward]

Basically your carrier has a way to precisely know what the fuck you did and your phone died. Instead of playing the guessing game at customer support. It even has an opt-out option.

http://www.xda-developers.com/wp-content/uploads/2011/11/CIQoverview.png?139d23

How is this different than the information any new software collects to improve your experience, providing you with an opt-in/out option as well?
Why is this bad again?

Re:So?

[SmurfButcher Bob]

There's nothing bad about it if you are of no merit.

For those who are... it's bad because carriers have no control of their infrastructure. It's bad because both the Chinese haxxors and the Russian mob have more control over that infrastructure than the carriers do. It's bad because the carriers have no accountability for their incompetence, negligence, or recklessness. It's bad because this package is trivial to hijack by an attacker - the attacker just needs to change some settings and then vanish. It's bad because the carriers have no incentive to stop the Russians and Chinese from farming you.

The carrier doesn't give two shits about why your phone died... there is no "customer support". If the phone dies, they either re-image or replace. Anything more will cost too much.
The carrier isn't the one who'd triage the dead phone, anyway. It's the $7.00/hr schmuck in the shopping mall who does. I hope to god THEY do not have access to this CIQ data.

Re:So?

[compro01]

Because said "opt-out" option cannot be accessed conventionally and requires root to do so.

Re:So?

[Andy Dodd]

Because it only has an opt-out option in the original software as delivered to the carriers/manufacturers.

By the time it gets into your hands, it is more invasive and the opt-out option has been removed. In fact, the software is fairly aggressively hidden from the user so it becomes difficult to even know about it.

some legitimate technical questions

[nimbius]

that should get asked about the article
does cyanogenmod mitigate this threat? if not how about whispercore? could whisper systems in the future detect and correct this
rootkit?
can rootkit detection systems presently available in linux detect and successfully help a hacker to remove the rootkit?

Re:some legitimate technical questions

[esocid]

You put a whole new system image onto the phone, so I can't imagine it would still be there. If it was in /system, it's not afterwards.

Re:some legitimate technical questions

[Andy Dodd]

Cyanogenmod does not have CIQ in the first place.

It is also possible, with a LOT of work, to remove CIQ's hooks from the system using baksmali/smali (basically, a disassembler/assembler for Java).

Unfortunately, the developers on XDA who put forth NoCIQ mods seem to be considering this their "special sauce" to set themselves apart and get some donations - when asked where to look for hooks on a device they don't support, you get nothing but silence. No guides, even high-level ones oriented towards developers.

Re:some legitimate technical questions

[toadlife]

I have a ROM for the Epic4G with Carrier IQ removed. The first person who figured out how to remove CarrierIQ, posted the fixed jar files for all ROM developers to use.

I think the part of the reason why some of these mods don't come with guides is because they involve modifying those smali files, of which the stricture tends to very wildly from device to device.

Since I have tons of other mods on my ROM that affect the same files that CarrierIQ removal affects, I had to kang the changes by decompiling the stock jar/apk files and CIQ removed jar/apk files and comparing them with WinMerge.

The carrierIQ removal was actually fairly trivial compared the most challenging mod I integrated - adding a reboot and reboot to CWM recovery to the power menu. I followed an excellent guide on how to do it, but the guide was for a different device, were the structure and layout of the smali files was significantly different than the those that were on my phone.

You are right about devs not always sharing though. It's a giant rat race with everyone trying to integrate the latest hack or mod first.

Some guy messaged me asking to trade the code to the power menu mod in my ROM in exchange for something [that I didn't need]. I thought it was silly and offered to help him for free. I told him about the guide I followed, but advised him to decompile my jar/apk files and rip the changes, but he said he would just follow the guide. It's been a week and still no power menu mod in his rom.

There is definitely a culture clash over at XDA. A lot of devs don't seem to get the point of open source.

Re:some legitimate technical questions

[kesuki]

trusted computing means they can put it right in the chip and short of cracking the case and replacing the chip there is nothing that can be done to remove a truly well thought out rootkited phone from factory. i don't know if CiQ is done in software or hardware though.

Re:some legitimate technical questions

[thegarbz]

There needs to be some common interface for the rootkit to operate though. It's one thing to make a hardware root kit and quite another to get useful data out of it. Take for instance a keystroke logger on the screen. Firstly it may interface with some API the carriers put in the keyboard and may not work with Cyanogenmod. If it reads the location of the presses from hardware it may still not know what is being typed due to not knowing the layout of the keyboard. Or maybe the user has Swype installed in which case the keypresses aren't actually keypresses. Or they use their dictionary prediction a lot in which case you need some way of figuring out which word came up.

It's not so simple to simply have hardware to TCM based rootkits without a consistent OS underneath. So yes there is a chance it may be there. There's also a chance it will break if the user installs a different OS on the phone.

Re:some legitimate technical questions

[Andy Dodd]

"posted the fixed jar files for all ROM developers to use."
No, that's not for all ROM developers to use, that's only useful for ROM developers using the EXACT same base ROM that the NoCIQ mod was developed for.

It is utterly useless to anyone trying to remove CIQ from a ROM with a different base even for the same device, let alone someone trying to remove CIQ from a different device.

Now if they just had a high-level list saying "These are the jar files normally affected, these are the smali files normally affected within the .jar, and these are the function calls to look for in those files", it would be a LOT easier to port the NoCIQ mods to other devices.

Similar to what I did with mods to Settings.apk to allow NFC to work on the SGH-I777 - On IRC, it took me one sentence that two ROM devs had no trouble implementing:
"Search for NfcAdapter in WirelessSettings.smali, and delete the second occurrence of removePreference after that" - no need for anyone to find the original Settings.apk of my modified one to diff against.

And yeah, the power menu mod is a bitch - it fails frequently. I wasn't able to do it until gtg465x's commit at https://github.com/gtg465x/unnamed_rom/commit/1911cf0561bd278e86f1d238b272417b57d0b230 (As do many mods that involve adding something - removal mods are USUALLY easier.)

We've been fortunate in the SGH-I777 community - most of us came from the Infuse community, where nearly everyone worked together because there were few of us and the device was a massive fucking annoyance. As a result there's a lot of coordination and cooperation on IRC. Developers that choose not to coordinate/cooperate often find themselves unable to keep up - such as one guy that took almost a week to release sources for his kernel, and when he did so, just did an initial commit of his current source tree. Meets the letter but not the spirit of the GPL...

The problem is you have a lot of oldschool ROM cooks from the WinMo days, colliding with the open-source crowd, such as the Cyanogenmod team, and in my experience most of the better kernel hackers are the ones that post full git commit histories because they have nothing to hide AND believe in peer review. A lot of kernels are barely GPL-compliant (e.g. no source for betas, when source drops it's a megatarball) and when I read the threads for those, I see that whoever it is seems to have broken all sorts of things in the pursuit of ShinyUselessFeature that everyone asks for despite it not really being that useful and having major potential negative side effects.

Re:some legitimate technical questions

[toadlife]

The problem is you have a lot of oldschool ROM cooks from the WinMo days, colliding with the open-source crowd, such as the Cyanogenmod team, and in my experience most of the better kernel hackers are the ones that post full git commit histories because they have nothing to hide AND believe in peer review. A lot of kernels are barely GPL-compliant (e.g. no source for betas, when source drops it's a megatarball) and when I read the threads for those, I see that whoever it is seems to have broken all sorts of things in the pursuit of ShinyUselessFeature that everyone asks for despite it not really being that useful and having major potential negative side effects.

Believe me I know. I made a few enemies yesterday int he Epic 4G dev forum.

http://forum.xda-developers.com/showthread.php?p=19454556#post19454556

His (the guy distributing the kernel) excuse was that he had trouble getting git to work.

Rule #1: If you can figure out how to get git working, you shouldn't be mucking around with kernels and you sure as hell should not be distributing them publicly.

Re:some legitimate technical questions

[Andy Dodd]

Man I just couldn't resist jumping on the bozomoron who claimed that Google was being GPL-noncompliant and asked for him to provide even a single example.

Ooh, found the battery drain bug!

[Anonymous Coward]

How much battery drain does this app cause? Is this un-killable, always on, always logging service part of the reason we see inconsistent battery drain across a large group of devices?

Troll this guy down to where he belongs.

[Anonymous Coward]

Twit, please link to the articles that reveal apple has key-loggers on the iPhone or get off your "I'm kewl and a free-thinker because I hate Apple" pedestal and make comments you can actually back up.

Re:Troll this guy down to where he belongs.

[Anonymous Coward]

Absence of evidence != Evidence of absence... Anyone even vaguely familiar with scientific principles (or information security) should know this.

Re:Troll this guy down to where he belongs.

[Anonymous Coward]

Apple customers can use a key-logger so so can u!

I am using this iPhone keylogger to track my little son's messages and call activities, and it works fine, but I am not sure if it can save your email and password for your Facebook app.
http://www.iphone-spy-software.com

Re:Troll this guy down to where he belongs.

[Anonymous Coward]

Great to see you don't/can't trust your own son!

Re:Troll this guy down to where he belongs.

[filthpickle]

Not saying this is the case for the GP....but I know lots of parents who would laugh at you for saying that and then say "Hell no I don't trust him". Some of us had to be taught the consequences of doing wrong.

Re:Troll this guy down to where he belongs.

[BitZtream]

Funny, that's the common argument used against the existence of God by many idiots who thunk they understand what science is

Re:Troll this guy down to where he belongs.

[WorBlux]

The fact not appearing is presumed not to exist. (quod non apparet non est) This is the standard used in courts. It's also a waste of time to act otherwise.

Re:Troll this guy down to where he belongs.

[cayenne8]

Not saying this is the case for the GP....but I know lots of parents who would laugh at you for saying that and then say "Hell no I don't trust him". Some of us had to be taught the consequences of doing wrong.

Whew...boy, I'm glad I grew up in the days before cell phones, and all this tracking crap.

I mean, I grew up in a world without anything but land lines as a kid...I came home from school on the bus, and was home alone for hours before the parental units came in.

Even so, I learned the consequences of doing wrong....when they caught me, and even so..I learned them too, when I was able to fix the problem I made, and be smart (and sometimes lucky) enough to cover my tracks.

I actually feel a bit sorry for kids today...helicopter parents, every activity scheduled and organized, soccer moms, etc.

I don't think kids get to be kids...during summers, my parents worked, and from about 6th-7th grade on, I pretty much had free run of the neighborhood and one surrounding me. When young, I just had to call into Mom at the office every couple hours or so...but as I got older, didn't have to do that. My friends and I swam at the neighborhood pool....built forts out in the woods (before the developed the whole area), and rode bikes and skatboards all over the place...cooked our own lunches.

All without extreme supervision. I don't see that for many kids today....hell, I'm almost afraid that these days, the way our parents raised us and left us alone at times, etc....they'd be arrested for child abuse or something in todays world.

Sad....

You'd think people would learn.

[Anonymous Coward]

This should surprise no one. Phone carriers are consumer hostile and one of android's selling points is that is more "carrier friendly" than the iphone.
Apple's biggest contribution to the mobile device market is and was wrestling control away from carriers. I recognized this from day one and I've enjoyed my iphone since.

I will trust Apple over any mobile phone carrier. Period.

Re:You'd think people would learn.

[scot4875]

Meh. I don't have an iPhone but I somehow manage to not run any of Sprint's code on my phone. Apple doesn't have a monopoly on handsets that aren't slaves to the carrier.

--Jeremy

Samsung Vibrant

[oakgrove]

When I rooted my Vibrant and stripped out CIQ, the performance went through the roof. Logging every single thing a user does takes a toll apparently.

Re:Samsung Vibrant

[gstoddart]

When I rooted my Vibrant and stripped out CIQ, the performance went through the roof. Logging every single thing a user does takes a toll apparently.

And, I'm betting it's the users paying for the data plan usage that sends this stuff.

So, you're paying extra to be snooped on. I highly doubt they exclude this data from what they charge you.

Re:Samsung Vibrant

[Bradmont]

Care to post info on how you uninstalled it?

Re:Samsung Vibrant

[oakgrove]

Unfortunately, I can't take the real credit. When I installed Cyanogenmod, ciq was not a part of the package.

Re:Samsung Vibrant

[Anonymous Coward]

When I rooted my Vibrant and stripped out CIQ, the performance went through the roof. Logging every single thing a user does takes a toll apparently.

Oh, then that explains why Windows is so slow.

Re:Samsung Vibrant

[BeardedChimp]

Unfortunately, I can't take the real credit. When I installed Cyanogenmod, ciq was not a part of the package.

And you didn't think for a second that the performance difference could have been because you installed cyanogenmod on it, an android distribution widely known for speeding up phones?
You deserve to be modded troll for being so misleading.

Re:Samsung Vibrant

[Anonymous Coward]

CIQ does not record any personal information. It only sends data when it's reached it's maximum for logging and it only turns on and sends information when you're actively using your data so it won't affect your battery life. It barely records anything and it most certainly doesn't record websites you visit. It's strictly bare bones usage data and it's anonymous. Also, you aren't charged for the data as it's flagged as carrier request data (like the text messages you are sent by a carrier do not count against your text message limit if you have one).

In other words, take the tinfoil off guys.

Funny

[Anonymous Coward]

how "the land of the free" also means that the companies are free to rape your privacy. Horray for the ultimate freedom. Nothing but hard work to kepp up to date on who is abusing you.

The Price of Progress

[NicknamesAreStupid]

Those who can, do. It has always been true with technology. As we get older and see more of the effects, we are more aware, more affected. Privacy has been shrinking along with the open terrain since the Garden of Eden (metaphorically speaking). In 100 years, the privacy issues will extend into our subconscious minds. This seems inevitable as much as it seems disturbing. I guess that is why we grow old and die.

Re:The Price of Progress

[Anonymous Coward]

I'm interested to see how the Occupy Wallstreet protests turn out... a litmus test for how much the companies feel they own the 99%? With the 99% throwing themselves at them it's hard not to see how the attitude is developing. Companies OWN their customers in so many ways these days... it used to be a figure of speech. Something has to give... but what, and when?

list?

[Taibhsear]

Does anyone have a list of the phones/carriers that implement this?
"many Android, Nokia, and BlackBerry smartphones" doesn't really help us.

Re:list?

[Anonymous Coward]

I can only speak for my Employer... BlackBerry: 0
It's a very misleading article. Yes it shows that a "root kit" install has appeared on an Android device, but it is clear that the author has no idea about the security restrictions applicable to BB devices. Want to block your Carrier's Application? Simply go to Security Options -> Advanced Security Options -> Certificates. Find your Carrier certs and revoke them. It won't block your phone calls, or data connections, but any app which your carrier has installed to your device with a Service Book will be prevented from running.
Oh, and you can also see exactly what modules are stored on your device under the Options->Applications listings. I seriously doubt you will ever find this stuff in there.

Re:list?

[GameboyRMH]

Was looking for the same thing, the original blog source of all this is being slashdotted.

I've bought all my phones unlocked and unbranded, am I safe?

Re:list?

[Sponge Bath]

It can't be AT&T, because they are cups filled to overflowing with the very cream of human goodness.

Re:list?

[GameboyRMH]

Update: one article says the processes on Android are named IQRD and IQAgent, I can't find any processes with "iq" or "carrier" in the name on my N900.

Re:list?

[Bucky24]

Want to block your Carrier's Application? Simply go to Security Options -> Advanced Security Options -> Certificates. Find your Carrier certs and revoke them. It won't block your phone calls, or data connections, but any app which your carrier has installed to your device with a Service Book will be prevented from running.

Seriously? Can someone else verify this? I'd love to do it but I've already bricked my phone last month and really can't afford to get another one if I brick it again....

Re:list?

[CimmerianX]

I wanted to verify this. So i got a blackberry 9700 on ATT BES plan. I checked the Certificates installed and all I see are the normal trusted root certs I would expect, i.e. Digicert, Verisign. I saw 2 for cingular. So maybe these are old certs from when ATT bought cingular, I revoked these. Phone still functions.

However, is there any way of viewing the apps installed in the BES. All I see in that applications listing is stuff like "Blackberry Phone", "Blackberry App World". I doubt I would see every module of every app installed there.....

BTW, whats with all the DOD certs on a BB anyway?

Re:list?

[taylortbb]

Go to Menu -> Modules while in the applications list and you'll see every module. Opening up an application will also show you the modules for that application, and let you edit the app's permissions. I see everything that's an actual app my carrier (Rogers) has installed, and found the Rogers certificates. The VPLs (virtual pre-loads) are just homescreen bookmarks so they're not listed as apps until you open them and do the installation. Most things carriers push are just VPLs.

I should point out though that your carrier already knows what numbers you dialled and when you received messages. Anything that connects off device is obviously readable and loggable by them, BES of course excepted due to the encryption.

How much data?

[oic0]

Soooo.... is data sent to them by this app exempt from your data cap and data usage rates? if not, perhaps someone can start a class action and make them bleed.

Re:How much data?

[skr95062]

Unfortunately SCOTUS has ruled the binding arbitration clause in the contract prohibits you from filing or joining a class action suit against the carrier.
So if the carrier is transmitting the data collected by CIQ and counting it against your data cap, which they probably are, you might stand a chance of winning an arbitration case against the carrier. After all they are using data from the data plan you are paying for that you can't use. You could always try a criminal complaint against the carrier, I doubt if that would work, but technically they are depriving you of data that you paid for. It would be interesting to see how much data they are transmitting each time CIQ phones home.

Sounds like

[Anonymous Coward]

This sounds very similar to the Microsoft CEIP (Customer Experience Improvement) data collection that is strictly opt-in. The difference? Nobody gets to opt-in (or out) of this smart phone based one. But it is probably for the same intent - figure out what features get used, which don't get used, which may be confusing, etc. It would be nice if Motorola would use this to figure out how many people replace their Blur launcher with something else. Maybe they would stop development on Blur if they knew. Now, this should be opt-in. End of story. The purpose probably isn't nefarious at all. But it should be opt-in.

The real, important questions...

[Anonymous Coward]

In typical slashdot style, I'm seeing a lot of In Soviet Russia jokes, and a lot of apple vs android comments. Why is nobody asking the real questions?

1.How can we as users detect if our phones are running this software?
2.Does a completely custom rom negate this? (cyanogen, etc)
3.Is it possible to remove or deactivate it on a rooted phone with stock rom?

And so on. Generally speaking, we should be asking the how's and why's on this. Not talking about setting carrier CEOs on fire.

Re:The real, important questions...

[filthpickle]

absolutely not an authority on this. Just repeating some answers that were already in the thread when you posted.

1.How can we as users detect if our phones are running this software?

http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ [androidsecuritytest.com] The bottom of this page has a section about detection including an app to detect hidden UIs. (posted by rootkit above)

2.Does a completely custom rom negate this? (cyanogen, etc)

Yes, several people have posted that they do. Cyanogen was specifically mentioned.

3.Is it possible to remove or deactivate it on a rooted phone with stock rom?

I doubt it on removal, it has been posted that you can opt out on several phones.

Re:The real, important questions...

[Anonymous Coward]

1. Link is slashdotted. Has been for a while now.
2. Yes, I saw plenty of people make reference to it as well, but nothing to back it up on. Do we even know where this software resides? Is it in the rom itself? Or does it get loaded in ram by the bootloader on startup? Or some other method that doesn't rely on the rom? If you saw some reference I missed as to how people know that phones running cyanogen are fine, please link it.
3. But if it is in the rom, as you imply, then with root privilege one could easy delete the program.

Re:The real, important questions...

[zill]

1. this
2. Yes
3. Yes, see above link.

2 Questions

[JustNiz]

1) How can you authoritatively determine the android phone you are about to buy doesn't have Carrier IQ installed, BEFORE you buy it?

2) If you already have an android phone, (how) can you check for and uninstall Carrier IQ?

Re:2 Questions

[SmurfButcher Bob]

3. If your lawyer has this on his (her) phone, are they in breach of confidence? What about now that they know about CIQ?
4. If a medical *anything* has this on their phone, is this a HIPAA issue?

Re:2 Questions

[dukerobillard]

1) Don't buy your phone from a Carrier. I bought my Nexus One from Google. I bought my previous (non-smart) phone from some guy on Ebay.

Re:2 Questions

[Andy Dodd]

1/2 - Go to XDA. If the phone has CIQ, people there will know.

Re:2 Questions

[compro01]

1. Ask around basically.

2. a guy on xdadevs whomped up an app to detect (requires root) and remove (requires root and 99 cent donation) CIQ, among other things. http://forum.xda-developers.com/showpost.php?p=17612559&postcount=109

Re:2 Questions

[GameboyRMH]

a guy on xdadevs whomped up an app to detect (requires root) and remove (requires root and 99 cent donation)

What a swell guy.

Re:2 Questions

[pjr.cc]

1) i dont believe you can unless someone is giong to start carrying a list of phones known to carry the CarrierIQ "Virus"..

2) been watching this for a while and im not 100% certain that you can... there isnt huge wadges of information yet available. All my android phones are rooted and one runs an original (carrier) rom... I cant see carrieriq anywhere, but i dont know if it is there or not... If i adb shell in, theres nothing in the process list that gives it away and I cant find much on the phone that suggests its there either.

Uninstall - its believed flashing a custom rom will get rid of it as its part of the rom not the phone..

Re:2 Questions

[Tomato42]

I'm quite sure this breaks EU data protection directive...

Re:2 Questions

[Anonymous Coward]

ha ha, asking for real info! -2!

Re:2 Questions

[CimmerianX]

Those are 2 excellent questions.

How about

5. How about Financial information transmitted through banking apps or to and from your bank staff's phones? Would this be a violation of GLBA or SOX?

Re:2 Questions

[rvw]

1. Ask around basically.

2. a guy on xdadevs whomped up an app to detect (requires root) and remove (requires root and 99 cent donation) CIQ, among other things. http://forum.xda-developers.com/showpost.php?p=17612559&postcount=109

"A guy"? You're talking about TrevE, the "guy" who discovered this.

Re:2 Questions

[Anonymous Coward]

1. Post article with security threat
2. Comment with link to 99 cent app
3. Profit!

Re:2 Questions

[Anonymous Coward]

3. yes.
4. yes.
Cry havoc, and let slip the sharks of law!

Re:2 Questions

[Anonymous Coward]

Wow. Thiat is a really good question.

Re:2 Questions

[Anonymous Coward]

1) You probably can't... this will be one of those "blank-faced"/"customer-service-says-huh?" moments. Also there probably isn't one.
2) To check: You can just assume you have it. And to get rid of it install another rom (seriously, it sounds less risky than to "rip out the hooks").

android permissions

[Anonymous Coward]

ever since I saw that this application was granted literally *every* permission in the android SDK, I made a point of killing the process after every reboot :P

Article title missing something...

[Anonymous Coward]

...namely "In the United States". I -- like most people around here -- buy my phones from consumer electronics retailers, not mobile phone carriers. I guess you don't have that luxury.

Re:Article title missing something...

[PPH]

Well, I'm in the United States. And I bought my last phone from a consumer electronics retailer .... mail ordered from the UK.

Like its a bad thing...

[srussia]

What are the "pros" to pounding yourself in the crotch with a sledgehammer?

Especially coming from someone whose nick is "larry bagina".

Iphone

[Anonymous Coward]

Carrier IQ is also present on the Iphone.

+1 Insightful Parent, -1 Ignorant Grandparent

[Kamiza Ikioi]

-nt-

CarrierIQ job opportunities...

[Anonymous Coward]

Tons of jobs on offer at CarrierIQ

Android is clearly the target
"Design, implement, extend and port our Java and C/C++ components of our mobile software technology for Android. ... Integrate our library onto new Android releases and OEM hardware platforms."

"The embedded device agents are currently shipped on more than 75 million devices across numerous device manufacturers and models. The solutions can be deployed across multiple wireless technologies such as CDMA2000, GSM, UMTS/WCDMA, WiFi, and device types such as feature phones, smart phones, PDAs, data cards."

in soviet russia

[mapkinase]

My phone company sends me the rootkit data. It is called an itemized phone bill.

A troll, by any other name would smell as awful...

[jeffmeden]

Jesus, mods, way to fall for a troll. Parent should be (Score:-5, Lying). There is no suggestion in any of the articles on this subject that the iPhone has this software, other than a CarrierIQ job requirement listing iPhone experience as optional...

RMS was right

[SigmundFloyd]

Stallman doesn't sound so crazy now...

Re:RMS was right

[Anonymous Coward]

Obxkcd

Re:RMS was right

[Anonymous Coward]

For anyone who can learn from history, Stallman never sounds crazy. He's been right too many times.

Re:RMS was right

[Anonymous Coward]

Being right and being crazy aren't mutually exclusive.

Re:RMS was right

[Tomato42]

How I want you to be wrong...

Re:RMS was right

[swillden]

Being right and being crazy aren't mutually exclusive.

Being occasionally right and being crazy aren't mutually exclusive. Being consistently right and being crazy are, though.

Re:RMS was right

[Anonymous Coward]

Stallman doesn't sound so crazy now...

He never did. But the fine line between genius and crazy is invisible to most people.

Re:RMS was right

[Anonymous Coward]

Sorry but it is impossible for Stallman not to sound crazy.

Re:RMS was right

[sentimental.bryan]

He is always right - it's just that he's a little weird as well.

Re:A troll, by any other name would smell as awful

[creepynut]

replying to undo mod. I fell for it. I'm a little trigger happy handing out the mod points.

So can I say no and still use what I bought?

[Anonymous Coward]

No?

Then it's not an agreement, is it.

Re:A troll, by any other name would smell as awful

[Anonymous Coward]

Here you go jackass. http://www.geek.com/articles/mobile/how-much-of-your-phone-is-yours-20111115/

If you weren't a dumbass, you could have clicked some of the links in TFA and found this out yourself.

Re:A troll, by any other name would smell as awful

[jeffmeden]

"CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well." This would be so poorly worded otherwise, that it is hard to believe that the author didn't simply mean to write "not confirmed". That, and all of the articles by Trevor (and those in the scene) make NO mention at all about the iPhone.

Limited info really.. But it *IS* for iphone

[pjr.cc]

From what I have read, and baring in mind the amount of information is limited, but IOS is indeed capable of carrying the carrieriq software and there are versions of the iphone out there with it already installed OR at least that is the suggestion from this particular site:

http://www.geek.com/articles/mobile/how-much-of-your-phone-is-yours-20111115/

I dont have an iphone, so i dont care either way personally.

The briefcase whispers goodbye

[ThatsNotPudding]

I wish more handset makes, especially the big ones (HTC, Motorola, Nokia) would do the same to offer their customers a much better and more consistent experience.

If they did, Apple would probably sue them for infringement.

Google's fault?

[pjr.cc]

I am something of a self-confessed google fan-boy - though the lustre of theirs has been very much tarnished by things they have done lately, such as keeping 3.x out of AOSP - amongst many other things. Generally my love of google is pretty low at the moment.

But, I personally dont really hold google responsible for any of this. They make an OS. Did microsoft get blamed when sony had that drm root-kit flooding cd's?

Or would you blame ubuntu if a fork of ubuntu carried a similar piece of software? Even if it were an ubuntu sanctioned derivative work?

Ultimately though, what control would google have over people doing this? probably not alot. The devices makers make the roms and (probably) customise them for the carriers, the fact that an app is capable of doing such a thing is unsurprising given it operates at the root level and i doubt there would be much from the android side you could really do to stop it from occurring.

However, given its in the open now, I wonder what the legal (i.e. government) response might be, It could have serious implications to numerous compliance-type privacy issues. I suspect we'll probably see a government probe coming along sometime soon personally.

Re:Google's fault?

[farble1670]

But, I personally dont really hold google responsible for any of this. They make an OS. Did microsoft get blamed when sony had that drm root-kit flooding cd's?

people generally don't get the relationship between AOSP and what is on their phones. first, phone manufacturers take the code from AOSP, and customize the hell out of it and add their special hooks and software. then the carrier gets it, and again customizes the hell out of it and *their* special software. in both cases they can add and modify software at any level in the OS. they can modify the kernel, whatever.

google has no control over any of that. "android" is just a code base that carriers and manufacturers start from when building the operating system they will put on their phones. when it comes to production level shipping software, there's no one thing called "android". to be correct we should be referring to things as htc+at&t android or samsung+sprint android, etc.

Re:Google's fault?

[shutdown -p now]

Actually, my understanding is that Google is trying to exert more control over what ends up on people's devices now. That was part of the reason why they withheld the source code for 3.x from everyone except for companies licensing it from them - and from what I've heard, there were some hefty restrictions on what licensees could do with it - apparently, Asus has barely convinced Google to let them change the stock icons for Back/Home/Tasks in Honeycomb, and didn't manage to convince them to have an animated wallpaper set by default.

Not sure where things are with 4.x. On one hand it's FOSS again now so it's technically free-for-all, but that doesn't include Market, and it probably comes with some strings attached. Hopefully Google will keep it in check so that manufacturers don't load too much crapware on the phones - it seems that it's where most of complaints about Android from casual users (like "very sluggish") actually come from, so it directly hurts the brand image.

Re:Google's fault?

[scot4875]

such as keeping 3.x out of AOSP

Code's out; you can strike that one off your list.

--Jeremy

Re:Google's fault?

[gl4ss]

1) htc, samsung etc DON'T take code from android open source project, they get dumps direct from google.

2) google could bar them from including the market and other google sw if they install extra crap the user can't uninstall.

3) they implied something along these lines with ics announcement, but wouldn't really be specific(user can uninstall all packages he doesn't want or so).

so google has plenty of control over google licensed androids, which is pretty much 99% of what these carriers are selling. providing a sw like carrierIQ baked in the firmware is something the manufacturers think will make it more probable that the carrier will choose to push their devices towards the carriers "drone" users, who in the views of the marketing folk will just pick whatever is available on contract. this is the problem with carrier subsidy phones(which are a hinderance on free trade and consumer rights, they should just be done with, if someone wants to lease a phone, fine, but it should be a separate business from the network provider).

I feel partially dirty, too. wrote some sw that could be turned into something like this.

there's a big reason and a way how google could have fought this quite easily, NO HIDDEN DATA TRANSFERS clause to their licensing. you would think that's pretty reasonable and simple, too, since users are going to pay for the data transfers.

btw, if someone has found this shipping in EU: request your data!

What do you mean? It already has.

[SuperKendall]

A walled garden would not have prevented this.

How do you you figure that?

The case in point is obviously Apple. They do not do an end-run around the providers as you advocate for. Yet there is no such software on any iPhone.

The carriers will screw with whoever they can. You have to stand up to them; Apple did, and Google never even tried.

Old phone

[SuperTechnoNerd]

This is one of the many reasons why I'll never give up my good old trusty 2G phone. No gizmos or fluff - it makes and receives calls and text messages. That's all I need. Only way I'll get rid of it is if you rip it out of my hands after I die. :)

Boot To Gecko

[Anonymous Coward]

While Mozillas Boot to Gecko project may be the answer to this although will the phone network companies allow access to their network if you have B2G installed?

https://wiki.mozilla.org/B2G

Re:Doesn't Matter (won't work as a phone)

[ankhank]

I'd call that a feature.

A decent tablet/handheld I can control that doesn't require a tap directly into my bank account and personal information?

Sounds like what Palm OS 5 was promising.

Re:What do you mean? It already has.

[bberens]

Google hasn't (until recently when it purchased Motorola) really had much skin in the game. Do the Nexus phones have this software? Blaming Google is like blaming MSFT for the malware Dell/HP/etc. put on consumer devices.

Re:What do you mean? It already has.

[geminidomino]

Yet there is no such software on any iPhone.

Prove it.

And since I'm not wholly unreasonable and know the logical problems of proving a negative (as opposed to you, who seems to have no problem with making factually non-falsifiable statements), I'm sure we'll all be happy to take your word with a notarized deposition from all of the board of directors of Apple, stating that there is no such software on any iPhone, and that they will refund the full original purchase price of any iPhone with such software, as well as tender their own resignations as well as those of every executive in the company.
Also, that if that policy changes, every iPhone that comes with such software after the fact will have this fact displayed in a big, gaudy, shiny red-foil sticker on the box.

Re:What do you mean? It already has.

[Anonymous Coward]

Umm, hello? Can you or can you not buy an iPhone directly from Apple? End-run around carriers achieved.

Re:What do you mean? It already has.

[Ossifer]

Prove Android is free of spyware first. Just because you get to see the source code doesn't mean it doesn't exist. So go head over to Mountain View to sign up Google's board...

Re:What do you mean? It already has.

[Bucky24]

Um, I hate to point it out, but what you just said (prove yours before I prove mine) tells me that you can't prove it, so you're just drawing attention away from it.

Re:What do you mean? It already has.

[Ossifer]

No, I'm just ridiculing the stupidity of your comment.

Re:What do you mean? It already has.

[Bucky24]

But I hadn't commented until just then.... Did you even bother to see who replied to you? :P

CAN you prove that the iPhone doesn't have spyware on it? I agree that Android probably does.

Re:What do you mean? It already has.

[geminidomino]

I never said android didn't. GP is the one making claims, not me. In fact, the presence of this story is evidence that Android does. So why are you even posting, for that matter?

Jobs is dead. Get your nose out of his ass already and maybe your knee will stop jerking like that.

Privacy?

[StikyPad]

the software runs as root and the privacy implications are pretty severe.

Jesus. Next I bet the carriers will start directing all of their customers cellular voice, data, and SMS traffic through their servers, and maybe even their "strategic partners'"' servers as well. Just think of the potential privacy implications of that!

Re:What do you mean? It already has.

[Ossifer]

Wow, impressive argument!

You essentially nullify your own statement and then proceed to insult with vulgarities...

Impressive!

Re:What do you mean? It already has.

[Ossifer]

My sincerest apologies... I thought I had verified...

s/your/the/

Personally I doubt that either iOS nor "core Android" (that is to say, what Google releases) has anything truly close to actual, nefarious, spyware. However once Android is turned over to the carriers....

Re:What do you mean? It already has.

[Ossifer]

arghh... s/either/neither/ ...oh wait, now I'm into double-negative territory... s/doubt/believe/

Re:What do you mean? It already has.

[geminidomino]

I nullify what statement? That SuperKendall is full of shit?
I'd ask how I did that, but I think getting that much of a glimpse of what's rattling on inside your head there would be like looking on the face of Cthulu.

Are you functionally illiterate or did mommy just forget to give you your medicine?

Re:What do you mean? It already has.

[Ossifer]

And I repeat, "Impressive!"

Re:What do you mean? It already has.

[Bucky24]

Oh aye, the core Android likely doesn't, but as far as the stuff the carriers sell us... I wouldn't put it past them.

Re:What do you mean? It already has.

[idontgno]

Ad hominem: the sophisticated way to say "I lose".

Re:What do you mean? It already has.

[Anonymous Coward]

"Yet there is no such software on any iPhone."

What makes you think this?

win 98

[__aazsst3756]

This and other malware issues (Google deletes them from app store regularly) make Android just seem like Win 98 to me. I was trying to buy my kids an Android tablet last Christmas (none ready for prime time), and now will likely never own an Android product. Getting excited about Windows Phone 7 recently.

Re:What do you mean? It already has.

[egranlund]

How do you you figure that?

The case in point is obviously Apple. They do not do an end-run around the providers as you advocate for. Yet there is no such software on any iPhone.

How do you know?

BS

[Anonymous Coward]

BS

They are All Evil. Except Microsoft.

[Anonymous Coward]

I still remember the rants&shouts until a few years ago, here on ./ too, if a crappily coded dll on any fabulous Windows 98 or XP would ever dare send a single ping to any IP address anywhere in the sphere of interest of Microsoft.

Hordes of people spent entire nights capturing and analyzing each and every bit coming out of their (cabled, then) network interface.

Today everybody calls home or happily violates any far idea of private life still left to connected human beings.

Apple, Google, Facebook: the list can go on forever. Calling home has even become a separate core business for the malware sector. Entire businesses and trillions of dollars rotate around not only a home address (as in the past) but each and every single bit of any private life.
Is that done to improve life (and make it very superficial and foreseeable?) to connect people? Good excuses, but no. It's for the money. Purely and simply for the money. We know you go often to the toilette? Here you go with an ad about our new toilette paper: earning one cent/click a person means huge lots of money.

Only one party hasn't changed policies, compared to years ago. My fingers tremble while I write this: Microsoft.
I trust Microsoft is not betraying my right to privacy.

How low have we gone...

Re:What do you mean? It already has.

[Ossifer]

The old internet way used to be silence, but alas, progress!

It's not in my phone.

[ross.w]

I have a Samsung Galaxy SII with the current Australian firmware. Based on the information at http://forum.xda-developers.com/showpost.php?p=11763089 CIQ is not installed. I don't know if the standard Samsung firmware as supplied is the same, but it's one of the things I like about my carrier, Virgin. Their phones really are. With Optus or Telstra YMMV.

Re:It's not in my phone.

[Anonymous Coward]

Only parts of Android are open source. Other parts, including key infrastructure pieces and the majority of apps people use that ship on the devices are closed.

And open source here is a license that doesn't require Google to disclose the source when shipping, leading to every Android Honeycomb tablet that shipped this year being a closed platform until this week. HDMI adapter

Proved already

[SuperKendall]

Prove it.

Obviously you can't truly prove a negative but...

I've run the phone at home for a few days on end with a proxy recording all traffic, there were no surprises.

There are other people FAR more obsessive though that would have found such software if it existed - either people like you just DYING to prove something bad about Apple, never mind the jailbreaking guys who have been over the iOS libraries with a fine-tooth comb and found nothing also.

Give it up man, it's as close to proved as it is possible to be. You just look like you have a terrible case of sour grapes going on with your silly denial.

Meanwhile in the other corner there's actual software on Android ACTUALLY creating a real security risk.

Re:Proved already

[geminidomino]

Obviously you can't truly prove a negative but...

Read what I said. I addressed that.

You're the one making the claim. The onus is on you.

Give it up man, it's as close to proved as it is possible to be. You just look like you have a terrible case of sour grapes going on with your silly denial.

It's not even close.

Are you not the Greater Idiot here?

[SuperKendall]

Um, I hate to point it out, but what you just said (prove yours before I prove mine) tells me that you can't prove it

Isn't insisting someone prove a negative basically just a round-about way to say you are an idiot?

The person you were responding to was cleverly pointing this out, basically presenting a construct I will call an "Idiot Motel". Idiots such as yourself follow in (rhetorically speaking) but can't back out once they hug the sticky tar-baby of illogic inside.

Re:Are you not the Greater Idiot here?

[Bucky24]

Well it just seems rather childish to me.
"prove it!"
"You prove it first!"
I personally feel that if you say something on a forum like this, if someone says "prove it", you should be able to do so, instead of resorting to mind games.
But that's just me. :)

Endless spying

[Anonymous Coward]

Endless surveillance, yet another violation of our rights. The gov’t constantly violates our rights.
They violate the 1st Amendment by caging protesters and banning books like “America Deceived II”.
They violate the 4th and 5th Amendment by allowing TSA to grope you.
They violate the entire Constitution by starting undeclared wars.
Impeach Obama, support Ron Paul.
Last link of “America Deceived II” before it is completely banned:
http://www.amazon.com/America-Deceived-II-Possession-interrogation/dp/1450257437

Re:What do you mean? It already has.

[Anonymous Coward]

Don't be so sure. From here:
When CarrierIQ was dubbed one of the Fierce 15, they were working with seven of the top ten major OEM’s, as well as Verizon Wireless, AT&T, and Sprint. Currently, Trevor has found CarrierIQ in a number of Sprint phones, including HTC and Samsung Android devices. CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well. CarrierIQ can be seen on your Android handset by installing an app from the Market called AnyCut. From here you will notice IQRD and IQAgent, which are both parts of the CarrierIQ system on the device.

This is why I bought a Nokia N900

[jonwil]

Yes the Nokia N900 has a pile of closed-source packages. But if it WAS running this CarrierIQ crap (which it isn't because its a product direct from Nokia and has never been tainted by any carrier) I could just open up an xterm and type "apt-get remove carrieriq" and get rid of it.

Re:This is why I bought a Nokia N900

[aug24]

I don't think you've understood the principle of a rom-based rootkit.

Cyanogen

[Anonymous Coward]

Just install CyanogenMod...

fork the droid!

[anwyn]

someone needs to figure out how to get a version of debian to run on pads and phones! All the phone stuff could be just be another Linux application. You could even add encryption to encrypt your phone call if both sides were running linux! There should be no app stores. Only repositories! With a true free software, you could be sure no one is pulling this stuff, because the source code would be available for inspection!

Fork the Droid.

Apple!

[hesaigo999ca]

Why I use IPHONE!

Rootkit in RAM

[phorm]

Depends on how you interpret it. Perhaps it's loaded up somewhere hidden and encrypted, and then quickly loads into memory in a hidden ramdisk or something similar without any identifiable files otherwise on the filesystem.

I've been dorked by CarrierIQ

[RobK410]

I've had my pre-release copy of Gingerbread/2.3 on an Epic 4G disabled remotely (over air) by Sprint because of CarrierIQ. Was running a stock leaked copy of 2.3, and after about a week the phone modem would become disabled (forced to always be in airplane mode). I'd have to reflash the modem portion of the ROM to make the phone usable again. After doing this 3 or 4 times I found a ROM where Carrier IQ was removed. I have not had to reflash the phone modem since (same version of leaked ROM and modem btw) This is proof in my mind Sprint uses this rootkit for disabling phones. THANK GOD they've found this garbage software and were able to remove it. My question is, do the "google" Nexus phones have this junk on them out of the box?

Just now an issue?

[Gyorg_Lavode]

I have a Sprint Epic and the dev community for it has been removing CIQ for every release. Why is this just now becoming a public issue?

It's written in FROTH & is less then 30kb

[Anonymous Coward]

As a AnonCoward I can tell you I'd be breaking the NDA if I had a name.

The last project I worked on was a data transfer bridge of between the Hadoop cluster to share information between the code name "Caramel" project (aka Iphone) and AT&T.

The process involves "Tasking" the system to be active or passive during an update an incoming packet across SMS channel 0 (your mobile provide) provides the access commands for tasking...

The under the guise of providing better coverage CarrierIQ has a Dictionary of approximately 200 odd commands to send. The packets record radio signal strength, length of conversations, call's dropped, gps locations, as well as any and all devices.

The incoming collection stream allows the map and reduce to effectively identify your relationships (same car, same cell towers switching at the same time, etc.)

If you stalk one person you are a stalker, if you stalk 100's you are a data aggregation and marketing demographic identifier.

Christmas gifts for girls

[Anonymous Coward]

Monetization is not the goal here, and would likely lead to more headaches/concerns over the management of said money. I think we want to avoid this angle as much as possible Funny christmas gifts. Hence the post referring more towards physical hardware donation/help

cyanogenmod

[Anonymous Coward]

cyanogenmod is free. runs well on my G1. As opposed to what it came with.