Slashdot Mirror
CarrierIQ: Most Phones Ship With "Rootkit"
First time accepted submitter Kompressor writes "According to a developer on the XDA forums, TrevE, many Android, Nokia, and BlackBerry smartphones have software called Carrier IQ that allows your carrier full access into your handset, including keylogging, which apps have been run, URLs that have been loaded in the browser, etc."
Since this was submitted, a few more details have come to light. The software was designed to give carriers useful feedback on aggregate usage patterns, but the software runs as root and the privacy implications are pretty severe.
With a walled garden, Apple keeps the carriers out too.
Nice.
Buy a phone you can root and put CyanogenMod on it. It works great!
In open source, the user can do whatever he or she wants with the software.
In proprietary software, it's the other way around.
But many of the drivers and first stage bootloaders aren't
This is why I'm not buying a "smart" phone until until they release one with a fully open software stack (excluding the little bit of firmware that controls the cellular modem.)
I think the GPs point is that, in this case, the latter can also be true for open source software.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
Absence of evidence != Evidence of absence... Anyone even vaguely familiar with scientific principles (or information security) should know this.
But the point is that an open version is available, and thanks to third party mods like cyanogen if you don't like the version shipped with the phone you can replace it...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I can only speak for my Employer... BlackBerry: 0
It's a very misleading article. Yes it shows that a "root kit" install has appeared on an Android device, but it is clear that the author has no idea about the security restrictions applicable to BB devices. Want to block your Carrier's Application? Simply go to Security Options -> Advanced Security Options -> Certificates. Find your Carrier certs and revoke them. It won't block your phone calls, or data connections, but any app which your carrier has installed to your device with a Service Book will be prevented from running.
Oh, and you can also see exactly what modules are stored on your device under the Options->Applications listings. I seriously doubt you will ever find this stuff in there.
Or maybe his point was that, if Android was really open such things would be easy to fix.
Rethinking email
Jesus, mods, way to fall for a troll. Parent should be (Score:-5, Lying). There is no suggestion in any of the articles on this subject that the iPhone has this software, other than a CarrierIQ job requirement listing iPhone experience as optional...
There is a HUGE difference between knowing who you call or what websites you visit (available from network info) and knowing which apps you're using or monitoring your key strokes. The latter is none of their business, and key logging can allow them to access your passwords. That's completely inappropriate and probably a crime.
make imaginary.friends COUNT=100 VISIBLE=false
I'll tell my grandma to go do that right away! She is always paranoid about her privacy, I'll tell her all she needs to do is get cyanogen and replace her OS!
What Marcos said. Android is not "open source". It's "kinda sorta open to downstream proprietors, but not to end users", which is not open source at all.
I'm one who likes a lot of what Google does, but I'm no blind fanboi. Google dropped the ball when they permitted downstream customers to close their source. And, that's why I'm using a "dumb phone"*, with no plans to upgrade. I'm not about to pay the phone company hundreds of dollars, PLUS an exorbitant contract fee, so that they can spy on me.
* It should be noted that even old "dumb phones" are pretty easy to spy on, albeit to a lesser extent than is exposed in this and other recent articles.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
No, you cannot replace the first stage bootloader and the baseband, so they will forever remain proprietary. There is no way to have a working Android phone without running proprietary code unfortunately.
You can, however, get Android running without relying on proprietary code. It just won't work as a phone unfortunately.
1) Don't buy your phone from a Carrier. I bought my Nexus One from Google. I bought my previous (non-smart) phone from some guy on Ebay.
Only parts of Android are open source. Other parts, including key infrastructure pieces and the majority of apps people use that ship on the devices are closed.
And open source here is a license that doesn't require Google to disclose the source when shipping, leading to every Android Honeycomb tablet that shipped this year being a closed platform until this week.
Google has severely muddied the meaning of open and open source compared to what we are used to from the GPL and Linux worlds.
Never let your hatred of Apple, Microsoft or whoever to cloud your judgement of the companies you do cling to. Google's "open" message is eerily similar to FUD messages Microsoft was spreading in the 90s when it came to Java and "open computing". The quicker we hold these companies accountable, the quicker it improves. Getting stuck in fanboy wars and putting on the blinders helps no one.
There is no spoon.
Kid-proof tablet..
Google dropped the ball when they permitted downstream customers to close their source
And if they hadn't, no manufacturer would have adopted it.
---- Booth was a patriot ----