Slashdot Mirror

← Back to Stories (view on slashdot.org)

CarrierIQ: Most Phones Ship With "Rootkit"

Posted by Unknown on from the your-keystrokes-may-be-monitored-for-qa-purposes dept.

First time accepted submitter Kompressor writes "According to a developer on the XDA forums, TrevE, many Android, Nokia, and BlackBerry smartphones have software called Carrier IQ that allows your carrier full access into your handset, including keylogging, which apps have been run, URLs that have been loaded in the browser, etc." Since this was submitted, a few more details have come to light. The software was designed to give carriers useful feedback on aggregate usage patterns, but the software runs as root and the privacy implications are pretty severe.

55 of 447 comments (clear)

  1. Doesn't Matter by Anonymous Coward · · Score: 4, Funny

    It doesn't matter because Android is open.

    That's all that matters.

    1. Re:Doesn't Matter by Anonymous Coward · · Score: 5, Insightful

      In open source, the user can do whatever he or she wants with the software.
      In proprietary software, it's the other way around.

    2. Re:Doesn't Matter by WorBlux · · Score: 5, Insightful

      But many of the drivers and first stage bootloaders aren't

    3. Re:Doesn't Matter by circletimessquare · · Score: 5, Funny

      in soviet software land, software programs you!

      --
      intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
    4. Re:Doesn't Matter by ByOhTek · · Score: 5, Insightful

      I think the GPs point is that, in this case, the latter can also be true for open source software.

      --
      Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
    5. Re:Doesn't Matter by Bert64 · · Score: 3, Insightful

      But the point is that an open version is available, and thanks to third party mods like cyanogen if you don't like the version shipped with the phone you can replace it...

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    6. Re:Doesn't Matter by marcosdumay · · Score: 4, Insightful

      Or maybe his point was that, if Android was really open such things would be easy to fix.

      --
      Rethinking email
    7. Re:Doesn't Matter by Runaway1956 · · Score: 4, Insightful

      What Marcos said. Android is not "open source". It's "kinda sorta open to downstream proprietors, but not to end users", which is not open source at all.

      I'm one who likes a lot of what Google does, but I'm no blind fanboi. Google dropped the ball when they permitted downstream customers to close their source. And, that's why I'm using a "dumb phone"*, with no plans to upgrade. I'm not about to pay the phone company hundreds of dollars, PLUS an exorbitant contract fee, so that they can spy on me.

      * It should be noted that even old "dumb phones" are pretty easy to spy on, albeit to a lesser extent than is exposed in this and other recent articles.

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    8. Re:Doesn't Matter by zill · · Score: 5, Insightful

      No, you cannot replace the first stage bootloader and the baseband, so they will forever remain proprietary. There is no way to have a working Android phone without running proprietary code unfortunately.

      You can, however, get Android running without relying on proprietary code. It just won't work as a phone unfortunately.

    9. Re:Doesn't Matter by gauauu · · Score: 5, Informative

      What Marcos said. Android is not "open source". It's "kinda sorta open to downstream proprietors, but not to end users", which is not open source at all.

      Well, it's not "free" according to GPLv3 (android devices can be Tivo'ised preventing you from running modified code), but anyone can download the android source and modify and rebuild it. If your device supports it (many do), you can run your modified code on your device. I'm not sure how you can say Android isn't open source, as that's pretty much the definition of open-source.

      Now you could argue that it's not "free" as defined by RMS and the FSF, and you'd have a decent argument. But claiming it's not open source is just incorrect.

    10. Re:Doesn't Matter by Ossifer · · Score: 5, Interesting

      I disagree. The very real risk (result!) is from the carriers putting crapware/spyware/etc. that you can't remove. I don't fear Google or Apple in this respect. Consider that yesterday it was revealed that Japan's largest carrier doesn't sell the iPhone precisely because Apple won't allow them to install such things.

      Secondly, I don't consider it truly open source, unless I can reasonably make changes, which you can't do with Android phones currently on the market.

    11. Re:Doesn't Matter by Drakino · · Score: 4, Insightful

      Only parts of Android are open source. Other parts, including key infrastructure pieces and the majority of apps people use that ship on the devices are closed.

      And open source here is a license that doesn't require Google to disclose the source when shipping, leading to every Android Honeycomb tablet that shipped this year being a closed platform until this week.

      Google has severely muddied the meaning of open and open source compared to what we are used to from the GPL and Linux worlds.

      Never let your hatred of Apple, Microsoft or whoever to cloud your judgement of the companies you do cling to. Google's "open" message is eerily similar to FUD messages Microsoft was spreading in the 90s when it came to Java and "open computing". The quicker we hold these companies accountable, the quicker it improves. Getting stuck in fanboy wars and putting on the blinders helps no one.

    12. Re:Doesn't Matter by lindi · · Score: 3, Informative

      cyanogenmod claims to have 745,259 users currently. I am not sure if it is completely free or not but clearly more than 10000 users are using unofficial and modified version.

    13. Re:Doesn't Matter by adolf · · Score: 4, Insightful

      There is no spoon.

      --
      Kid-proof tablet..
    14. Re:Doesn't Matter by farble1670 · · Score: 3, Informative

      Why should I drop it?

      because it's not a valid grievance. google didn't sign some binding agreement with the users of the world to make all android open source, all the time, immediately. compared to apple or msft they are freaking saints (w/ regard to OSS), but it's never good enough huh? can't you be just as little positive about the fact that a company is pouring millions of dollars of resources into a platform and then just giving it away? of course not, because they aren't going about it on your time table.

      OSS is *expensive* for a company. it's not just throwing it over the fence. they have to manage the community, manage contributions, keep the code clean and clear and keep everything perfectly documented for moron consumption. it's much, much more expensive for a company to open source their code than to just keep it internal.

      there are good reason why they didn't release 3.0. for one, there were in the middle of restructuring the source code merging the 2.x and 3.x branches. releasing the code in this state would have been confusing to users, but mainly, cause them more work and resources in the long run. that's their prerogative- they are a public company that reserves the right to make make financial decisions.

    15. Re:Doesn't Matter by nurb432 · · Score: 3, Insightful

      Google dropped the ball when they permitted downstream customers to close their source

      And if they hadn't, no manufacturer would have adopted it.

      --
      ---- Booth was a patriot ----
    16. Re:Doesn't Matter by sveinungkv · · Score: 3, Informative

      The newest version of the GPL, version 3, forbids it. GPLv2, the license of the Linux kernel, may allow it. Android is mostly Apache 2.0.

      --
      Spelling/grammar nazis welcome (English is not my first language and I am trying to improve my spelling/grammar)
    17. Re:Doesn't Matter by nevermore94 · · Score: 4, Interesting

      You are right. It doesn't matter. I am not a tinfoil hat wearer because I am a Computer Systems Engineer and Network Administrator and I know how much data they can gather from you if they want to and have pretty much just stopped caring. They don't need any special app hidden on your phone to spy on you. They could record every single URL that you visit from their server end. Unless you are taking some extraordinary measures on your phone like running through proxies (which can then log everything you do themselves) or Tor they can already track all of your online activity. Does this make something like CIQ right, hell no, and I have already verified that my Android phone doesn't contain it. But, it also doesn't mean that I have any allusions that every URL I visit isn't being recorded somewhere. I just don't care because I don't do anything on my phone that I wouldn't want the world to know about anyway. That is why burner phones were invented ;-)

      PS, if you want an interesting look into which Android apps are tracking you when you use them, check out the app:
      Addons Detector

      --
      Nevermore.
  2. but but but... Apple by Anonymous Coward · · Score: 5, Insightful

    With a walled garden, Apple keeps the carriers out too.

    1. Re:but but but... Apple by Pieroxy · · Score: 3, Insightful

      With a walled garden, Apple keeps the carriers out too.

      Yes, walled gardens have pros and cons. This is definitely a pro in my book.

      --
      Write boring code, not shiny code!
    2. Re:but but but... Apple by CastrTroy · · Score: 5, Interesting

      This is the best thing that the iPhone has done for the cell phone industry. Apple doesn't bow down and let the carrier load whatever crap they want to on the phone. This makes the iPhone a much better experience, because an iPhone from Verizon is exactly the same as an iPhone from AT&T and it exactly the same as an iPhone you purchase directly from Apple. The only difference is that the carrier specific phones have been locked to that provider, but that's acceptable since you're getting the phone at a huge discount. I wish more handset makes, especially the big ones (HTC, Motorola, Nokia) would do the same to offer their customers a much better and more consistent experience.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    3. Re:but but but... Apple by sribe · · Score: 4, Insightful

      ...but that's acceptable since you're getting the phone at a huge discount.

      I don't even believe that. As long as you continue to pay your contract, you should be able to unlock the phone.

    4. Re:but but but... Apple by Unoriginal_Nickname · · Score: 5, Funny

      Has anyone?

    5. Re:but but but... Apple by strech · · Score: 3, Informative

      And you're sure of this why?
      And from geek.com (http://www.geek.com/articles/mobile/how-much-of-your-phone-is-yours-20111115/):

      Currently, Trevor has found CarrierIQ in a number of Sprint phones, including HTC and Samsung Android devices. CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well.

      This may just be a terribly worded sentence and CarrierIQ isn't on the iPhone (and I can't find any other cites), but even if this specific software isn't there, that doesn't mean other software that does the same thing under the excuse of "improving the network" isn't. Further, "Apple doesn't engage in abuse <x>" is a bullshit excuse for other problems.

    6. Re:but but but... Apple by sootman · · Score: 4, Informative

      You don't even need to go as far as the EULA -- iOS 5 actually asks you during setup if you want to allow usage data to be sent.
      http://www.thewwwblog.com/wp-content/uploads/2011/10/ipad-ios-5-diagnostics-7.jpg
      (From http://www.thewwwblog.com/apple-ios-5-setup-steps-apple-ipad.html )

      --
      Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
    7. Re:but but but... Apple by popoutman · · Score: 5, Informative

      EULAs are not contracts. They are a wishlist by the software writers, and such are part of an honour system. They are not legally binding in sane jurisdictions.

      --
      - This sig deliberately left blank. Nothing to see, move along.
    8. Re:but but but... Apple by Anonymous Coward · · Score: 3, Informative

      The iPhone isn't even mentioned (like not at all) in any of the linked articles, so I don't know where you're imagining you read this.

      Also, the word you're looking for is spelled "speech".

    9. Re:but but but... Apple by hawguy · · Score: 3, Insightful

      Care to explain how it doesn't keep the carriers out of the phone? Last I checked, and yes employing traffic monitoring is standard on my network, there was no remote access nor capabilities to do so.

      How did you check when you have no access to the IOS source code and no idea what it's really doing? Would you really know it if AT&T had some code buried in the kernel that sends your tracking data in some GSM control messages that aren't accessible in user-land on the phone? Making a phone work with a new carrier is more than just slapping a new radio in it -- there's software involved as well.

    10. Re:but but but... Apple by LoverOfJoy · · Score: 3, Informative

      CarrierIQ is confirmed to be found on the iPhone

      Not directly in the article but in the links within the article.

      Here's the direct link: http://www.geek.com/articles/mobile/how-much-of-your-phone-is-yours-20111115/

    11. Re:but but but... Apple by LordLimecat · · Score: 5, Insightful

      Article is a load of crap, they give no details on how they know its there. They show screenshots of 2 android phones with visible GUIs which show CIQ, and then claim its on iPhone and Blackberry as well. Sorry, Ive dug through all the servicebooks on several blackberries (8250, 9600, 7200) and Ive never seen a CIQ service book.

      And as for this statement...

      According to TrevE, the software is installed as a rootkit software in the RAM of devices where it resides. This software basically is completely hidden from view and in it virtually invisible,

      Someone doesnt understand the volatile nature of RAM, or is terrible at communicating. Rootkits dont reside in RAM, because then they would be removable with a battery removal. As for "completely hidden", why then does he have screenshots of a CIQ GUI where theres a "disable CIQ" checkbox?

      The credibility factor of this story is in the negatives, especially when they really dont explain what their proof is and they have one guy on a forum claiming this-- its not even a researcher with a known real name. Who says this isnt a massive troll?

    12. Re:but but but... Apple by kiwimate · · Score: 3, Insightful

      Disclaimer: I don't know what Baloroth's opinions in general are, so this isn't necessarily aimed at you. And I hope this doesn't sound too snide.

      That said, this is where I see a double standard in Slashdot from time to time. Go back to stories about broadcasting SSIDs and setting up computers and so forth. Most Slashdotters tend to say it is on the part of the consumer to understand, read manuals, etc. Setting up encryption, for example - the prevailing opinion on here is that that that is just part of the modern world in which we live, and if consumers can't be bothered to read and understand, then they get what they deserve.

      I think that's a pretty cavalier and smug attitude. Beyond that, however, if the same attitude doesn't work both ways, then I'm not terribly sympathetic. I don't understand all the legalese when I sign a mortgage, say...so I make sure I ask someone. And if I don't understand, I don't sign until I do. (And it's been pretty amazing. Example a - watching the glib sales girl who breezily said "read everything, take your time" and then got visibly cooler in her attitude when I proceeded to do just that. Example b - the Wells Fargo reps who responded "umm, we don't know" when I asked them what a particular phrase in their mortgage paperwork meant, and didn't think it was a problem to say "but it's standard language, so it's okay to sign anyway".)

    13. Re:but but but... Apple by The+Moof · · Score: 5, Insightful

      They are not legally binding in sane jurisdictions.

      That, right there, is the catch. If you're in the US, you're not in a sane jurisdiction. Have you seen some of the egregious things they've been putting in EULAs these days that are actually being held up in court?

    14. Re:but but but... Apple by BitZtream · · Score: 3, Informative

      iOS is mostly closed and analysis tools can't be installed without jailbreaking, how do we know what's going on in there?

      Uhm ... Its been jailbroken so we can just look, just like you would on a rooted android device?

      Besides, does nobody remember the iPhone location privacy fiasco?

      No, cause there wasn't one. It wasn't anything even slightly malicious. The only person with direct access to it was the phone owner and the person with unencrypted backups of the phone, which was also likely the owner. I'm pretty sure the owner knew where the phone was anyway, which makes the whole thing a nonpoint.

      It's just idiots like you who keep pretending it was some big deal because your to ignorant to realize it wasn't a threat.

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
    15. Re:but but but... Apple by Drakino · · Score: 5, Informative

      You mean the smartphone location fiasco where it was discovered that *gasp* AGPS caches data on phones, including Android, Blackberry, iPhone and WebOS? Yep. Typical internet echo chamber amplification that turned it into an attack point for fanboys who didn't actually do any research.

      Apple did have one legitimate bug in the situation. The cache was in a folder marked for backup to computers, due to it living in the same location as the settings file to toggle what apps can use location data. This was fixed, and the cache was reduced. I personally preferred the old cache time, since it meant my phone found my location when I wanted it to quicker. But they bowed to the pressure from the echo chamber anyhow.

  3. Cyanogen by Tsingi · · Score: 4, Insightful

    Nice.

    Buy a phone you can root and put CyanogenMod on it. It works great!

    1. Re:Cyanogen by Pieroxy · · Score: 5, Funny

      Tell that to my Mom. You're in for a rough ride, I'll tell you that much!

      --
      Write boring code, not shiny code!
    2. Re:Cyanogen by gparent · · Score: 5, Funny

      I'm always in for a rough ride with your mom. Oh, you mean to install Cyanogenmod?

    3. Re:Cyanogen by dkleinsc · · Score: 4, Funny

      Plus, as any Aussie can tell you, rooting a phone is more than little bit kinky.

      --
      I am officially gone from /. Long live http://www.soylentnews.com/
    4. Re:Cyanogen by oakgrove · · Score: 4, Informative

      I put Cyanogen on my Samsung Vibrant. It has "removed carrier iq" in the release notes.

      --
      The soylentnews experiment has been a dismal failure.
  4. Re:So by Rootkit · · Score: 5, Informative

    http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ The bottom of this page has a section about detection including an app to detect hidden UIs.

  5. Re:Really? by MightyMartian · · Score: 3, Interesting

    I'm unclear here. Why isn't senior management and the board being hauled into court, forced to pay bail of a million bucks and the FBI seizing every single document within the United States? I mean, every time some fucking dipshit downloads a copy of some piece of Hollywood excrement, Congress and the courts are bending over backwards to punish the evildoer, but when major companies start throwing rootkit spyware on their phones, it's like "oh well."

    If I was in charge, those companies would be facing destructive fines (hundreds of millions of dollars), senior management and the board would be cooling it in prison cells and facing stripping of every single asset they own and years of jail time ahead of them. I would make those fuckers so terrified that they'd wake up three times every night of the rest of their lives fearing that some marketing fuck had put something like that on the phones they're selling.

    --
    The world's burning. Moped Jesus spotted on I50. Details at 11.
  6. some legitimate technical questions by nimbius · · Score: 4, Interesting

    that should get asked about the article
    does cyanogenmod mitigate this threat? if not how about whispercore? could whisper systems in the future detect and correct this
    rootkit?
    can rootkit detection systems presently available in linux detect and successfully help a hacker to remove the rootkit?

    --
    Good people go to bed earlier.
    1. Re:some legitimate technical questions by Andy+Dodd · · Score: 3, Interesting

      Cyanogenmod does not have CIQ in the first place.

      It is also possible, with a LOT of work, to remove CIQ's hooks from the system using baksmali/smali (basically, a disassembler/assembler for Java).

      Unfortunately, the developers on XDA who put forth NoCIQ mods seem to be considering this their "special sauce" to set themselves apart and get some donations - when asked where to look for hooks on a device they don't support, you get nothing but silence. No guides, even high-level ones oriented towards developers.

      --
      retrorocket.o not found, launch anyway?
  7. Re:Really? by Smallpond · · Score: 5, Informative

    " By entering this Agreement, you consent to our data collection, use and sharing practices described in our Privacy Policy available at verizon.com/privacy." -- from Verizon Customer Agreement

    That's why.

  8. Samsung Vibrant by oakgrove · · Score: 4, Informative

    When I rooted my Vibrant and stripped out CIQ, the performance went through the roof. Logging every single thing a user does takes a toll apparently.

    --
    The soylentnews experiment has been a dismal failure.
    1. Re:Samsung Vibrant by gstoddart · · Score: 4, Interesting

      When I rooted my Vibrant and stripped out CIQ, the performance went through the roof. Logging every single thing a user does takes a toll apparently.

      And, I'm betting it's the users paying for the data plan usage that sends this stuff.

      So, you're paying extra to be snooped on. I highly doubt they exclude this data from what they charge you.

      --
      Lost at C:>. Found at C.
  9. 2 Questions by JustNiz · · Score: 4, Interesting

    1) How can you authoritatively determine the android phone you are about to buy doesn't have Carrier IQ installed, BEFORE you buy it?

    2) If you already have an android phone, (how) can you check for and uninstall Carrier IQ?

    1. Re:2 Questions by SmurfButcher+Bob · · Score: 5, Interesting

      3. If your lawyer has this on his (her) phone, are they in breach of confidence? What about now that they know about CIQ?
      4. If a medical *anything* has this on their phone, is this a HIPAA issue?

      --

      help me i've cloned myself and can't remember which one I am

    2. Re:2 Questions by compro01 · · Score: 4, Informative

      1. Ask around basically.

      2. a guy on xdadevs whomped up an app to detect (requires root) and remove (requires root and 99 cent donation) CIQ, among other things. http://forum.xda-developers.com/showpost.php?p=17612559&postcount=109

      --
      upon the advice of my lawyer, i have no sig at this time
  10. Re:list? by Anonymous Coward · · Score: 4, Insightful

    I can only speak for my Employer... BlackBerry: 0
    It's a very misleading article. Yes it shows that a "root kit" install has appeared on an Android device, but it is clear that the author has no idea about the security restrictions applicable to BB devices. Want to block your Carrier's Application? Simply go to Security Options -> Advanced Security Options -> Certificates. Find your Carrier certs and revoke them. It won't block your phone calls, or data connections, but any app which your carrier has installed to your device with a Service Book will be prevented from running.
    Oh, and you can also see exactly what modules are stored on your device under the Options->Applications listings. I seriously doubt you will ever find this stuff in there.

  11. A troll, by any other name would smell as awful... by jeffmeden · · Score: 3, Insightful

    Jesus, mods, way to fall for a troll. Parent should be (Score:-5, Lying). There is no suggestion in any of the articles on this subject that the iPhone has this software, other than a CarrierIQ job requirement listing iPhone experience as optional...

  12. RMS was right by SigmundFloyd · · Score: 5, Informative

    Stallman doesn't sound so crazy now...

    --
    Knowledge is power; knowledge shared is power lost.
  13. Re:Really? by gstrickler · · Score: 3, Insightful

    There is a HUGE difference between knowing who you call or what websites you visit (available from network info) and knowing which apps you're using or monitoring your key strokes. The latter is none of their business, and key logging can allow them to access your passwords. That's completely inappropriate and probably a crime.

    --
    make imaginary.friends COUNT=100 VISIBLE=false
  14. Re:A troll, by any other name would smell as awful by jeffmeden · · Score: 3, Informative

    "CarrierIQ is confirmed to be found on the iPhone or on feature phones, but Trevor has found RIM’s Blackberry handsets and several Nokia devices with CarrierIQ on board as well." This would be so poorly worded otherwise, that it is hard to believe that the author didn't simply mean to write "not confirmed". That, and all of the articles by Trevor (and those in the scene) make NO mention at all about the iPhone.

  15. It's not in my phone. by ross.w · · Score: 3, Informative

    I have a Samsung Galaxy SII with the current Australian firmware. Based on the information at http://forum.xda-developers.com/showpost.php?p=11763089 CIQ is not installed. I don't know if the standard Samsung firmware as supplied is the same, but it's one of the things I like about my carrier, Virgin. Their phones really are. With Optus or Telstra YMMV.

    --
    If my call is important, why am I talking to a recording?