Slashdot Mirror

← Back to Stories (view on slashdot.org)

CarrierIQ: Most Phones Ship With "Rootkit"

Posted by Unknown on from the your-keystrokes-may-be-monitored-for-qa-purposes dept.

First time accepted submitter Kompressor writes "According to a developer on the XDA forums, TrevE, many Android, Nokia, and BlackBerry smartphones have software called Carrier IQ that allows your carrier full access into your handset, including keylogging, which apps have been run, URLs that have been loaded in the browser, etc." Since this was submitted, a few more details have come to light. The software was designed to give carriers useful feedback on aggregate usage patterns, but the software runs as root and the privacy implications are pretty severe.

20 of 447 comments (clear)

  1. but but but... Apple by Anonymous Coward · · Score: 5, Insightful

    With a walled garden, Apple keeps the carriers out too.

    1. Re:but but but... Apple by CastrTroy · · Score: 5, Interesting

      This is the best thing that the iPhone has done for the cell phone industry. Apple doesn't bow down and let the carrier load whatever crap they want to on the phone. This makes the iPhone a much better experience, because an iPhone from Verizon is exactly the same as an iPhone from AT&T and it exactly the same as an iPhone you purchase directly from Apple. The only difference is that the carrier specific phones have been locked to that provider, but that's acceptable since you're getting the phone at a huge discount. I wish more handset makes, especially the big ones (HTC, Motorola, Nokia) would do the same to offer their customers a much better and more consistent experience.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    2. Re:but but but... Apple by Unoriginal_Nickname · · Score: 5, Funny

      Has anyone?

    3. Re:but but but... Apple by popoutman · · Score: 5, Informative

      EULAs are not contracts. They are a wishlist by the software writers, and such are part of an honour system. They are not legally binding in sane jurisdictions.

      --
      - This sig deliberately left blank. Nothing to see, move along.
    4. Re:but but but... Apple by LordLimecat · · Score: 5, Insightful

      Article is a load of crap, they give no details on how they know its there. They show screenshots of 2 android phones with visible GUIs which show CIQ, and then claim its on iPhone and Blackberry as well. Sorry, Ive dug through all the servicebooks on several blackberries (8250, 9600, 7200) and Ive never seen a CIQ service book.

      And as for this statement...

      According to TrevE, the software is installed as a rootkit software in the RAM of devices where it resides. This software basically is completely hidden from view and in it virtually invisible,

      Someone doesnt understand the volatile nature of RAM, or is terrible at communicating. Rootkits dont reside in RAM, because then they would be removable with a battery removal. As for "completely hidden", why then does he have screenshots of a CIQ GUI where theres a "disable CIQ" checkbox?

      The credibility factor of this story is in the negatives, especially when they really dont explain what their proof is and they have one guy on a forum claiming this-- its not even a researcher with a known real name. Who says this isnt a massive troll?

    5. Re:but but but... Apple by The+Moof · · Score: 5, Insightful

      They are not legally binding in sane jurisdictions.

      That, right there, is the catch. If you're in the US, you're not in a sane jurisdiction. Have you seen some of the egregious things they've been putting in EULAs these days that are actually being held up in court?

    6. Re:but but but... Apple by Drakino · · Score: 5, Informative

      You mean the smartphone location fiasco where it was discovered that *gasp* AGPS caches data on phones, including Android, Blackberry, iPhone and WebOS? Yep. Typical internet echo chamber amplification that turned it into an attack point for fanboys who didn't actually do any research.

      Apple did have one legitimate bug in the situation. The cache was in a folder marked for backup to computers, due to it living in the same location as the settings file to toggle what apps can use location data. This was fixed, and the cache was reduced. I personally preferred the old cache time, since it meant my phone found my location when I wanted it to quicker. But they bowed to the pressure from the echo chamber anyhow.

  2. Re:Doesn't Matter by Anonymous Coward · · Score: 5, Insightful

    In open source, the user can do whatever he or she wants with the software.
    In proprietary software, it's the other way around.

  3. Re:Doesn't Matter by WorBlux · · Score: 5, Insightful

    But many of the drivers and first stage bootloaders aren't

  4. Re:Doesn't Matter by circletimessquare · · Score: 5, Funny

    in soviet software land, software programs you!

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  5. Re:Cyanogen by Pieroxy · · Score: 5, Funny

    Tell that to my Mom. You're in for a rough ride, I'll tell you that much!

    --
    Write boring code, not shiny code!
  6. Re:Cyanogen by gparent · · Score: 5, Funny

    I'm always in for a rough ride with your mom. Oh, you mean to install Cyanogenmod?

  7. Re:So by Rootkit · · Score: 5, Informative

    http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ The bottom of this page has a section about detection including an app to detect hidden UIs.

  8. Re:Doesn't Matter by ByOhTek · · Score: 5, Insightful

    I think the GPs point is that, in this case, the latter can also be true for open source software.

    --
    Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
  9. Re:Really? by Smallpond · · Score: 5, Informative

    " By entering this Agreement, you consent to our data collection, use and sharing practices described in our Privacy Policy available at verizon.com/privacy." -- from Verizon Customer Agreement

    That's why.

  10. Re:2 Questions by SmurfButcher+Bob · · Score: 5, Interesting

    3. If your lawyer has this on his (her) phone, are they in breach of confidence? What about now that they know about CIQ?
    4. If a medical *anything* has this on their phone, is this a HIPAA issue?

    --

    help me i've cloned myself and can't remember which one I am

  11. RMS was right by SigmundFloyd · · Score: 5, Informative

    Stallman doesn't sound so crazy now...

    --
    Knowledge is power; knowledge shared is power lost.
  12. Re:Doesn't Matter by zill · · Score: 5, Insightful

    No, you cannot replace the first stage bootloader and the baseband, so they will forever remain proprietary. There is no way to have a working Android phone without running proprietary code unfortunately.

    You can, however, get Android running without relying on proprietary code. It just won't work as a phone unfortunately.

  13. Re:Doesn't Matter by gauauu · · Score: 5, Informative

    What Marcos said. Android is not "open source". It's "kinda sorta open to downstream proprietors, but not to end users", which is not open source at all.

    Well, it's not "free" according to GPLv3 (android devices can be Tivo'ised preventing you from running modified code), but anyone can download the android source and modify and rebuild it. If your device supports it (many do), you can run your modified code on your device. I'm not sure how you can say Android isn't open source, as that's pretty much the definition of open-source.

    Now you could argue that it's not "free" as defined by RMS and the FSF, and you'd have a decent argument. But claiming it's not open source is just incorrect.

  14. Re:Doesn't Matter by Ossifer · · Score: 5, Interesting

    I disagree. The very real risk (result!) is from the carriers putting crapware/spyware/etc. that you can't remove. I don't fear Google or Apple in this respect. Consider that yesterday it was revealed that Japan's largest carrier doesn't sell the iPhone precisely because Apple won't allow them to install such things.

    Secondly, I don't consider it truly open source, unless I can reasonably make changes, which you can't do with Android phones currently on the market.