Slashdot Mirror
Carrier IQ Software May Be in iOS, Too
New submitter Howard Beale writes with this excerpt from The Verge: "To date, the user tracking controversy surrounding Carrier IQ has focused primarily on Android, but today details are surfacing that the company also may have hooks into Apple's iOS. Well-known iPhone hacker Chpwn tweeted today that versions at least as recent as iPhone OS 3.1.3 contained references to Carrier IQ and later confirmed it's in all versions of iOS, including iOS 5." The details are still emerging; however, iPhone users will be happy to hear that while it's reported that the software is available to the OS, "the good news is that it does not appear to actually send any information so long as a setting called DiagnosticsAllowed is set to off, which is the default."
why do people make frivolous useless posts like this, grow up.
Part of the agreement is to allow Apple and the cellular carrier to monitor and be able to diagnose problems. One has zero expectation of privacy anyway with a cell phone, so having software which is present as per a signed contract is to be expected.
everything it collects is viewable to the user and you can turn it off in settings > general > about > diagnostics & usage
Is this software specific to various handsets or is it specific to the carrier?
So far it has seemed to me that this guy is using Sprint and thier phones seem to have it. But, people on AT&T are reporting that their phones do not have it.
Does anyone know for sure?
Aren't we told that Apple's walled garden would prevent non-sanctioned applications from running or even being installed? Does that mean that Apple is complicit in installing Carrier IQ?
It is dangerous to be right when the government is wrong.
-1 goatse
Do not click the link, it is evil.
"the good news is that it does not appear to actually send any information so long as a setting called DiagnosticsAllowed is set to off, which is the default."
This is supposed to be reassuring? How many people will ever read about this? And how long until it's turned on by default? Or perhaps turned on by a remote message.
I've found it useful as an example for people who don't understand why we need free/open software. This story simply means that if you use your phone to access anything that is protected by a password (or PIN or whatever), that little hidden bit of software is making a copy of your login, password, account numbers, etc., and sending it off to some site that you know nothing about. Whoever has that information can then get into your account and do as they like with it. I've seen a lot of worried looks, and I know a number of people who have held off on the idea of using their phone to access their bank accounts as a result of this information.
I try to get the idea across that, as long as there's any software that's not freely available to us software geeks ("hackers" to the media), so that we can study it and expose such little nasties, nobody's information or accounts or identities can be considered safe. This sort of software can and does send all your private information to some unknown strangers.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
In other news, hackers have discovered that the game, Angry Birds, mysteriously turns on a setting called "DiagnosticsAllowed".
Good news: last time you looked, he was still sitting in the back and hadn't stabbed you yet.
If you were blocking sigs, you wouldn't have to read this.
Here's my "diagnostic log" or at least one of them:
deviceId: "aac0e3b1805c47f85e759c5d............"
isAnonymous: true
deviceConfigId: 101
triggerTime: 1320879763561
triggerId: 72014
profileId: 1012
investigationId: 0
bluetoothServiceDisconnectionResult {
timestamp: 1320879561
deviceOUI: "\00\066="
service: 8
result: 104981
}
seems a bit less intrusive than the one demoed yesterday.
...when they wrote iOS? Weird.
I can understand it being found on Android devices since individual phone companies (who are absolute sh** at making software - personal experience) would want to avoid doing it themselves, but Apple?
Loading...
Not only is it off by default, apparently it's only allowed to access information at a layer that doesn't give away the farm. It's not recording your keypresses, the sites you visit (which apparently the HTC version does even if you're on WiFi) or anything else that's possibly a significant security risk. Supposedly, it really does act just as it's claimed to in the press releases.
(I'm aware that I use 'apparently' and 'supposedly'; I have no concrete info that I've tested myself, this is just what I've read today.)
Interestingly, it looks like the "pure" Android phones (i.e the Nexus line) don't ship with CarrierIQ
Unless you have an Android phone, in which case, he's already stabbing you every time you turn a corner.
I for one appreciate that Apple has decided to make sure their "Evil" setting is turned off by default for the time being.
There should be a way to block all the accounts of this troll or to report him to /. editors, apparently he created a thousand of these accounts.
Mexico: 100% conservative's America now!
The question is, can a government agency or anyone else call up Apple or a carrier and have them remotely activate CarrierIQ on the iPhone?
I don't care if it's "off by default". I care if it's "controlled by the user". There's a clear and concise distinction, and Apple's track record does not lead me to believe that Apple doesn't have absolute control to remotely activate this or any other setting at their discretion. Even if they were unable to before, they may have added that remote capability since they've lost several phones before.
I8-D
Now that CarrierIQ is also found on the iPhone (albeit in a harmless version), this is now considered Slashdot news. As long as only Android was affected it was apparently not considered newsworthy.
It is actually required to be integrated for all devices for certain carriers (this includes Data Cards).
Every link to evenweb.com is goatse.
The more you know...
There are two types of people in the world: Those who crave closure
iPhone? Your stuck with the Axe Murderer in a Turtle Neck... that will sue you for copying the way he drives BEFORE he kills you.
Android? With a little looking and forethought, you can replace the "Angry Backstabbing Murderer" with a "cute blonde". You can even tweak the Blonde to have bigger boobs if you want.
On Android... you are only stuck with the "Murderer" if you are too lazy to replace him... or too dumb to know how to get into his mind and convince him otherwise. (Or stupid enough to drive a car with OnStar where you don't control the locks).
Sure... the Blonde might be the sweetest thing since sliced bread... or she might be a gold digger... but you still have to option to replace her or replace parts of her you don't like.
So the carrier can turn it on/off at will? Or worse a criminal or overzealous news reporter pretending to be the carrier?
Democracy isn't practical without privacy, so this is a big deal.
Apple is in fact circling the drain now. They`re playing "follow-the-leader" with features on their phones. Now that Mr.Jobs is gone Apple will slowly go the way it went the last time Mr.Jobs left. Except this time, no amount of coaxing will get Mr.Jobs back. Save this post. Date it. Refer back to it. I`m not kidding. Just wait.You`ll see.
At least according to US laws, the content of your communications are still considered private. It's just the destination and time of communication (bookkeeping data) that has no expectation of privacy.
The fact that SMS keystrokes can be recorded is clearly a violation of privacy.
I'm also quite worried about the fact that I have to put the password for my work account into my phone in order to receive my work emails. I expect those to be private as well, especially since the password field is masked with *'s (which definitely implies that the password is private). The fact that some previously unknown company may know my work password is frightening to me.
:(){
Honest question: When this is turned on do we still get billed for it's usage? Could this be also called bandwidth stealing? If I'm on a 200mb/month plan and this is on how much data is it using of my data plan? I know it will depend upon my usage of texts and websites and so on but do you think it doubles my usage allowed?
Here's a thought... most people who run smart phones do not have the ability to replace portions of the system software that come with their phone. I can see that you look down on such people, but you're an elite technologist so you think that's OK.
Telling people that they can replace parts of the system software they don't approve of is like telling a car owner that he can simply replace the brakes if he feels the standard ones aren't powerful enough. Yes, he can - if he has the knowledge and the equipment. But only a tiny fraction of car owners will have the necessity prerequisites and will care enough to do that. Most will trust the manufacturer to have made the correct choice of brake components.
In the case of Android phones, it appears the right choice is to send user data to carriers without telling anyone or providing an option to turn it off - at least, I can't turn it off on my HTC phone. In the case of Apple phones, the default is not to send data and to make visible the option to send data and also show the user what data is being sent.
But some people still think the Apple methodology is more evil. Mind boggling really.
I'll echo many of the other comments here: It's not really the fact it logs everything. The question is what is it doing with that information.
While I'm not a full-fledged hacker, I know enough about logging and event triggering to know that the computer has to be able to keep track of events so that things that rely on events can be triggered. The best examine is browser events. If there's code to pop-up a window on a click, the browser has to register the click somewhere and the handler has to then pass the buck to function to open the window.
If Carrier IQ proper is collecting this data -- for any reason -- it should be disclosed and it should be able to be turned off. If Android, Apple, et al is using Carrier IQ has an event logger, it should be clear that the information is internal to the phone and is not available to other applications.
Overall, it seems like Android, Apple, et al got caught with their pants down. Assuming the best, they just forgot to mention that this software was a part of their OS.
We don't live in Shouldland.
I am just going to guess that Android devices that were rooted and run custom ROMs don't have Carrier IQ installed. If that is the case, everyone should bitch and whine about the right to have root access on their devices, and the right to add whatever freaking ROM they want. If the carriers are keylogging their devices, we should be able to disable that feature. If they don't let us do that, we should be able to wipe off their spyware.
A NYC lawyer blogs. http://www.chuangblog.com/
What if you decided to become one later? We've got our eyes on you.
Denying it just makes you look more guilty.
So, let me get this straight. Someone who can replace the brakes on their own car is an "elite mechanicist"? I know plenty of hillbillies who can upgrade their braking system. There's nothing elite about them, they just know how to work on cars. Just like there's nothing elite about those of us who can modify our system software on our handheld computers (telephones), we just know how to work on computers.
Anyone can learn to change brakes on a car, anyone can learn how to change (software) parts on a phone. Just for some reason, most people think that the "magic box" needs "magic people" to work on it. That's why people don't try to learn how to do these things, there's this perception that it's just *so* complicated that any mere mortal cannot possibly know how it works.
Example, I got my first car in 1996. It was a 1984 Buick POS. At this time, I had no idea how cars worked. It was constantly breaking down because I drove it like I stole it. A couple friends of mine were pretty competent at mechanical repairs, so we started diagnosing and repairing our cars (which were also early 80's POS's) together, and now, 15 years later, I feel pretty confident I can complete most basic/intermediate auto repairs myself, if I needed to. Granted, being around people who knew about them helped, but they themselves were self-taught for the most part.
At the same time as I became friends with some car guys, they also became friends with me and some tech guys. Now, those guys are pretty competent at (at least the basics) of technology and how it works. My friends and I were self taught at computers. So between the (say 6) of us, I don't think there isn't a mechanical or technological thing we couldn't do, if we needed to. Nothing elite, nothing special, just regular people who want to know how the things we use every day work.
I know what everyone will say next: people have busy lives and most could care less about how a cell phone, computer, car, electricity, or the like operates. I get that, but at the same time, if they *really* care about if their phone is spying them, or their brakes are substandard, or whatever, they can either buy a new device/car, pay someone to modify the system software/brakes, or learn how to modify the system software/brakes themselves. (With Apple, you have no such option, btw.)
What's so hard to understand about that?
There appears to be more privacy issues beyond monitoring in the phone. My Smartphone (GT-I9100 v.2.3.4) won't allow access to https://www.google.com./ It also doesn't allow the addition of private certificate authorities or the removal of bad ones. To make matters worse, it won't display the fingerprint of a certificate. So the only option is to accept, on faith, the issuer name displayed. It seems obvious that the handset makers don't care about privacy or potential harm to customers.
What's so hard to understand about that?
Well...
I know what everyone will say next: people have busy lives and most could care less about how a cell phone, computer, car, electricity, or the like operates. I get that, but at the same time, if they *really* care about if their phone is spying them, or their brakes are substandard, or whatever, they can either buy a new device/car, pay someone to modify the system software/brakes, or learn how to modify the system software/brakes themselves. (With Apple, you have no such option, btw.)
And learn how to take DNA samples and review everything they eat. And learn how to apply anesthetic as well as open themselves up again to check that their surgeon did what he was supposed to. And so on and so forth.
Just because a layman can gain enough knowledge to 'review' the work of experts, does not mean that anyone should have to do this . The very idea is completely fucking absurd.
Download unrevoked one click root.
Download Rommanager and tell it to do it's thing.
Yes that's more complicated than turning off menus within iPhone, but it's not so complicated that a non-technical person couldn't do it if they had the instructions in front of them.
The U.S. laws on data collection provide protection. It's a federal offense, and has been for many years:
http://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act
That doesn't help if the carrier chooses to ignore the law.
Cell phone contracts are loans.
With the principal and interest payment bundled in the monthly bill. The trouble is that Verizon, Sprint, and AT&T don't give a discount on the monthly bill if I buy the phone up front at full price. So why do I still have to pay principal + interest to the carrier for a phone that I already own outright? It'd be like having to pay a car payment to the bank (and not just tags and liability insurance) for a car that I've already paid off.
I was just about to give such a reply, but you beat me to it, and yours is even better than mine would have been.
My mom doesn't have to know how to root her phone and load CyanogenMod. But it does create a market for a business which can do these things for people who lack the necessary expertise.
:(){
Yes, this outdated and rarely enforced law will surely be used to protect us by the government, who completely respects citizen privacy and stand up against corporate abuse...
</sarcasm>
I have D&U turned on on my iPhone 4S. Why? Because I'm a geek and if I can help out some other geeks at Verizon or Apple, so be it. But, guess what? I can see what's transmitted, no rooting required. Here's a typical entry:
deviceid: "xxx"
isAnonymous: true
deviceConfigid: 101
triggerTime: 1322150199352
triggerId: 655363
profileId: 10109
investigationId: 0
locationaUpdateSession {
timestamp: 1322150199351
timestampEnd: 1322150199351
desiredAccuracy: 1000
cellAvailable: true
wifiAvailable: true
passcodeLocked: false
airplaneMode: false
ttff: 0
ttffGps: -1
bundleid: "com.apple.weather"
achievedAccuracy: 99
}
Enjoy your paranoia! I refuse to participate.
If I used a sig over again, would anyone notice?
They'll respect it more if the voters appear to care about it.
They keep getting reelected despite doing all that crap. So it's not important enough.
Now better known by their working acronym of NSA.
iTunes and I guess other stuff does enough tracking for them.
http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html
I agree, it's completely fucking absurd. But, unfortunately, we can't rely on anyone but ourselves these days, let alone bought-and-paid for "experts" who work for the companies we are supposed to "trust". Heh.
Thus the reason you should be buying unlocked phones. I have been saying this for years. They aren't loaded up with a bunch of crap that you don't need/want.
That's the point I have been mulling over as well ever since this mess came to light. There's only two reasons why this software would log the content of text message/email/search. Either a government agency of some sort requested this feature (or outright demanded it), or the folks behind CarrierIQ built in this ability so that carriers could use this info for their targeted advertising platforms.
If it's the former reason, this fits in line with PATRIOT-Act provisions, and if it's the latter, then quite simply, CarrierIQ broke the law, violating both the Electronic Communications Privacy Act, and the various laws based on wiretapping.
In this first case I mentioned, they still might get into trouble, if those parts of the software were enabled by default, as it was recently decided in some US Circuit Court case that the government is required to obtain a warrant before they may obtain access to such data as this CarrierIQ software provides.
I guess we'll find out once the inevitable lawsuits spring up.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.
Android? With a little looking and forethought, you can replace the "Angry Backstabbing Murderer" with a "cute blonde". You can even tweak the Blonde to have bigger boobs if you want.
I wish those were real settings you could tweak on an Android device.
All the world's a CPU, and all the men and women merely AI agents
With Apple's history of tracking, that statement is laughable. Google sought user permissions before collecting data.
But CarrierIQ is not a part of Android, it's not a function installed by HTC, it's a function installed by US carriers (yet to find it on an Australian phone). But remember that if this had not had been discovered on Android, it would never have been discovered on IOS.
You still think that code is the answer, but it isn't. Dennis Richie demonstrated long ago how even access to the full source doesn't make you safe.
Here you're using a logical fallacy. You're treating "safe" as a binary concept, implying if you're not 100% safe, you are 100% unsafe. This is not the case.
Having access to the code does not guarantee security nor provide absolute security, but it does give you greater security by being able to interrogate the code and find out what it's doing. With Closed Soruce, you're taking the manufacturers word that they aren't doing anything untoward and this is it. You get the same gaurantee with Open Source, but with Open Source you also get to see the code for yourself.
Fixed that for you.
CarrierIQ has been around for years before Android or IOS (company started in 2005) and their software is borderline illegal already in the US, it's well and truly illegal in other jurisdictions. It's pretty obvious already that the carriers using CarrierIQ dont care about nor fear the law in this regard. If new laws were introduced, they would still be as infective and closed source would make it easier for them to hide what is actually being recorded. In addition to this, a court case will take years and in the end, they'll get a slap on the wrist and keep doing because it's more profitable and class actions aren't that costly.
Further more, US carriers are more effective at influencing lawmakers then US citizens. Any further laws would only serve to help the telco's collecting information.
Calling someone a "hater" only means you can not rationally rebut their argument.
It's kinda nice to be at the beginning of such a huge mess.. and know it while it plays out.. The carrier IQ storm is , i think gonna be just *huge*.. this is the lull before the proverbial s* hits the fans.. IMHO
Actually, I felt betrayed when I found out that Apple has this installed. But ummm, predominantly Android phones were being sold by asshole carriers with a rootkit installed and enabled - actively sending keystrokes and personal data. The same rootkit is on iOS but it's disabled by default. Why would Apple need to sell this as a feature? It IS a feature. At least it's not enabled by default.
I think you're just a little too emotionally invested in your hatred of Apple. Why waste your time? Besides being guaranteed to be modded up, I mean.
I have a theory that the truth is never told during the nine-to-five hours. - Hunter S. Thompson
The only plausible explanation for Carrier IQ is a government mandate to the carriers to install wiretapping capabilities. Which makes it ironic that a class-action lawsuit is proceeding which will probably eventually bring in the FCC too, i.e. the very government that put Carrier IQ in place in the first place.
Can they Deny this too??
Carrier IQ's own marketing claims undercut its defense
http://www.pcadvisor.co.uk/news/mobile-phone/3322625/carrier-iqs-own-marketing-claims-undercut-its-defense/
Agreed but it seems to me that the EU is more serious about consumer protection than the US, perhaps from being less controlled by corporations.
I'm American but living in the EU so I have a bit of both perspectives, if no hard data to hand to back up my feeling on this...
blindly antisocialist = antisocial