Slashdot Mirror
Carrier IQ Software May Be in iOS, Too
New submitter Howard Beale writes with this excerpt from The Verge: "To date, the user tracking controversy surrounding Carrier IQ has focused primarily on Android, but today details are surfacing that the company also may have hooks into Apple's iOS. Well-known iPhone hacker Chpwn tweeted today that versions at least as recent as iPhone OS 3.1.3 contained references to Carrier IQ and later confirmed it's in all versions of iOS, including iOS 5." The details are still emerging; however, iPhone users will be happy to hear that while it's reported that the software is available to the OS, "the good news is that it does not appear to actually send any information so long as a setting called DiagnosticsAllowed is set to off, which is the default."
everything it collects is viewable to the user and you can turn it off in settings > general > about > diagnostics & usage
Is this software specific to various handsets or is it specific to the carrier?
So far it has seemed to me that this guy is using Sprint and thier phones seem to have it. But, people on AT&T are reporting that their phones do not have it.
Does anyone know for sure?
It matters because what the contract allows is ambiguous at best and definitely does not cover all that CarrierIQ is capable of (what it is configured for on a given phone from a given carrier may be a different story). In fact, keystroke logging of text messages may be in violation of federal wiretap laws, particularly if the logging continues even when the phone is not connected to a cellular network.
Does that mean that Apple is complicit in installing Carrier IQ?
Yes. It was potentially something they were told to do by carriers, but Apple has had a habit of telling anyone that went against their worldview to fuck off, so I imagine it at least doesn't conflict with their intents.
"the good news is that it does not appear to actually send any information so long as a setting called DiagnosticsAllowed is set to off, which is the default."
This is supposed to be reassuring? How many people will ever read about this? And how long until it's turned on by default? Or perhaps turned on by a remote message.
I've found it useful as an example for people who don't understand why we need free/open software. This story simply means that if you use your phone to access anything that is protected by a password (or PIN or whatever), that little hidden bit of software is making a copy of your login, password, account numbers, etc., and sending it off to some site that you know nothing about. Whoever has that information can then get into your account and do as they like with it. I've seen a lot of worried looks, and I know a number of people who have held off on the idea of using their phone to access their bank accounts as a result of this information.
I try to get the idea across that, as long as there's any software that's not freely available to us software geeks ("hackers" to the media), so that we can study it and expose such little nasties, nobody's information or accounts or identities can be considered safe. This sort of software can and does send all your private information to some unknown strangers.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
In other news, hackers have discovered that the game, Angry Birds, mysteriously turns on a setting called "DiagnosticsAllowed".
Good news: last time you looked, he was still sitting in the back and hadn't stabbed you yet.
If you were blocking sigs, you wouldn't have to read this.
Here's my "diagnostic log" or at least one of them:
deviceId: "aac0e3b1805c47f85e759c5d............"
isAnonymous: true
deviceConfigId: 101
triggerTime: 1320879763561
triggerId: 72014
profileId: 1012
investigationId: 0
bluetoothServiceDisconnectionResult {
timestamp: 1320879561
deviceOUI: "\00\066="
service: 8
result: 104981
}
seems a bit less intrusive than the one demoed yesterday.
...when they wrote iOS? Weird.
I can understand it being found on Android devices since individual phone companies (who are absolute sh** at making software - personal experience) would want to avoid doing it themselves, but Apple?
Loading...
carriers and handset makers need the ability to monitor their networks for problem cell sites and areas of low to no signal as well diagnostics about the phone and any problem apps.
if you go for tech support it's not like the people magically know everything that is wrong with your phone. the diagnostics data is collected and analyzed. if you complain of dropped calls its important to know where they are occuring
Not only is it off by default, apparently it's only allowed to access information at a layer that doesn't give away the farm. It's not recording your keypresses, the sites you visit (which apparently the HTC version does even if you're on WiFi) or anything else that's possibly a significant security risk. Supposedly, it really does act just as it's claimed to in the press releases.
(I'm aware that I use 'apparently' and 'supposedly'; I have no concrete info that I've tested myself, this is just what I've read today.)
Interestingly, it looks like the "pure" Android phones (i.e the Nexus line) don't ship with CarrierIQ
It is not, however, important for them to have the keystrokes that you enter into your phone before sending encrypted communications. There is NO WAY that this is not a violation of the law if it is not explicitly mentioned in the ToS, as keystroke logging could never be remotely construed as even remotely necessary for system diagnostics; its only purpose is the violation of privacy.
To the haters: You can't win. If you mod me down, I shall become more powerful than you could possibly imagine
The question is, can a government agency or anyone else call up Apple or a carrier and have them remotely activate CarrierIQ on the iPhone?
I don't care if it's "off by default". I care if it's "controlled by the user". There's a clear and concise distinction, and Apple's track record does not lead me to believe that Apple doesn't have absolute control to remotely activate this or any other setting at their discretion. Even if they were unable to before, they may have added that remote capability since they've lost several phones before.
I8-D
Of course, when Apple does it, it must be okay. If other maufacturers do, BURN THEM AT THE STAKE!
DNA -- National Dyslexic Association
When was the last time you got any useful technical support from a cell phone carrier? Those guys play a classic game of passing the buck, blaming your handset (which they didn't make) interference (which they can't control) and anything else that's not the service they provide.
The notion that some Level 42 World of Warcraft Paladin who spends his days providing tech support for a cell carrier:
1) Has access to any useful information that relates directly to your handset,
2) Has the analytical skills to determine its meaning without rolling a 20 sided die
is patently ridiculous. They'd at best have access to your current outstanding balance.
North Americans need to stop buying handsets from manufacturers: start buying unlocked, carrier independent handsets and you'll change the industry. As long as over 90% of us are committing to contracts that are longer than the average length of time your phone lasts, the oligarchy that is the North American cell phone industry can do whatever it wants.
Skot Nelson music is my saviour / i was maimed by rock and roll
At least according to US laws, the content of your communications are still considered private. It's just the destination and time of communication (bookkeeping data) that has no expectation of privacy.
The fact that SMS keystrokes can be recorded is clearly a violation of privacy.
I'm also quite worried about the fact that I have to put the password for my work account into my phone in order to receive my work emails. I expect those to be private as well, especially since the password field is masked with *'s (which definitely implies that the password is private). The fact that some previously unknown company may know my work password is frightening to me.
:(){
Part of the agreement is to allow Apple and the cellular carrier to monitor and be able to diagnose problems. One has zero expectation of privacy anyway with a cell phone, so having software which is present as per a signed contract is to be expected.
Keylogging my username and password for my https or ssh connections is definitely not part of the agreement as I understood it (and a valid contract is a meeting of the minds, not an evil trap full of gotchas), no any other data that I might be typing in to encrypted or even non encrypted sessions. Sure, I admit that the non encrypted sessions might be listened to by someone, but the expectation is that the someone in that scenario is not my phone provider using a tool the installed before I bought it.
We can't buy carrier independent handsets because all of our cellphone networks are incompatible. Sprint phones sometimes work on Verizon, Verizon phones never work on Sprint, neither of them work on GSM, and AT&T and TMobile, the two GSM carriers, have incompatible 3G networks. Don't get me started on "4G" and the half-dozen different things it's been redefined into meaning.
Also, for every carrier except TMo, the monthly price is just as high when you bring your own phone as it is when you take the carrier subsidy.
So, since buying your own phone doesn't make it portable across networks, and costs more money up front and the same amount per month, there's no point. That's why everyone takes the carrier phone and contract; it's not because we're all stupid, it's because it's the most cost effective solution in a shitty market.
I am just going to guess that Android devices that were rooted and run custom ROMs don't have Carrier IQ installed. If that is the case, everyone should bitch and whine about the right to have root access on their devices, and the right to add whatever freaking ROM they want. If the carriers are keylogging their devices, we should be able to disable that feature. If they don't let us do that, we should be able to wipe off their spyware.
A NYC lawyer blogs. http://www.chuangblog.com/
Caught with their pant down? The first thing that pops up when you turn on the iPhone for the first time is a box explaining this and asking if you want to allow it. Thats not exactly hiding it. As someone posted above there is also a very lengthy explanation and the actual log files available on the control panel that allows you to turn it off. Some conspiracy.
Apple is in fact circling the drain now. They`re playing "follow-the-leader" with features on their phones.
Do you have anything other than your own personal opinion to back up your "fact"? AAPL corporate earnings continue to grow, their products continue to sell and expand their market share, they are the #1 or #2 company in the world in terms of market cap and they have a ginormous cash hoard to draw upon for further R&D and expansion.
If you want to see a perfect example of a company that actually IS circling the drain, take a look at RIM.
"follow-the-leader features"? Siri-ously (har har)? Oh look, Google has a Siri-like app now! Leading-the-followers is more accurate...
That's what I was thinking. When this came out yesterday about HTC and RIM people went nuts on this forum about privacy, but when it comes out that Apple is doing it too, well it couldn't possibly be the benevolent apple overlords are doing something inappropriate. Hell, they are going to start touting it as a feature pretty soon.
I got here through a series of tubes
carriers and handset makers need the ability to monitor their networks for problem cell sites and areas of low to no signal
First, handset makers don't have networks or cell sites. Second, why do carriers need to use my device to test their network, they don't have their own equipment to do that? And if my device is transmitting diagnostic data, why the hell are they charging me data fees to send them diagnostics? I should be charging them. The point is that they don't need to use my device to test their network. And if they're going to ask me to do that, they sure as hell better tell me and better give me a way to opt out. Neither of those happened when I bought my phone. iOS took the right path with specifically calling it diagnostic mode, and having it disabled by default. Sprint tries to hide it from me. That's not right.
as well diagnostics about the phone and any problem apps
Again, they don't *need* the ability to do that. It would be *nice* if they had it, and frankly if they asked me I might allow them. But since they try to sneak it in the backdoor now I simply don't trust them and it's finally pushed me to the point where I'm ready to install Cyanogenmod and get rid of their software altogether. So now they get nothing.
if you go for tech support it's not like the people magically know everything that is wrong with your phone.
Yeah, you're right, even with all the data my phone has been sending them they still don't know what's wrong with it. So why should I send the data to them?
if you complain of dropped calls its important to know where they are occuring
A diagnostic application specifically for monitoring dropped calls is completely different than the software that is actually being used. Dropped calls are just one aspect that they try to highlight to claim that the software is benevolent, and then they deny the ability to log keystrokes even when proof is shown that they are.
If the company is lying about what their capabilities are and what data they're collecting, then that's a major red flag. That's enough to get me to remove the software.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Cell phone contracts are loans.
With the principal and interest payment bundled in the monthly bill. The trouble is that Verizon, Sprint, and AT&T don't give a discount on the monthly bill if I buy the phone up front at full price. So why do I still have to pay principal + interest to the carrier for a phone that I already own outright? It'd be like having to pay a car payment to the bank (and not just tags and liability insurance) for a car that I've already paid off.
Wouldn't this same logic apply to an ISP and your computer? Should they be able to install a key logger on your computer to "diagnose" connection issues? Isn't a smart phone a computer with a phone?
Chance favors the prepared mind.
Perfect is the enemy of good.
That's why everyone takes the carrier phone and contract; it's not because we're all stupid, it's because it's the most cost effective solution in a shitty market.
It depends on what you want to do with the phone. If you e.g. use it for tethering, the cost of buying an unlocked international version for full price recoups itself pretty quickly.
Also, it is possible to have 5-band 3G phones that work on both AT&T and T-Mo, so you can at least switch between those two. For example, Galaxy Nexus is 5-band HSPA 850/900/1700/1900/2100 - which covers both AT&T's 1900MHz, and T-Mo's 1700/2100 MHz.
I have D&U turned on on my iPhone 4S. Why? Because I'm a geek and if I can help out some other geeks at Verizon or Apple, so be it. But, guess what? I can see what's transmitted, no rooting required. Here's a typical entry:
deviceid: "xxx"
isAnonymous: true
deviceConfigid: 101
triggerTime: 1322150199352
triggerId: 655363
profileId: 10109
investigationId: 0
locationaUpdateSession {
timestamp: 1322150199351
timestampEnd: 1322150199351
desiredAccuracy: 1000
cellAvailable: true
wifiAvailable: true
passcodeLocked: false
airplaneMode: false
ttff: 0
ttffGps: -1
bundleid: "com.apple.weather"
achievedAccuracy: 99
}
Enjoy your paranoia! I refuse to participate.
If I used a sig over again, would anyone notice?
Car analogy: just because you buy a car on hire-purchase doesn't mean the bank gets to do whatever they want with the car. Even if you don't pay up, there are still certain limitations to what they can do to repossess the car.
And even if you rent a car, the rental agency doesn't get to do whatever they like with the car once you've rented it out.
IANAL but I suspect recording conversations in the car and recording videos of the interior would generally not be legal unless you get permission from the court.
Think about it. CarrierIQ is a front for the NSA.
I hope you didn't post that from your cell phone.
Faster! Faster! Faster would be better!
That's the point I have been mulling over as well ever since this mess came to light. There's only two reasons why this software would log the content of text message/email/search. Either a government agency of some sort requested this feature (or outright demanded it), or the folks behind CarrierIQ built in this ability so that carriers could use this info for their targeted advertising platforms.
If it's the former reason, this fits in line with PATRIOT-Act provisions, and if it's the latter, then quite simply, CarrierIQ broke the law, violating both the Electronic Communications Privacy Act, and the various laws based on wiretapping.
In this first case I mentioned, they still might get into trouble, if those parts of the software were enabled by default, as it was recently decided in some US Circuit Court case that the government is required to obtain a warrant before they may obtain access to such data as this CarrierIQ software provides.
I guess we'll find out once the inevitable lawsuits spring up.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.
As far as I'm concerned, "tethering service" amounts to enabling the appropriate widget on operator-supplied phones where it's otherwise disabled, so I don't need it.
Yes, I know that their contract says something else. I very much doubt that those provisions are meaningfully enforceable in court - any more so that the requirement to, say, only hold the phone in your right hand (and never in the left one!) when making a call through operator's network. Reason being, tethering is something I do to the device, not to the network, and they can't enforce what I do to my device - it's mine. They can legally enforce what goes over their network - i.e. packet content - but that's a different thing, and is not how they define tethering in contract in any case.
Pragmatically, since I use it to tether an Android tablet through an Android phone, good luck catching that.