Slashdot Mirror
Carrier IQ Responds To FBI Drama, EFF Wants More Information
New submitter realized writes "Yesterday Carrier IQ released a report (PDF) which tries to answer some questions about how their system operates. Also, after reports of the FBI using Carrier IQ data, the company responded by saying, 'Carrier IQ has never provided any data to the FBI. If approached by a law enforcement agency, we would refer them to the network operators.' Additionally, the EFF just released a report which says they believe keystroke data 'is in fact being inadvertently transmitted to some third parties,' but they would like to study carrier profiles to verify information."
Reader Trailrunner7 adds that Carrier IQ's report indicates "under some limited circumstances its software will log the contents of SMS messages sent to a user's phone, but that that the contents of those messages would not be human readable. Instead, they would be in an encoded form that could not be decoded without special software and the carriers don't have access to the contents of the messages either. The company said it has worked on a fix for the bug, which affected devices running the embedded version of the Carrier IQ agent."
I've got the iPhone, how do I crib smother this Carrier IQ parasite?
http://en.wikipedia.org/wiki/COINTELPRO
http://en.wikipedia.org/wiki/Citizens'_Commission_to_Investigate_the_FBI
I suspect COINTELPRO has been updated and perfected by now.
Why do they feel the need to include shit like this? God damn it I hate big corporations.
The fix is to not install spyware on the phones in the first place. How hard is this to understand?
Instead, they would be in an encoded form that could not be decoded without special software and the carriers don't have access to the contents of the messages either.
Yeah, first they say they don't sniff your traffic, then they say this, then that, then they pull the "not without our secret magic decoder ring" argument. If they are working with government agencies to use this software (and it may not be the FBI), they wouldn't even have the ability to admit to it- those kinds of agreements require the company to deny everything in perpetuity.
First thing this new year, I'm migrating my phone over to cyanogenmod. I'd do it now, but I just don't have the time.
In my company's software there are plenty of "bugs" that are really just features of the software that are as designed. For example, you used to be able to set a time limit on user sessions. But then we took that out. Many of our customer's complained that it was bug, but it wasn't. It was designed out simply so we could sell more user licenses. While my example is not terribly nefarious, it would not surprise me if there was a "bug" that fed call data and user text messages into our governments Total Information Awareness programs.
encoded or encrypted?
but that that the contents of those messages would not be human readable. Instead, they would be in an encoded form that could not be decoded without special software
"We encoded it as ROT13, twice."
--
BMO
I see they carefully chose their words, implying that the special software that makes it unreadable makes it ok. However, one may assume they have such software and are able to read everything. In addition, when I hear about unreadable by humans, I assume that it is most likely xor rather than aes.
I would not be surprised if any cell phone, even the dumb ones, could be remotely enabled to log keys and other private information at the drop of a hat with order from proper authority. I could see the big corporations and government interesting lying somewhere along the lines of "The technology is capable of it, why not include the feature for the sake of public "security"? Same goes for any of the cloud connected network devices, such as the Kindle. Remember, when you are in the cloud you are in another parties home, running on their network under their control. Do you trust them with your private information? You better read *all* of the fine print before agreeing to it and using their services. Even then, can you really *trust* them?? What can't they tell or reveal to you because their mouths are zipped with all of the blessings of the US government?
"Show me the source code, and let me rebuild it" is the only way to be sure. To be sure you, or someone else who you trust, need to be able to inspect it and reconstruct it to confirm that is does what you want it to do and does not do what you don't want it to do.
Such as in the case of using the GPL. This is why the GPL rules when it comes to privacy and controlling the technology you use. Proprietary solutions, such as found in today's smart phones, are very risky because you have no way of knowing the full extent of what harmful things they can actually do.
First off.. CIQ are not the bad guys here.
They make software. It does various things, and it can be used for good or evil.
The carriers are the ones who requested the software to be placed on the handsets. The handset makers are the ones who screwed up, specifically HTC who left debug mode enabled on a production handset. The Samsung handsets do not exhibit the same issues that were shown in the video that the HTC handsets show.
The whole FBI link, no one really knows for sure, what the deal is, other then they refused a FOIA. That could mean they utilize the data, or they are in fact investigating CIQ itself.
Honestly, for the purposes that CIQ claim the software is for, I have no real issue with it. However they built far more capability then was needed in the software, and that I do have a major issue with.
I came, I conquered, I coredumped
When your cell phone gets a call, it’s not like every tower on the network suddenly starts looking for your phone, only the towers with the best signal send the call. If for example you're in South Dakota when a call comes in, towers in California, Kentucky and Maine aren't suddenly looking for you, only the towers with the best signal quality send you the call; this is how carriers guarantee “quality of service” and why there are cell phone towers all over the place.
The "cell" in “cell phone” refers to the towers themselves, or more accurately the range of coverage for each tower. That is how the industry refers to them and in order to guarantee quality of service your provider needs to know what “cell” or “cells” your phone is closest to; so in that regard ALL CELL PHONES "smart" and "dumb" are tracked. Additionally all cell phones can be compromised allowing your devices microphone, camera, or GPS to be used by unauthorized persons without your knowledge. It has been proven that the contents of your entire phone including the text messages, emails, phone book, confidential log in information etc can be accessed with or without the phone being connected to any network, just like people used to steal phone numbers from highway overpasses when mobile phones first came out.
We have spent YEARS researching the problem.
The problem is REAL and so is the SOLUTION: The Case For Privacy – Because there is a case for privacy.
www.thecaseforprivacy.com
I read the CIQ pdf, and the part I was most impressed with was the service quality heatmaps. It would be great if the carriers made (or were required to make) this data available. This would make it much easier to evaluate a carrier in your actual area. Instead the carriers just release vague maps that show that nearly the entire US is green. Clearly they have the data.
One thing that's bothered me about all this:
Google's street-view car inadvertently logs SSID broadcasts, which are transmitted in the clear. They 'fess up and get washed and hung out to dry. Threats from governments, demands that they turn over the data, investigations galore.
CarrierIQ sends your text messages and keypresses and location information (including your typed passwords) to various third parties including the FBI and carriers... and nothing. A handful of small entities are "seeking suit" against the company.
Where's the outrage? You'd think that CarrierIQ only affects geeks.
Defenders of Carrier IQ insist that they're not collecting keystrokes, capturing SMS messages, or relaying personal information to the FBI, and that they're just collecting information to improve the quality of the network. The argument is irrelevant. Clearly the software has the capability of performing all these functions even if it isn't currently being used that way, and if the capability is there, it can be abused by third parties. Its existence on a personal device on anything other than an opt-in basis is unacceptable.
"Carriers don't have access to the contents of the [SMS] messages." Then how the hell do they get them to my phone in a human-readable format?
"This is extremely useful software, that a few OEMs misused."
No the OEMs used it pretty much exactly as it was made to be used. They didn't customize it to be spyware, it was already spyware.
Are you trying to shift blame to the OEMs? Why? Both parties are involved here, both parties knew what they were doing.
"There's absolutely zero evidence that any wrongdoing even occurred"
There's is absolute evidence of wrongdoing here. There fixed that for you.
"Be honest with yourself. You just want to be angry and righteous about something"
So you have no argument and are reduced to insults?
Reading through it, it's a very clever document.
It explains that the IQ agent collects diagnostic info, then talks about that diagnostic info. Then attributes the log file with all the data to the OEM (HTC in this case).
Do they say that the network signal strength diagnostic is the ONLY data they collect? No, read it carefully, every sentence that comes close, has a get out clause. "We wrote software that...", not "Our software only does...".
Do they say the data it collects is not used by the FBI? No literally they say, the FBI doesn't approach *them* for that portion of the data that they have!
Literally they only talk about the diagnostic part of their software and hope you don't notice that their Experience manager, for example, has data from logs all your camera usage, and apps run and everything else, even offline. Where does it get that data from if they don't also log that?
It's a very well drafted document, which CAN BE ARGUED to be true in court, by a lawyer, sentence by sentence. Yet it doesn't tell the full story here.
Sad that such paranoia grips the President and all appointed officiates.
There is a clause in the Constitution that states that the President can be removed on cause of medical or physical inabillity to function in the capacity to uphold the Constitution of the United States of America.
Trouble is, this President and his God -- Mr. George Walker Bush -- abandoned the Constitution, local laws, State laws, Federal laws, International laws and ethics and morality long long ago.
Pity.
Most comments I've read are from them saying that they don't do this or that. They never clarify or deny that their software CAN'T do this or that. With it running as root and having full access to the file systems on Android phones, what the hell can it do? To me this seems like a huge security risk and hole that either hackers or law enforcement can and will use. Hopefully I'm wrong.
Please go read their website, they make it clear they capture usage data (for example every time you take a photo, where it was taken, and when), even offline, apps runs, URLs visited etc. Their apps can dig this info right down to individual user level, again they make the clear claim on their website.
They release a document discussing the network signal strength diagnostic as though its the only function of this software.
All it shows is that this company seeks to mislead, yet again sadly. That document doesn't deny it records and sends all this information, indeed their CEO has argued that they need this data to aid users (see his mistyping facebook.com comment). It just seeks to make a justification based on a narrow function of the software.
How does logging my use of the camera aid network signal strength detection?
So people are NOT way too paranoid, they'd hypothesized that the software does this and that, and BEHOLD, it has turned out to be true, and the CEO then comes out, claims it's for our benefit and does another misdirection.
The whole FBI link is because the FBI refuses to release info on when it has used Carrier IQ data on the basis that it puts at risk an ongoing investigation.
So we know there are ongoing investigations that use this data, Carrier IQ would know if the FBI had their data to investigate them, so there would be no investigation put at risk by revealing if it was CIQ itself being investigated.
FBI has previously revealed it uses software 'bugs' (bugs in the sense of bugging) to monitor phones. So it is likely FBI has helped itself to all that data. CIQ's very *narrow* denial doesn't dispute this. Indeed when you say 'Carrier IQ data' you mean the data grabbed by their software, but they use it in the sense of the data described in the document. Which is a far far narrower definition.
Lawyer weasel words from CIQ.
Don't the phone companies know the full plaintext of every message you send or receive, and every voice call, and every phone # you ever sent or received communication from?
Do we know exactly what they are storing/not-storing or transmitting?
The really sad thing is that CarrierIQ has had several articles run about it recently, but there was only one article regarding the wikileaks spyfiles.
Personally, corporations in my area selling 0-day vulnerabilities and maliciously hacking for profit (primarily selling to authoritarian regimes, who else would by these tools?) is a much bigger issue in my book.
The carriers can already track your location anyway, and they are doing it right now legally. (Ever heard of cell phone triangulation?)
Also, I was able to disable all of the security checks on my cell phone (quite a lengthy process requiring a serial cable/etc), which enabled me to dump ALL of the data on my cell phones rom, which is running Cyanogenmod btw. (That includes the data that is hidden between partitions).
After doing so, I used strings to extract all of the @AT remote commands, which are all commands which can be run by the carrier.
This was all in an attempt to figure out how the FBI turned a Mafioso's cell phone into a roving bug:
http://www.zdnet.com/news/fbi-taps-cell-phone-mic-as-eavesdropping-tool/150467
It turns out there are several methods that they could have used. The simplest, which would generically work on all cell phones is to remotely answer a cell phone call, and tell the phone not to ring. The @AT commands fully support this. There are several other more powerful commands, some of which give you raw access to the cell phones memory, and a few allow carriers to remotely reprogram the SPL of the phone.
There are several other installation vectors for standard cell phones, specifically if you use a google phone, your cell could be turned into a roving bug by using the remote install feature. If someone gets ahold of your google account, they can remotely install malware into your cell phone without you even knowing about it. (Specifically, I would name the malware "Vending" or something like that so it doesn't look suspicious). The FBI could easily persuade google to perform this for them.
If that method proves futile (or they don't want to deal with google), they could use Over the Air (OTA) which thankfully cyanogenmod disables, or they can use a BinarySMS, or the SIM toolkit functionality. There are probably other infection methods, but these are the only ones I could find.
For anyone interested in a cell phone that disables most of these methods, have a look at http://www.cryptophone.de.
Overall, it seems like if you want to be an activist or someone who is nefarious, you had better leave your cell phone at home...
The data is there all right. Here are a couple of maps from Finland - I don't actually know how they gather this data, but it's really thorough: http://www.elisa.fi/kuuluvuus/index.php / http://www.dna.fi/yksityisille/puhe/Kuuluvuus/kuuluvuuskartta/Sivut/Default.aspx
I think that the maps need to be this precise because a lot of people have second homes or cottages somewhere outside the cities, and naturally one would like to use the same operator everywhere.
How to be shure that no spyware is running, and that the carrier and government is not spying on where you are going in real time ?
it's very simple, and works on any brand and model of phone :
Put it off.
or even better : Throw it away.
For carrier IQ : it definitely is a rootkit. Of course they collect statistical information, and they say they don't user personnal info.
But a real plain statistic SW would :
- Not hide it's presence from the user
- remove any plain text payload before doing anything
aaaaaaa
it's really rather easy to gather. slap some sw on a phone and start driving around.
slap a logger box on your access point installers van and that's another way. no need to go spying on everyone.
SO.. ciq is not needed for this at all.
world was created 5 seconds before this post as it is.
Our client Trevor Eckhart (whose research set off the present firestorm) and his subsequent collaborator Ashkan Soltani have shown that on some phones, dialer keypresses and SMS text are being written to system logs by layer 4 code.
It doesn't matter the intent of the developers of the software. If it exposes private information by logging plain text information to a place where an application can access it, it is bad. Trevor Eckhart exposed a VERY dangerous effect of a software exposing private information. The developers should fix their shit and shut the fuck up.
Finally, there is an additional configuration file (called a "Profile") that controls the behavior of layer 2 and determines what information is actually sent from the phone to a carrier or other Carrier IQ client.
If the user does not have access, or even know there is access, to controlling the "Profile" it is spyware. If it can not be disabled or removed without rooting the phone it is a rootkit.
Having to work for a living is the root of all evil.
if the mobile software soop won't get you, surely their *.PDF (hint hint) will...
if the TLAs want data, let them get a search warrant.
if this is supposed to be a new economy, how come they still want my old fashioned money?
http://www.rcfp.org/can-we-tape
So with wire tapping laws, some states require all parties involved to give concent to the recording. These are 2 party states. All other states are 1 party states, which means only one person involved in the recording has to give concent.
Now if they are recording incoming information within a 2 party state, the sender of the SMS message has to give concent that the message can be recorded. This is reguardless of the contract of the owner of the phone has. Ultimately, anyone who has ever sent a message to one of these phones in a 2 party state could possible sue.
This directly contradicts the Eckhart video (http://www.wired.com/threatlevel/2011/11/secret-software-logging-video) which clearly shows that txt's are logged in plain text.
But we can't be sure? What the hell does that mean for giant programs like Windows? Or programs that you wouldn't suspect like video drivers (a two company duopoly), msn, IE, Router Firmware?, Microsoft Word, Firefox, Linux, etc.?
And what are our inklings of the penalties here? Can we penalize this company for doing something ferociousness when they were just following the orders of the FBI to "include a little code", or a court order not to discuss their involvement with law enforcement?
When programs send "random data" to fill packets we'll never know....
Perhaps a small country will speak out against this and all the genius tinfoil hats will move there and build paradise.
I pray for this every day.
Very good point. You can count on it. And the replacement is most likely not so easy to detect or understand. Perhaps they can switch it on or off and collect the data as a pool at opportune times when it may not be so easily noticed. As long as they have the source code and you don't, there is no way for you to understand how the device works, for or against your wishes. If you are not permitted to rebuild it, then you will never understand how it truly works. ...I guess the poor unwary consumer will just have to *trust* them as money flows aggressively from their shallow wallet to the deep corporate coffers. heh heh.
Next in the headlines-- Feds using electric utility company data to monitor you at home, using.. what, really? Utility IQ! http://www.silverspringnet.com/products/utilityiq-apps.html
Because DRM has never been broken.