EFF Reverse Engineers Carrier IQ

← Back to Stories (view on slashdot.org)

EFF Reverse Engineers Carrier IQ

Posted by samzenpus on Friday December 23, 2011 @01:06AM from the see-how-it-ticks dept.

MrSeb writes "At this point we have a fairly good idea of what Carrier IQ is, and which manufacturers and carriers see fit to install it on their phones, but the Electronic Frontier Foundation — the preeminent protector of your digital rights — has taken it one step further and reverse engineered some of the program's code to work out what's actually going on. There are three parts to a Carrier IQ installation on your phone: The program itself, which captures your keystrokes and other 'metrics'; a configuration file, which varies from handset to handset and carrier to carrier; and a database that stores your actions until it can be transmitted to the carrier. It turns out that that the config profiles are completely unencrypted, and thus very easy to crack."

103 comments

Min score:

Reason:

Sort:

If it's unencrypted... by Anonymous Coward · 2011-12-23 01:09 · Score: 5, Funny

...why would anyone have to crack it? Just open and read it. BRB, I'm going to 'crack' these jpegs of naked ladies.
1. Re:If it's unencrypted... by Bananana · 2011-12-23 01:15 · Score: 0
  
  One doesn't know it is unencrypted until he figures it out (cracks).
2. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 01:16 · Score: 5, Insightful
  
  'crack' is a vague expression. It says that it's unencrypted, which doesn't mean it isn't encoded. If you read the articles, it will be clear that by cracking they mean understanding what's in there.
3. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 01:19 · Score: 5, Insightful
  
  Unencrypted != human readable.
  Obfuscated bytecode is unencrypted and still takes a lot of effort to make sense from.
4. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 01:20 · Score: 5, Informative
  
  Being unencrypted and being human readable are two different things. Reverse engineering includes figuring out the data structure and format and actually figure out what bit means what data. Generally a simple process if it isn't compressed, encrypted or complex, but still reverse engineering.
5. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 01:22 · Score: 0
  
  If you didn't have a program that could take those bytes in the jpeg and turn them into pixels on the screen we'd be talking comparison. Cracking the jpegs would then be to get the photo onto your screen. Now do that without the use of libjpeg or the jpeg standard documentation.
6. Re:If it's unencrypted... by sunderland56 · 2011-12-23 01:24 · Score: 5, Informative
  
  It is a binary, not source code. So it's like having a file containing an image of naked ladies, but not knowing what sort of compression scheme was used.
  
  It was also written in forth, of all things. So it's like finally figuring out the compression scheme and decoding the file - only to find out that it is an image of naked lady *martians*.
7. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 01:25 · Score: 5, Funny
  
  Indeed. Anyone who has worked with any sort of Perl source code knows just how true your statement is. It's unencrypted, it's not (intentionally) obfuscated, and it may even have comments, but it's not human-readable, even after you've worked extensively with Perl for a couple of decades.
8. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 01:36 · Score: 0
  
  Or ASCII... ever tried reading the binary values for ASCII codes? Thankfully almost every hex editor ever built can decode ASCII...
  But I understand the confusion - you just assume that if it isn't encrypted that it will be in a format that can be easily read...
9. Re:If it's unencrypted... by Tsingi · 2011-12-23 01:37 · Score: 1, Funny
  
  it's not human-readable, even after you've worked extensively with Perl for a couple of decades.
  Which pretty much makes you a masochist. I used perl for a project once because it was the only language I could get to talk to MSSQL from Linux without screwing up. I dread maintaining it.
10. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 02:02 · Score: 0
  
  That's ok, there were (and, presumably, still are) versions of Forth for DOS
11. Re:If it's unencrypted... by c · 2011-12-23 02:32 · Score: 5, Funny
  
  > It was also written in forth, of all things. So it's like finally figuring out the compression
  > scheme and decoding the file - only to find out that it is an image of naked lady *martians*.
  Er... you do realize this is slashdot, and to an entire generation of nerds who spent most of their post-pubescent lives lusting after Star Trek aliens, both real-live implementations of "forth" and images of "naked lady martians" are considered a good thing to find inside compressed, encrypted binary blobs?
  Stick with something safe, like car analogies.
  
  --
  Log in or piss off.
12. Re:If it's unencrypted... by interval1066 · 2011-12-23 02:57 · Score: 1
  
  real-live implementations of "forth" and images of "naked lady martians" are considered a good thing...
  I must not be living in your universe then. The last time I experienced Forth was an interpreter on a cart I bought for my C64 back in the 80's. I think I popped it in the slot once, then it sat on a shelf for the next 10 years and finally got round filed. I can't think of anyone I know who would consider Forth more than a curiosity and more than one of them would try to re-write the module in Python, probably.
  
  --
  Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
13. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 03:10 · Score: 5, Funny
  
  Ever look at LISP code. Looks like fingernail clippings in oatmeal.
14. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 03:20 · Score: 0
  
  Perl is the only programming language I know of that looks the same both before and after 128 Bit encryption
15. Re:If it's unencrypted... by eudaemon · 2011-12-23 03:47 · Score: 1
  
  Just as a single data point counterpoint, Forth is used in openboot proms so if you were to admin any Sun gear, you'd be using Forth whether you knew it or not even today. Having said that, it's a nice skill to have, but you probably won't get a job programming in that language.
16. Re:If it's unencrypted... by Dark$ide · 2011-12-23 03:48 · Score: 1
  
  Or ASCII... ever tried reading the binary values for ASCII codes? Thankfully almost every hex editor ever built can decode ASCII...
  But I understand the confusion - you just assume that if it isn't encrypted that it will be in a format that can be easily read...
  The youth of today. You've not lived until you've decoded EBCDIC or read the holes on a Hollerith card or five bit paper tape.
  ASCII is trivial compared to those three.
  
  --
  Sigs. We don't need no steenking sigs.
17. Re:If it's unencrypted... by rdebath · 2011-12-23 04:09 · Score: 1
  
  I did use forth for a little while a long time ago. But I'm far to comfortable with normal algebraic notation to stay with it.
  So, IMO it's no use as a high level language, but it makes a very good assembly language especially if you're space constrained because optimising for space is just a simple LZW style compression algorithm. Something that is very, very well understood.
  So it'll never die, just get hidden everywhere there's half a penny to be shaved.
18. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 04:27 · Score: 0
  
  EBCDIC? what's there to decode? A simple lookup table and you are good to go.
19. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 04:28 · Score: 0
  
  Maybe so, but it still beats the hell out of C++ with templates and macros for readability.
20. Re:If it's unencrypted... by dbc · 2011-12-23 04:43 · Score: 1
  
  Punch cards are easy. Get out a bottle of MangnaSee, pour some on a magnetic tape, and stick it under a microscope...
21. Re:If it's unencrypted... by jackbird · 2011-12-23 04:56 · Score: 1
  
  In the early 90s, portions of the computer art crowd (the ivory tower capital-A Art folks, not the demoscene folks) were using a lot of Forth to do things people would use Processing for today.
22. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 05:29 · Score: 0
  
  I dread maintaining it.
  From what you say, I would also dread maintaining your code.
23. Re:If it's unencrypted... by geekprime · 2011-12-23 05:29 · Score: 1
  
  Thank you, damn kids nowadays have no idea whatsoever.
  Try sight reading paper tape.
24. Re:If it's unencrypted... by geekprime · 2011-12-23 05:36 · Score: 1
  
  It's my understanding that the camera systems that run suspended on cables over the football fields and up and down the sidelines are run on forth, not that that's a huge job market but it's still in use.
25. Re:If it's unencrypted... by SQLGuru · 2011-12-23 05:36 · Score: 1
  
  I'll just encyrpt my paper tape by running the tape back side up.
26. Re:If it's unencrypted... by paramour · 2011-12-23 05:39 · Score: 2
  
  Pah, kids these days. Try TECO
  "It has been observed that a TECO command sequence more closely resembles transmission line noise than readable text. One of the more entertaining games to play with TECO is to type your name in as a command line and try to guess what it does. Just about any possible typing error while talking with TECO will probably destroy your program, or even worse - introduce subtle and mysterious bugs in a once working subroutine."
  -- Real Programmers Don't Use PASCAL
  The first versions of emacs were written in TECO, inspired in part by tmacs -- TECO macros.
  Or try APL. Uses a special character set, permits composed characters, assumes you know linear algebra, and reads right to left -- the epitome of a write-only language.
  Now get off my lawn.
27. Re:If it's unencrypted... by Night64 · 2011-12-23 06:04 · Score: 2
  
  The first time I saw someone coding a MUMPS program, I figured that it was just a memory dump.
  
  --
  Grey's Law: Any sufficiently advanced incompetence is indistinguishable from malice.
28. Re:If it's unencrypted... by sjames · 2011-12-23 06:28 · Score: 1
  
  If the images were in an undocumented proprietary format, figuring that format out so that they could be viewed outside of the intended proprietary app would be cracking.
29. Re:If it's unencrypted... by sjames · 2011-12-23 06:37 · Score: 1
  
  In spite of protests to the contrary, Postscript is practically forth with a few keywords changed and a vector graphics library pre-loaded.. That came in handy when I needed a program to produce printer ready output.
  Python may be generally preferable, but Forth can fit in a really tiny and minimalist environment.
30. Re:If it's unencrypted... by Em+Adespoton · 2011-12-23 07:52 · Score: 1
  
  As another coutner-datapoint: All "new world" Macs (PowerPC Macs running OpenFirmware) were using Forth as the bootloader. This also goes for all Sun gear that used OpenFirmware, as well as anyone else. OF was the only real alternative to CMOS for years, and was built around a Forth interpreter.
  Up until 2006 or so, you'd probably get a decent driver-level coding job using Forth, but nowadays Lua would be a more useful language to know.
31. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 09:34 · Score: 0
  
  Back around 1974-5, right after I got out of college, I went to work for a company that made computer systems for the publishing industry. Being a ham radio operator, as well as a BSEE, I was already familiar with 5-level Baudot ("RTTY") used on Model 28 ASRs, as well as 8-level ASCII used on ASR 33's. But I'd never heard of 6-level TTS paper tape until I started calling on customers. That was weird stuff because the sprocket holes were aligned with the *front* edge of the data holes, not centered on the data holes' centerlines. And, there were 3 data holes on one side of a sprocket hole and 3 on the other side, so which way was up? Even more incredible were the old-timers at some of the customer establishments who could read those tapes visually, similar to some hams I knew (and who apparently didn't have anything better to do...).
  So, yeah, ASCII is trivial by comparison, assuming those 8-level tapes were indeed ASCII and not a RIM loader for a PDP-8 or PDP-11 !
32. Re:If it's unencrypted... by dlawson · 2011-12-23 11:29 · Score: 1
  
  I must not be living in your universe then. The last time I experienced Forth was an interpreter on a cart I bought for my C64 back in the 80's. I think I popped it in the slot once, then it sat on a shelf for the next 10 years and finally got round filed. I can't think of anyone I know who would consider Forth more than a curiosity and more than one of them would try to re-write the module in Python, probably.
  Alright, whippersnappers, listen up.
  FORTH was incredibly useful in the day when many SS-50 Bus systems had 32KB memory cards. I had one that also came with an old 8-KB memory card, but wasn't functional because it's address space overlapped the 32KB card. A simple lookup of the address pins on the memory controller address chip provided the knowledge to re-address the card to a new range, and so I had a system with 56KB addressable memory (the processor card had RAM and ROM onboard.)
  So what to do with the extra space? (Re-)Write my own FORTH based OS, which I had gotten from the FORTH magazine. The FORTH code was written in 8086 based assembler, but I had a MC6809, so a rewrite really sped things up. I even figured out how to thread the stacks so as to not have them collide, or simply scribble over all of memory.
  As you can probably guess, the project was useful as a learning tool, not for any real work, but it was three years before the Apple or the IBM PC. I then wrote in Assembler (Flex, AFAIR) a printer driver to properly run my DEC LA36 in HiRes mode. I printed my first resume on it. A friend said "Don't use the bold font, it's ugly." My reply was that it was a testament to my skill, because none of the existing drivers outside of DEC equipment could do that.
  BTW, SUN; IBM POWER; and OpenBOOT (AKA OpenFirmware) machines all used FORTH for boot loaders and console monitors. So it is more than a curiousity.
  NOW get off my lawn. Or make my day, punk ;-)
  
  --
  dot-sig.
33. Re:If it's unencrypted... by antdude · 2011-12-23 12:06 · Score: 1
  
  Do most geeks/nerds really know about cars? I am a nerd/geek, and I don't know about cars. :P
  
  --
  Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
34. Re:If it's unencrypted... by Anonymous Coward · 2011-12-23 12:19 · Score: 0
  
  "The program itself, which captures your keystrokes and other 'metrics'"...just open it up in notepad. It's.Just.That.Easy.
  Stick to cracking jpegs of naked chicks.
35. Re:If it's unencrypted... by c · 2011-12-23 13:16 · Score: 1
  
  Judging from most slashdot car analogies, I'd say "no". Which, I think, makes it safer ground than programming languages and naked aliens.
  
  --
  Log in or piss off.
36. Re:If it's unencrypted... by Thing+1 · 2011-12-23 15:10 · Score: 1
  
  Python may be generally preferable, but Forth can fit in a really tiny and minimalist environment.
  Yeah, but shouldn't it have been called Backth? I mean, it's using reverse polish notation...
  
  --
  I feel fantastic, and I'm still alive.
Seems like a waste of time by jbmartin6 · 2011-12-23 01:17 · Score: 4, Informative

According to the article, almost nothing has been reverse engineered and at best you get "a hint of what data is being captured" from examining an unencrypted config file

--
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
All I want to know is... by Saintwolf · 2011-12-23 01:20 · Score: 1

Are they actually transmitting my keystrokes to the carrier/google?
1. Re:All I want to know is... by karolbe · 2011-12-23 03:26 · Score: 1
  
  No.
android? by stoolpigeon · 2011-12-23 01:26 · Score: 3, Interesting

why does a story about carrier iq have the android icon on it?

--
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
1. Re:android? by AHuxley · 2011-12-23 01:34 · Score: 1
  
  The software was used by US telcos in a few different phone systems they offered ... i.e. sitting between the beloved safe 'open' android or more closed OS's, https and your fingers.
  
  --
  Domestic spying is now "Benign Information Gathering"
2. Re:android? by xSander · 2011-12-23 01:38 · Score: 1
  
  More like: why isn't there an iPhone/iOS-related tag? Android is mentioned because this spyware was installed on (some) Android phones.
3. Re:android? by Culture20 · 2011-12-23 03:53 · Score: 3, Funny
  
  why isn't there an iPhone/iOS-related tag?
  Because Apple vowed that it was never installed, and that it was disabled by default when it was installed.
4. Re:android? by Anonymous Coward · 2011-12-23 05:51 · Score: 1
  
  ...and that it was disabled by default when it was installed.
  So Apple lied when they said
  
  Apple vowed that it was never installed
  no?. And we must believe it was really disabled?
5. Re:android? by assertation · 2011-12-23 06:04 · Score: 1
  
  because Carrier IQ software is embedded in phones that use the Android OS?
So it's badly written & only helps the carrier by phonewebcam · 2011-12-23 01:33 · Score: 3, Insightful

All it needs now is a $5 per Android handset "licensing fee" and you've got your smoking gun!
Cough it up by PopeRatzo · 2011-12-23 01:34 · Score: 4, Insightful

If you haven't done so yet this year, it's time to go donate a few bucks to EFF.
I wouldn't bring it up if we didn't need them so bad.
I'm in for another fifty, just because I saw this story and it's fucking Christmas and if SOPA passes we might as well kiss our Internet goodbye.

--
You are welcome on my lawn.
1. Re:Cough it up by Anonymous Coward · 2011-12-23 01:46 · Score: 0
  
  EFF that !!
2. Re:Cough it up by Anrego · 2011-12-23 02:17 · Score: 1
  
  Yup!
  I don't agree with everything the EFF says by any stretch... but compared to the other extremes... they get some of my money!
3. Re:Cough it up by Anonymous Coward · 2011-12-23 02:33 · Score: 0
  
  Done. Money well spent..
4. Re:Cough it up by andydread · 2011-12-23 04:05 · Score: 1
  
  Yeah I am going to have to throw them another $50 too. Every time I see EFF in the news I try to throw a few their way. Hope they keep it up and I'll keep sending some their way every time.
5. Re:Cough it up by Anonymous Coward · 2011-12-23 04:35 · Score: 0
  
  I send them $50 every month. Best [beep] investment in freedom I can make.
6. Re:Cough it up by bcrowell · 2011-12-23 05:41 · Score: 3, Informative
  
  It's tax deductible.
  To donate by sending a check: 454 Shotwell St, SF, CA 94110
  Donate online.
  Good things they've done.
  
  --
  Find free books.
7. Re:Cough it up by poor_boi · 2011-12-23 08:46 · Score: 1
  
  I just donated again. Thanks for the reminder.
Consumer Protection by sociocapitalist · 2011-12-23 01:34 · Score: 5, Insightful

At the risk of being modded down, I think that if there is not already legislation to protect people from this type of spying then there should be.

--
blindly antisocialist = antisocial
1. Re:Consumer Protection by tunapez · 2011-12-23 04:38 · Score: 2
  
  Protect? Surveillance and enforcement are much more profitable than privacy. Be glad the lawmakers are still calling the internet a 'right', any day it could become a mandate.
  This is the greatest spycraft tool and marketing assault ever conceived, all wrapped into the guise of bringing info to the masses!
  
  Throttled, vetted and sanitized info is the endgame if the entitled set get their way.
  
  --
  Imagination drew in bold strokes, instantly serving hopes and fears, while knowledge advanced by slow increments...
2. Re:Consumer Protection by b4dc0d3r · 2011-12-23 05:12 · Score: 1
  
  What type of spying? So far, no one has shown that anything invasive has been sent. Only videos of event triggers, not actual storage or sending. The profile example for my phone looks innocuous enough, and the more I read about CIQ the more I think it does exactly what it says - help the carrier improve the network.
  So what exactly is it you want protection against?
  My carrier has already asked that it be removed from devices. The free market worked. Mostly because Sprint has been trying very hard to keep customer satisfaction high.
  http://informationweek.com/news/mobility/smart_phones/232300799
3. Re:Consumer Protection by sociocapitalist · 2011-12-23 08:00 · Score: 1
  
  You're referring to this specific instance (CIQ) whereas I am referring to the entire idea.
  Even if you are correct that nothing serious has happened..this time, the reality is that if we have no legal protection that we will be spied upon as much as possible for corporate gain.
  I want a life and I want it private. As I also want to be able to use the Internet (I don't use facebook et al and I make every effort for my private life NOT to be posted), and I want to be able to use a telephone without fear of being spied upon, I want legislative protection saying that they just can't do it.
  
  --
  blindly antisocialist = antisocial
4. Re:Consumer Protection by Anonymous Coward · 2011-12-23 15:14 · Score: 0
  
  I also don't use Facebook. We should be Friends!
collector/c info please by sgt+scrub · 2011-12-23 01:48 · Score: 5, Interesting

Of course we hope people can also send us Profiles from Windows Mobile, BlackBerry, iPhone and "feature phone" ports of Carrier IQ.
I'd settle for more info about "c" on the machines collecting data.
grep -H https *.xml
att-galaxy-s2-defaultProfile.pro.xml: UploadUrl="https://ciqcol01.ciq.labs.att.com:10010/collector/c">
htc-amaze-tmob-defaultProfile.pro.xml: UploadUrl="https://oddca.t-mobile.com/collector/c">
htc-evo-sprint-iqprofile.pro.xml: UploadUrl="https://collector.iota.spcsdns.net:10003/collector/c">
tmob-galaxy-s2-defaultProfile.pro.xml: UploadUrl="https://oddca.t-mobile.com/collector/c">
I was able to get ciqcol01.ciq.labs.att.com 10010 to respond with telnet; but, it dropped my connection when I sent GET/POST etc. The others didn't respond. I'm assuming they have been moved.

--
Having to work for a living is the root of all evil.
1. Re:collector/c info please by Anonymous Coward · 2011-12-23 01:56 · Score: 2, Insightful
  
  Interesting. Port 10010 doesn't show up on a port scan but responds to telnet.
  host ciqcol01.ciq.labs.att.com
  ciqcol01.ciq.labs.att.com has address 216.103.127.200
  nmap -P0 216.103.127.200
  Starting Nmap 5.21 ( http://nmap.org/ ) at 2011-12-23 07:52 CST
  Nmap scan report for 216.103.127.200
  Host is up (0.028s latency).
  Not shown: 998 filtered ports
  PORT STATE SERVICE
  139/tcp closed netbios-ssn
  445/tcp closed microsoft-ds
2. Re:collector/c info please by Anrego · 2011-12-23 02:01 · Score: 4, Informative
  
  By default, nmap only scans a subset of ports (first 1000 of all protocols or something).
  Try explicitly telling it to scan that port (using the -p option)
3. Re:collector/c info please by LordLimecat · 2011-12-23 03:48 · Score: 2
  
  Just the 1000 most common ports. Hence why it says "not shown: 998 filtered", as well as the two showing up. There is an option which will tell it to do a full scan of all 65536 ports.
  Thats probably why they chose that port, incidentally-- gets missed on a casual scan.
4. Re:collector/c info please by Anonymous Coward · 2011-12-23 06:50 · Score: 0
  
  It's using SSL, so Telnet won't be able to handle the SSL negotiation. Trying using OpenSSL.
  Command: openssl s_client -connect [host]:[port]
5. Re:collector/c info please by Anonymous Coward · 2011-12-23 07:00 · Score: 0
  
  You probably need client certificates for those https sessions. They're probably hidden in the carrier iq binary somewhere.
Wikipedia article by tpotus · 2011-12-23 02:08 · Score: 1

Why isn't there a wikipedia page on Carrier IQ, the software? There's only one on the company? Wiki wars?
1. Re:Wikipedia article by Anonymous Coward · 2011-12-23 02:22 · Score: 0
  
  The one on the company is pretty much all about the software.
  Right now information is changing too much.. once it's all calmed down I'm sure the article will be cleaned up and broken apart as appropriate.
2. Re:Wikipedia article by MarkGriz · 2011-12-23 02:22 · Score: 4, Insightful
  
  Welcome to Wikipedia, the free encyclopedia that anyone can edit.
  
  --
  Beauty is in the eye of the beerholder.
3. Re:Wikipedia article by Khyber · 2011-12-23 06:41 · Score: 1
  
  Wiki = What I Know Is.
  Given the intelligence of most people on this planet, Wikipedia isn't very intelligent. It's also SLOW to pick up on the latest and greatest. And it's still sorely out of date on many topics.
  What Wiki knows is garbage.
  
  --
  Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
4. Re:Wikipedia article by mcgrew · 2011-12-23 08:04 · Score: 2
  
  Welcome to Wikipedia, the free encyclopedia that anyone can edit, even though your edit won't last 24 hours.
  
  --
  Free Martian Whores!
5. Re:Wikipedia article by Anonymous Coward · 2011-12-23 14:02 · Score: 0
  
  Welcome to Wikipedia, the free encyclopedia that ALMOST anyone can edit, unless your ip address happens to come from some randomly blocked subnet.
6. Re:Wikipedia article by Thing+1 · 2011-12-23 15:18 · Score: 1
  
  Wiki = What I Know Is.
  Yeah I'm not going to add in the references, this is from this page.
  
  "Wiki" (pronounced [Ëwiti] or [Ëviti]) is a Hawaiian word meaning "fast" or "quick".[5]
  
  --
  I feel fantastic, and I'm still alive.
Still undiscovered versions out there? by meburke · 2011-12-23 02:28 · Score: 3, Interesting

We know it's on android, but the article points to an earlier article that says, "In our post yesterday, we wrongly assumed that Carrier IQ was something that carriers added to smartphones — but now it’s clear that Apple bakes Carrier IQ into its closed-source iOS for use by carriers."
This makes me suspicious that there may be a version in Windows-based phones, or other phones with different data OS' installed.

--
"The mind works quicker than you think!"
1. Re:Still undiscovered versions out there? by LordLimecat · 2011-12-23 03:49 · Score: 2
  
  Im curious whether this is true of blackberry. Im still rather skeptical that RIM would take their supposedly security-minded product and then compromise it by including something like this in the stock firmware.
2. Re:Still undiscovered versions out there? by SmurfButcher+Bob · 2011-12-23 04:54 · Score: 1
  
  ^^ Mod parent funny!
  
  --
  
  help me i've cloned myself and can't remember which one I am
I smell a class action suit by fred911 · 2011-12-23 02:39 · Score: 4, Insightful

So not only are you possibly able to invade my privacy, but you're also charging me for the bandwidth to do it? I'm sure the TOS doesn't cover you for the later.

--
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
1. Re:I smell a class action suit by AHuxley · 2011-12-23 03:04 · Score: 2
  
  I hope it wakes a generation up. So may thought the https as offered was safe via the trusted device and telco.
  This shows how many layers can sit between the users and the trusted network - open or closed in every phone shipped in parts of the world.
  Many noted it sends "nothing" back - but it still shows how easy it is to get a whole generation of devices shipped with any shipped or installed crypto dead out of the box.
  Where are the telco open source developers, former big telco contractors on this?
  All we got was ~ "its hard to keep a software secret in 'our' new open source world" or "https math is safe down the network"
  
  --
  Domestic spying is now "Benign Information Gathering"
2. Re:I smell a class action suit by cnj · 2011-12-23 03:14 · Score: 3, Informative
  
  This may help explain why some carriers (e.g. T-Mobile) required an "unlimited" data plan for certain phones. Even though my wife only uses about 40 MB of data over T-Mobile's network a month, they want to require her to use the more expensive unlimited plan. If it's an unlimited plan, they aren't charging you for additional data transfer.
  Well, technically they might be, but not directly; and not legally. If that's really the reasoning, then they're just extremely evil and bad, bad people.
  
  --
  Never trust anyone over 90000.
3. Re:I smell a class action suit by Dishevel · 2011-12-23 04:50 · Score: 1
  
  I loved my old Evo.
  Rooted with CM7 on it.
  Whatever phone you have, you should have root.
  Most likely you should replace the stock firmware with something else.
  
  --
  Why is it so hard to only have politicians for a few years, then have them go away?
4. Re:I smell a class action suit by Anonymous Coward · 2011-12-23 05:18 · Score: 0
  
  You do realize that even with a rooted phone, the radio is still a black box, right?
5. Re:I smell a class action suit by Anonymous Coward · 2011-12-23 05:27 · Score: 0
  
  they want to require her to use the more expensive unlimited plan.
  Here you go, the reason. No need to explain it with conspiracy, when plain greed will do just fine.
  But really, unless it sends live capture of your desktop and your phone cam plus unencrypted contents of every https request and response, it won't use much data.
  Even if it does really capture and send actual key and messages log and not just statistics as promised, it won't make more than a megabyte or two a month. "Les Miserables" or "War and Peace" are 1-2Mb each. Can you type it all in a month?
6. Re:I smell a class action suit by Anonymous Coward · 2011-12-23 06:29 · Score: 0
  
  Well, at least the radio can't keylog.
  On second thought, one could probably instrument it to read radio interference caused by the user being too close to the keys O_O
Least favorite aspect of may favorite language by Anonymous Coward · 2011-12-23 02:49 · Score: 0

I was asked as part of a recent job interview the following question: "What do you like least about your favorite programming language?"

Forth, that it's not more widely used.
Apparently, I was wrong
Of course by Anonymous Coward · 2011-12-23 03:00 · Score: 3, Insightful

Of course there will be. The legislation will say "you may continue to spy as long as we get a cut".
No, that wasn't a joke.
1. Re:Of course by bill_mcgonigle · 2011-12-23 05:28 · Score: 1
  
  Exactly right. EFF isn't corrupt - we're better off with them than legislation.
  In this case market regulation >>>> government regulation.
  
  --
  My God, it's Full of Source!
  OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Root phone and run Cyanogenmod! by Anonymous Coward · 2011-12-23 03:04 · Score: 1

http://www.cyanogenmod.com/blog/cyanogenmod-will-never-have-carrier-iq
Most non-OEM ROMs do not have Carrier IQ.
1. Re:Root phone and run Cyanogenmod! by Anonymous Coward · 2011-12-23 04:13 · Score: 0
  
  http://www.cyanogenmod.com/blog/cyanogenmod-will-never-have-carrier-iq
  Everyone loves light-grey-on-white text.
Re:Ok, by Anonymous Coward · 2011-12-23 03:38 · Score: 1

It took a picture of my dick and tweeted it :(
Tony Weiner.
Re:Ok, by Anonymous Coward · 2011-12-23 03:47 · Score: 0

It took a picture of my tits and tweeted it!
Hayley Williams
"The preeminent protector of your digital rights" by Hal_Porter · 2011-12-23 04:16 · Score: 0, Offtopic

The EFF isn't the preeminent protector of your digital rights. The lordpwnalot toolbar is. It protects against Adware, spyware, and all sorts of other capitalist things.
http://www.lordpwnalot.cn/
Note : many antivirus software will give a false positive and you may need to disable it to install.

--
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Re:"The preeminent protector of your digital right by Anonymous Coward · 2011-12-23 04:27 · Score: 0

Yes.. because I want to drop my pants to install some chinese crap recommended by who exactly?
Re:"The preeminent protector of your digital right by Lashat · 2011-12-23 06:48 · Score: 0

It's lordpwnalot. Surely, you can trust him.

--
For every benefit you receive a tax is levied. - Ralph Waldo Emerson
Re:Ok, by Anonymous Coward · 2011-12-23 06:54 · Score: 0

It took a picture of my tits and dick, and tweeted it!

Chas Bono
More than just privacy by cybergremlin · 2011-12-23 07:40 · Score: 2

My big problem with CarrierIQ has not been concerns over privacy (I just assume the carrier can see anything I send over their network) but the fact that it is both buggy and unstoppable. I was in the middle of nowhere when I noticed that my Atrix 2 was nearly dead (I had charged it that morning). Checking the battery monitor showed that "Device Health Applicaton" had sucked down 80% of my battery, and had been using GPS for 6 hours strait. Of course you can not force it to quit, que stream of [explative-deleted]. I was able to stop the bleeding by switching off GPS, and a cold boot restored functionality. Still, having an application that can murder performance, but that you can not kill or remove, seems like bad form at the very least.
How is that reverse engineering? by Anonymous Coward · 2011-12-23 09:45 · Score: 0

They didn't duplicate functionality with nothing to go on but the black box of how it works. They had direct reference material from which they could produce human readable code to duplicate functionality. That isn't reverse engineering, that's copying.
This was too easy... by RevSpaminator · 2011-12-23 10:23 · Score: 1

I think it is time to start digging to the Radio Images that are provided by the phone vendors. WHAT are they tracking and WHO are they reporting to?
FUD by Anonymous Coward · 2011-12-23 21:44 · Score: 0

So far my understanding is there is open dialog between Carrier IQ and the FCC and FTC. there is an inquiry and no one is being arrested and no agents showing up on their door step. This will all go away I am sure.
I believe Trevor had his detection tool removed from the android market place. I don't know if it was put back. There have been other reports to that other developers are saying the the bloggers initial inspection of what the software does is in fact wrong.
I truly believe the software is simply diagnostics. I know lots of screaming and yelling and freaking out over a video, which if you are technically inclined is inaccurate
for all intense and purposes. Just look at what others have reported after reverse engineering the product and also watching how the software processes and reads information. The "security researcher" if you want to call him that works for a company called Telogis. I hear they are trying to get up to the race with Carrier IQ. What better way than to get the leader shut down and you quietly slip into the vacuum that is left behind. If you don't believe me check out the bloggers linked in
profile.
I think he was asked to do this as corporate espionage, and then they will control it all. Al bet a little differently.
So really the EFF and this researcher have nothing by Anonymous Coward · 2011-12-24 11:38 · Score: 0

I am just asking.
Seriously so you create a database of profiles, what god does that do? If we take the article on Carrier IQ's website at face value and then consider ok so we know that the profiles, would match one of the following criteria, what does it do?
I think the EFF knows Trevor messed up and they are grasping for straws now. They also know he works for Telogis which is a competitor, so that is something that is going to bite them later as well.
Re:"The preeminent protector of your digital right by wiedzmin · 2011-12-27 10:54 · Score: 1

lol?

--
Bow before me, for I am root.