Slashdot Mirror
EFF Reverse Engineers Carrier IQ
MrSeb writes "At this point we have a fairly good idea of what Carrier IQ is, and which manufacturers and carriers see fit to install it on their phones, but the Electronic Frontier Foundation — the preeminent protector of your digital rights — has taken it one step further and reverse engineered some of the program's code to work out what's actually going on. There are three parts to a Carrier IQ installation on your phone: The program itself, which captures your keystrokes and other 'metrics'; a configuration file, which varies from handset to handset and carrier to carrier; and a database that stores your actions until it can be transmitted to the carrier. It turns out that that the config profiles are completely unencrypted, and thus very easy to crack."
According to the article, almost nothing has been reverse engineered and at best you get "a hint of what data is being captured" from examining an unencrypted config file
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Being unencrypted and being human readable are two different things. Reverse engineering includes figuring out the data structure and format and actually figure out what bit means what data. Generally a simple process if it isn't compressed, encrypted or complex, but still reverse engineering.
It is a binary, not source code. So it's like having a file containing an image of naked ladies, but not knowing what sort of compression scheme was used.
It was also written in forth, of all things. So it's like finally figuring out the compression scheme and decoding the file - only to find out that it is an image of naked lady *martians*.
By default, nmap only scans a subset of ports (first 1000 of all protocols or something).
Try explicitly telling it to scan that port (using the -p option)
This may help explain why some carriers (e.g. T-Mobile) required an "unlimited" data plan for certain phones. Even though my wife only uses about 40 MB of data over T-Mobile's network a month, they want to require her to use the more expensive unlimited plan. If it's an unlimited plan, they aren't charging you for additional data transfer.
Well, technically they might be, but not directly; and not legally. If that's really the reasoning, then they're just extremely evil and bad, bad people.
Never trust anyone over 90000.
It's tax deductible.
To donate by sending a check: 454 Shotwell St, SF, CA 94110
Donate online.
Good things they've done.
Find free books.