Slashdot Mirror

← Back to Stories (view on slashdot.org)

EFF Reverse Engineers Carrier IQ

Posted by samzenpus on from the see-how-it-ticks dept.

MrSeb writes "At this point we have a fairly good idea of what Carrier IQ is, and which manufacturers and carriers see fit to install it on their phones, but the Electronic Frontier Foundation — the preeminent protector of your digital rights — has taken it one step further and reverse engineered some of the program's code to work out what's actually going on. There are three parts to a Carrier IQ installation on your phone: The program itself, which captures your keystrokes and other 'metrics'; a configuration file, which varies from handset to handset and carrier to carrier; and a database that stores your actions until it can be transmitted to the carrier. It turns out that that the config profiles are completely unencrypted, and thus very easy to crack."

3 of 103 comments (clear)

  1. android? by stoolpigeon · · Score: 3, Interesting

    why does a story about carrier iq have the android icon on it?

    --
    It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
  2. collector/c info please by sgt+scrub · · Score: 5, Interesting

    Of course we hope people can also send us Profiles from Windows Mobile, BlackBerry, iPhone and "feature phone" ports of Carrier IQ.

    I'd settle for more info about "c" on the machines collecting data.

    grep -H https *.xml

    att-galaxy-s2-defaultProfile.pro.xml: UploadUrl="https://ciqcol01.ciq.labs.att.com:10010/collector/c">
    htc-amaze-tmob-defaultProfile.pro.xml: UploadUrl="https://oddca.t-mobile.com/collector/c">
    htc-evo-sprint-iqprofile.pro.xml: UploadUrl="https://collector.iota.spcsdns.net:10003/collector/c">
    tmob-galaxy-s2-defaultProfile.pro.xml: UploadUrl="https://oddca.t-mobile.com/collector/c">

    I was able to get ciqcol01.ciq.labs.att.com 10010 to respond with telnet; but, it dropped my connection when I sent GET/POST etc. The others didn't respond. I'm assuming they have been moved.

    --
    Having to work for a living is the root of all evil.
  3. Still undiscovered versions out there? by meburke · · Score: 3, Interesting

    We know it's on android, but the article points to an earlier article that says, "In our post yesterday, we wrongly assumed that Carrier IQ was something that carriers added to smartphones — but now it’s clear that Apple bakes Carrier IQ into its closed-source iOS for use by carriers."

    This makes me suspicious that there may be a version in Windows-based phones, or other phones with different data OS' installed.

    --
    "The mind works quicker than you think!"