Slashdot Mirror
Sprint Faces Backlash For Adding MDM Software To Devices (csoonline.com)
itwbennett writes: On Wednesday, Sprint customer Johnny Kim discovered an in-store technician adding MDM software to his personal iPhone 6 without prior notice or permission. Kim took to Twitter with his complaint, sparking a heated conversation about privacy and protection. One expert who commented on the issue told CSO's Steve Ragan that 'it's possible Sprint sees the installation of MDM software as an additional security offering, or perhaps as a means to enable phone location services to the consumer.' But, as Ragan points out, 'even if that were true, it's against [Sprint's] written policy and such offerings are offered at the cost of privacy and control over the user's own devices.' (MDM here means "Mobile Device Management.")
Credit where it's due: adding the definition of "MDM" at the end was a nice touch for those not already in the know.
Dewey, what part of this looks like authorities should be involved?
Man is Sprint retarded. SoftBank should have bought T-Mobil instead...
It's not their devices and they should not be installing software without the express permission of their owners.
Fight for your bitcoins!
When Sprint has policies in place that actually forbid that action without a customer request. Isn't it more likely you have an unethical tech who is looking for future access to phones?
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
Isn't it more likely you have an unethical tech who is looking for future access to phones?
Reading the article (yea, I know) it seems Sprint gave him several different reasons why it was installed. None of which included rogue technician.
On a side note, after using androids exclusively I was finally talked into getting an iphone when it was time to upgrade. So far I don't have any problems with the phone itself... but one BIG noticeable difference is every few weeks after using my new phone I get random calls from phone scammers/telemarketers. That's after I took the time to harden my phone as much as possible without jailbreaking it. Never once had this issue with the Andriod and the same friend who talked me into it finally mentioned that in the fine fine print apple blatantly says they sell your info to third parties which explains the calls.... so this will be the last apple product for me.
Every time I want to upgrade to a smart phone I think back to the 1990s when I didn't have a cell phone. Then about issues like this.
Having a tiny portable phone in my pocket: $20.
Not having to treat it like a crotchety piece of IT equipment: priceless.
"Did you not want to installed it? Let us know!"
Also - clearly he didn't fucking want it installed... Is it a new rule now that Customer Service just not read messages at all?
On your iPhone, go into Settings / General, select Profile, then look at the profiles that have been added. A stock iPhone has none. If you have an ISP who adds a cert that allows you to connect to their hotspots, you may see that here. If you have installed your company's MDM, perhaps a product like AirWatch, that will show up here. If you see something you don't recognize, that's when you need to do some research.
Inside the profile you can view the certs it installed. A WiFi cert will list what it can do: be wary if it includes a proxy.
John
The technician misheard the customer, the customer said " i do NOT want to be ass fucked". the tech didn't hear the NOT.
At what point was the technician handling his phone, and what was he doing with it?
Because if I go in for you to add me to your network, and you start installing shit on my phone ... I'm going become unreasonable quite fast.
I just can't quite figure out from the article how the technician came to be installing this in the first place; it was obviously in the middle of something else.
Surely he didn't walk into a Sprint store and hand the technician his phone, did he?
Lost at C:>. Found at C.
without prior notice or permission
I'm pretty sure it says they can do that in your contract. You remember your contract right? The one you signed to get service? What do you mean nobody reads those? You didn't read the contract you signed???
While I agree that pulling shenanigans like this is not something I want from the people who I hired to give me phone service, I'm willing to bet they are not acting outside the law.
Seven puppies were harmed during the making of this post.
So, how can I check my Sprint iPhone 6s for such software?
Sounds like a pretty straightforward case of Tresspass to chattels.
Time to hire a lawyer.
Sprint recently changed to a "iPhone forever" lease plan where you lease the phone for $5 per month, plus additional undisclosed add-ons that make it actually $10 per month. But, you're leasing the phone. You don't ever own it.
They still offer you the option of buying the phone outright for ~$700 and no subsidy, if you want to "avoid paying them" the monthly lease rate.
Apple add's NSA reporter at the baseband level anyways
I'm amazed every day I wake up and Sprint is still in business. It is a testament to the apathy of the average consumer.
I'm going to go ahead and throw up a red flag. I don't think this is a Sprint owned domain. I think it's meant to LOOK like one, but I don't think it IS one.
$ dig +short sprint.net ns
ns1-auth.sprintlink.net.
ns2-auth.sprintlink.net.
ns3-auth.sprintlink.net.
$ dig +short sprint.com ns
reston-ns1.telemail.net.
ns2-auth.sprintlink.net.
reston-ns3.telemail.net.
reston-ns2.telemail.net.
ns1-auth.sprintlink.net.
ns3-auth.sprintlink.net.
The places Sprint hosts their "well-known" domains looks remarkably like it's a legitimate place. "wabaw.net", however?
$ dig +short wabaw.net ns
ns6.domainmonger.com.
ns5.domainmonger.com.
ns7.domainmonger.com.
ns8.domainmonger.com.
I'm going to propose a theory that the WHOIS data shows Sprint so that - if someone gets caught and folks go looking for someone to vilify, Sprint is the unwitting victim. But - in reality - it's sitting in some domain-registration that nobody official at Sprint has ever heard of, and someone's been building a network of phones that they control via MDM.
Isn't it proper journalism practice to define acronyms on their first use, then continue on using the acronym through the remainder of the story?
Slashdot isn't journalism. Slashdot is a debate forum that is kinda sorta vaguely topical. Nobody comes to slashdot for breaking news. They come to debate things and occasionally be informed with a viewpoint they might not have considered previously.
You have a good point:
$ host leon.webaw.net
leon.webaw.net has address 62.99.250.53
$ whois 62.99.250.53 ... snip...
netname: Schneid-GmbH
descr:
descr: Schneid GmbH
descr: Herbert Schneid
descr: PIRKA
descr: IPs statically assigned
country: AT
maxmind corroborates the information.
So... Sprint are putting control of your phone into the hands of someone in Austria. Nice going, guys!
Sounds like buying your mobile device directly from the manufacturer, such as Apple, might be preferable to buying it from the service provider (albeit having to front the full cost of the device). I'll have to consider that if/when I upgrade from my 4S.
linquendum tondere
It doesn't matter whether it goes against Sprint's published policies - there is precisely nothing that you can viably do about this kind of situation these days thanks to arbitration clauses.
You can't sue. You certainly can't start a class action suit based on all the customers this was done to. You can elect to go to arbitration over it, however if the arbitrator rules against you you're likely going to have to pay for all of Sprint's costs related to the arbitration - including whatever price tag they put on their lawyers' (yes, plural) time for responding to the case. And of course, if you win, you can probably get them to uninstall the software or perhaps let you out of your contract with no termination fee.
fencepost
just a little off
Ppl who are Windows users, run as admin, and have their automatic updates "turned on" just wave their hands at this. Meh.
Considering the phone cannot escape the manufacturing company, what's the big deal?
There's a big MDM wrapped around the device to begin with. They can uninstall all the software they want, know what versions of software you have, forced so there's only one real browser engine, one store to get apps, one payment method only... etc. They've also proven they can add content (music) to your devices too without prior consent.
If you buy a device and you're okay with all of those previously used "MDM" permissions, who cares if there's another layer from a "big" and "trusted" company?