Author Topic: CarrierIQ - rootkit on your mobe (Read 1654 times)

andygates · « **on:** 30 November, 2011, 11:07:20 pm »

This ought to be big: there's a pre-installed rootkit on many smartphones that's recording your every click. Definitely on droids, probably on the rest.

http://gizmodo.com/5863849/your-android-phone-is-secretly-recording-everything-you-do

http://lifehacker.com/5863895/carrier-iq-how-the-widespread-rootkit-can-track-everything-on-your-phone-and-how-to-remove-it

The company's bumf says "we're not evil" but you can take that with a barrow of salt.

Cyanogenmod is clean. Might try installing that myself.

Charlotte · « **Reply #1 on:** 30 November, 2011, 11:14:41 pm »

Fuck. That's appalling

Frere · « **Reply #2 on:** 01 December, 2011, 01:26:27 am »

This is the guy who came across it and wrote up about it.

http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/

A law firm attempted a cease and desist.

https://www.eff.org/sites/default/files/eckhart_cease_desist_demand_redacted.pdf

Article on EFF's successful rebuff of the cease and desist.

http://informationweek.com/news/security/mobile/232200381

Appalling is an understatement.

Would point out that this CarrierIQ fiasco makes no mention of iPhones. It includes Symbian and Blackberrys. Makes RIMs claims of BB's 'inherent security' mendacious to say the least.

Frere

Rhys W · « **Reply #3 on:** 01 December, 2011, 09:21:58 am »

I bet there's a few Android geeks who smugly and loudly objected to Apple's apparent control-freak tendencies feeling a bit sheepish now...

One thing that puzzles me is that they think it's sneakily recording location data even when you appear to have turned it off - surely that would be noticeable in terms of battery drain?

David Martin · « **Reply #4 on:** 01 December, 2011, 10:19:02 am »

No sign of it on my HTC Desire - it could well be a US carrier thing.

Frere · « **Reply #5 on:** 01 December, 2011, 11:15:14 am »

Quote from: David Martin on 01 December, 2011, 10:19:02 am

No sign of it on my HTC Desire - it could well be a US carrier thing.

The point of root kits is that you don't know about it....

Frere

Manotea · « **Reply #6 on:** 01 December, 2011, 11:32:13 am »

Quote from: Rhys W on 01 December, 2011, 09:21:58 am

I bet there's a few Android geeks who smugly and loudly objected to Apple's apparent control-freak tendencies feeling a bit sheepish now...

One thing that puzzles me is that they think it's sneakily recording location data even when you appear to have turned it off - surely that would be noticeable in terms of battery drain?

Haven't you watched Terminator II, you know, that bit where Arnie gets thoroughly beaten up and shuts down.... until his backup systems locate an alternate power source... it probably works just like that.

mrcharly-YHT · « **Reply #7 on:** 01 December, 2011, 11:47:50 am »

Quote from: Rhys W on 01 December, 2011, 09:21:58 am

I bet there's a few Android geeks who smugly and loudly objected to Apple's apparent control-freak tendencies feeling a bit sheepish now...

Most Android 'geeks' root their phones and kill off all pre-installed sh!t. With good reason, it seems . . .

tiermat · « **Reply #8 on:** 01 December, 2011, 11:49:55 am »

This worried me.

So I had a search.

The assumption is that, because it is found on US carrier phones, it is on all carrier phones.....

Hence the past tense in the first line...

Rhys W · « **Reply #9 on:** 01 December, 2011, 12:34:24 pm »

Quote from: mrcharly on 01 December, 2011, 11:47:50 am

Quote from: Rhys W on 01 December, 2011, 09:21:58 am
I bet there's a few Android geeks who smugly and loudly objected to Apple's apparent control-freak tendencies feeling a bit sheepish now...

Most Android 'geeks' root their phones and kill off all pre-installed sh!t. With good reason, it seems . . .

Looks like they missed that particular bit of "pre-installed sh!t" - srlsy though, with the amount of jailbreaking and hacking that goes on, I'm surprised its taken so long to find it.

andygates · « **Reply #10 on:** 01 December, 2011, 12:34:26 pm »

We have yet to hear that it isn't on UK phones too. I've asked Giffgaff, not heard back yet, and O2 may be doing it without reseller knowledge.

Unlike the Jesus phone, android users *can* wrestle through a ROM change.

vorsprung · « **Reply #11 on:** 01 December, 2011, 12:39:18 pm »

Quote from: David Martin on 01 December, 2011, 10:19:02 am

No sign of it on my HTC Desire - it could well be a US carrier thing.

I followed the instructions on the video for looking for HTC Carrier IQ on my HTC Wildfire running 2.2.1
It doesn't seem to be there

I am a low powered Android developer and I don't see any trace in a debug attach either

Biggsy · « **Reply #12 on:** 01 December, 2011, 12:40:22 pm »

Quote from: mrcharly on 01 December, 2011, 11:47:50 am

Most Android 'geeks' root their phones and kill off all pre-installed sh!t. With good reason, it seems . . .

Except this particular piece of sh!t can't be completely removed, apparently.

Biggsy · « **Reply #13 on:** 01 December, 2011, 12:42:34 pm »

Is there any chance of this being a hoax?

The guy's tone of voice sounds sincere, but I don't really have a good reason to believe it ...or disbelieve it, for that matter. I don't understand the technicals, at this level.

Frere · « **Reply #14 on:** 01 December, 2011, 12:47:22 pm »

The full extent of exactly what this CarrierIQ root kit does and its implementation is still being worked through, but the very fact that it is there should be making Droid, Symbian and RIM users extremely wary.

Frere

tiermat · « **Reply #15 on:** 01 December, 2011, 12:49:59 pm »

There is always the possibility of it being FUD spread by Apple fanboys.

tom_e · « **Reply #16 on:** 01 December, 2011, 12:59:31 pm »

The native libraries don't appear to be there on my phone. And nowhere I can see on t'internet claims it is actually trying to hide those files.

(HTC Wildfire S on Tesco/O2)

DrMekon · « **Reply #17 on:** 01 December, 2011, 01:00:36 pm »

Quote from: David Martin on 01 December, 2011, 10:19:02 am

No sign of it on my HTC Desire - it could well be a US carrier thing.

Just did the applications check described on the video hosted on Lifehacker, and it doesn't appear to be on my 3 HTC Desire HD.

Still tempted by Cyanogenmod tho'. Just waiting for them to do an IceCreamSandwich build, and then I won't be able to resist, as I can't see HTC doing one for the Desire range.

tom_e · « **Reply #18 on:** 01 December, 2011, 01:04:54 pm »

That's not at all because the ICE CREAM bit appeals to your tastes, Dr?

Frere · « **Reply #19 on:** 01 December, 2011, 01:08:40 pm »

An Apple ~~fanboi~~ user is posting this link:-

http://www.theverge.com/2011/11/30/2601875/carrier-iq-references-discovered-apple-ios-iphone

Good news that if this is correct, no information is sent if the diagnosics is turned off, which is the default anyway, and such information is much more limited.

Frere

pcolbeck · « **Reply #20 on:** 01 December, 2011, 01:59:37 pm »

Quote from: Biggsy on 01 December, 2011, 12:42:34 pm

Is there any chance of this being a hoax?

The guy's tone of voice sounds sincere, but I don't really have a good reason to believe it ...or disbelieve it, for that matter. I don't understand the technicals, at this level.

Not a hoax the company that makes the software has admitted it's there.

tonycollinet · « **Reply #21 on:** 01 December, 2011, 09:22:11 pm »

European networks are denying use of the software:

http://www.guardian.co.uk/technology/2011/dec/01/carrier-iq-uk-mobile-networks?newsfeed=true

Rhys W · « **Reply #22 on:** 01 December, 2011, 10:27:15 pm »

Seems like it's been in Apple's iOS all along, but is only made active by checking a diagnostic mode. I've always had mine off, mainly because I hardly ever experience any problems with my iPhone (I often send reports back to Apple when an app on my iMac crashes) but also because I prefer to have the choice - if I do experience some problems that need diagnosing, then I'll enable it. Apple seem to be distancing themselves from the company now, even though they only used them for diagnostic reports and not anything like keylogging.

I've got a relaxed attitude towards these kinds of things by now. We're all carrying around a powerful Unix computer with GPS after all.

DrMekon · « **Reply #23 on:** 01 December, 2011, 11:37:21 pm »

Quote from: tom_e on 01 December, 2011, 01:04:54 pm

That's not at all because the ICE CREAM bit appeals to your tastes, Dr?

I guess, 'cos quite honestly, I barely noticed upgrading from Froyo to Gingerbread.

I'm waiting for my colleague to flash his phone with cyanogen mod before I do, and in that Sense is really buggering up his Desire Z, I shouldn't have long to wait.

Frere · « **Reply #24 on:** 02 December, 2011, 01:56:48 am »

This Apple ~~fanboy~~ user is posting another link to a statement by Apple, which is quoted below.

Quote

“We stopped supporting Carrier IQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.”

Source: http://allthingsd.com/20111201/apple-we-stopped-supporting-carrieriq-with-ios-5/

Kudos to Apple for taking quick action on this matter. Here's to the powerful pocket UNIX computer.

Frere