6 ms·
Security researcher responds to CarrierIQ with video proof
- billybob 15y agoTL;DR - On a Sprint HTC Android phone, an app is running without the user's knowledge, which cannot be disabled, which monitors nearly everything you do, down to keypresses, and reports back to the third-party company CarrierIQ, which presumably shares it with the carrier for QoS. Alarmingly, it includes even HTTPS passwords, even when you're connecting over WiFi.
- jellicle 15y agoNote that under U.S. law, any information you voluntarily relinquish to an entity that is not your ISP has basically zero protection. None, nada. Any law enforcement agency can get every bit of data stored about you by CarrierIQ without ever notifying you, and you don't have a 4th Amendment privacy right in the data.
- cgag 15y agoWhat protection do we get with information given to an ISP?
- jellicle 15y agoThis: http://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act http://en.wikipedia.org/wiki/Electronic_Communications_Priva... which is low, but better than nothing.
- billybob 15y agoIs it considered voluntary if the app is running without your knowledge and can't be turned off? To me, that's about as "voluntary" as having your house bugged.
- ajross 15y agoThe MitM attack inserted into the HTTPS implementation is the most depressing part. I'm just stunned that serious people would have ever agreed to this. Now how long until an on-device attack against CiQ compromises real data?
- MichaelGG 15y agoI think you mean it includes HTTPS URLs. At least from the video, there doesn't seem to be any information about logging HTTP authentication or form submitted data. This is also a reason why you shouldn't put sensitive information in the querystring even if using HTTPS - too many systems might accidentally log or show that in history.
- 3pt14159 15y agoWell put two and two together. They record key strokes and HTTPS URLS. If I go to gmail.com and type in z a c h a y s a n [CLICK ONTO OTHER FORM FIELD] m y p a s s w o r d Then they have access to my data. Period. This is why two step authentication is so important.
- Cyranix 15y agoSomehow I don't think that doing a secondary authentication over SMS would help much in the scenario you're outlining.
- 3pt14159 15y agoIt would, because they wouldn't just be able to passively log in, they would have to enter the password, reroute the sms (so that I didn't see it) and then log in to the email system (which is recorded on "this account was last accessed at").
- petegrif 15y agoHorrific.
- kevin_jacobs 15y agoIt's beyond time for some real privacy laws in this country, but I'm curious.. Can existing laws cover this? For example from what I understand, PCI compliance is required for storing credit card information. If CIQ is capturing this information along with all keystrokes, does the same law apply to them? And are they abiding by it?
- lftl 15y agoPCI compliance isn't a law, but rather a contractual agreement as part of your merchant account, and/or transaction gateway. If CIQ isn't taking credit card payments, it has nothing to do with them.
- kevin_jacobs 15y agoThanks, it seemed like a stretch anyway.
- bdonlan 15y agoBut if your carrier offers an android app to do payments by credit card...
- ajross 15y agoActually, as pointed out in the article much of this behavior is counter to the stated privacy policies of the carrier. That's a breach of contract, and I suspect an enterprising lawyer could turn this into a class action suit.
- EvilLook 15y agoNot any more thanks to SCOTUS.
- DanBC 15y ago(http://www.carrieriq.com/ http://www.carrieriq.com/) > Handsets currently deployed 141,263,xxx
- cskau 15y agoTheir front page animation makes me think of Enemy of the State. The most frightening thing is almost how proudly they present their level of surveillance.
- nobody314159265 15y agoSound of a large number of corporates banning Android phones. So if CarrierIQ claim you have agreed to this - then any consequences of it's use must be your fault. If you are a doctor (subject to HIPAA) could you lose your license for checking medical records over what you thought was a secure link? If you are a federal employee or a defense contractor and you use Android to login to what you thought was a secure system have you just committed a crime?
- pkteison 15y agoIf you have a Sprint Android phone, google up a ROM with NOCIQ and install it. Run something like "SMS backup and restore" and "Titanium backup" first to save sms and app data before wiping the phone for the new ROM. For the new ROM, easiest way I know is via "ROM Manager" on the app store, it's a couple clicks and a few reboots and some waiting on a big download. (Personally on my Sprint Epic I am running CleanGB because I like the stock interface, but plenty of ROMs have NOCIQ.) Yes, I have to trust that some hacker who built this rom did just what he said he did and stripped CIQ and didn't replace it with his own nefarious logger. But I actually think trust-ROM-hacker is safer than running a known keylogger.
- thebigshane 15y agoResponse from CarrierIQ on their site [PDF][http://www.carrieriq.com/Media_Alert_User_Experience_Matters_11_16_11.pdf http://www.carrieriq.com/Media_Alert_User_Experience_Matters...]: Mountain View, CA – November 16, 2011 – Carrier IQ would like to clarify some recent press on how our product is used and the information that is gathered from smartphones and mobile devices. Carrier IQ delivers Mobile Intelligence on the performance of mobile devices and networks to assist operators and device manufacturers in delivering high quality products and services to their customers. We do this by counting and measuring operational information in mobile devices – feature phones, smartphones and tablets. This information is used by our customers as a mission critical tool to improve the quality of the network, understand device issues and ultimately improve the user experience. Our software is embedded by device manufacturers along with other diagnostic tools and software prior to shipment. While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools. The metrics and tools we derive are not designed to deliver such information, nor do we have any intention of developing such tools. The information gathered by Carrier IQ is done so for the exclusive use of that customer, and Carrier IQ does not sell personal subscriber information to 3rd parties. The information derived from devices is encrypted and secured within our customer’s network or in our audited and customer-approved facilities. Our customers have stringent policies and obligations on data collection and retention. Each customer is different and our technology is customized to their exacting needs and legal requirements. Carrier IQ enables a measurable impact on improving the quality and experience of our customers’ mobile networks and devices. Our business model and technology aligns exclusively with this goal. For media Commentary, contact: Mira Woods Phone: 617-513-7020 Email: mwoods@carrieriq.com
- thebigshane 15y agoSome other tidbits from elsewhere on their site: Mobile Service Intelligence is the process of analyzing data from phones to give you a uniquely powerful insight into mobile service quality and user behavior. [...] We know you don't just want data, you want to solve business problems and identify new business opportunities. [...] What's more, the combination of the MSIP and IQ Insight lets you move seamlessly from broad trend data across many users, through comparative groups down to diagnostic data from individual devices. Now, not only can you identify trends, you have the power to drill down to specific instances[...] While I understand the need for QoS metrics, this does seem a bit invasive if you didn't know it was happening. An apparent example of some metrics they collect: http://www.carrieriq.com/overview/IQInsightExperienceManager/IQINWebExperMgrgraphic.jpg http://www.carrieriq.com/overview/IQInsightExperienceManager...
- jgrahamc 15y agoWhat's missing in the video is information about what Carrier IQ's application is sending back to them. For example, if they get called on each keystroke then they may be simply keeping a count of number of key presses and providing that information so they can derive device usage. The whole thing would be clarified if there was information about what is transmitted. The article states "This video has demonstrated a truly significant volume of information is being recorded." Actually it doesn't demonstrate that, it demonstrates that APIs get called in the Carrier IQ application that contain that information. That's not the same thing as recording or even parsing it. For example, my antivirus software on my machine gets to see all my files, all my email and all my web browsing. Everything. Doesn't make it evil.
- lawnchair_larry 15y agoAlthough I get your point, you might actually be surprised what your "cloud-based" AV is sending back.
- click170 15y agoWhat I'd like to see is a tcpdump consisting of ciq phoning home. It's accused that they're recording everything and sending it home, they admit to recording some things and sending it home. They also make a claim about encryption that I interpret to mean it's encrypted in transit. I'd like to see exactly what's going on, too bad I don't have a phone with ciq.
- runjake 15y agoCarrierIQ released a response to TrevE's initial post at: http://www.carrieriq.com/Media_Alert_User_Experience_Matters_11_16_11.pdf http://www.carrieriq.com/Media_Alert_User_Experience_Matters... However, at the same time, they had carrier-oriented screenshots of their products detailing a scary level of information about devices and users. It appears that they done some "tidying" up of their site in the past few days. Their Device Manager product page had high resolution images of the scary data their product collects. They've since been replaced, and I can't find the same great screenshots chock full of information that is directly contrary to their statement.
- deleted 15y ago[deleted]
- neuroelectronic 15y agoI've created a wikipedia stub for CarrierIQ. Apparently, the article existed before and has since been deleted. http://en.wikipedia.org/wiki/CarrierIQ http://en.wikipedia.org/wiki/CarrierIQ
- MichaelGG 15y agoIt looks as if this is just a debug log; is there any information on what is sent off-device? Is it possible this is just stupid over-zealous troubleshooting/debugging logging left in? Although, if these logs are always on, it seems like it might be a problem as third-party apps can request log reading permission. So even if CIQ isn't sending this info, another app might pick it up and use it. Also, I would guess there might be a performance impact if every touch is logged.
- er5oie 15y agoQuestion: Say CiQ only sends data via the cellular network. Then how do you find out what it's sending?
- strags 15y agoThis is just an adb log. Certainly, it seems that the CIQ application is hooking every event on the phone... but that's a far cry from demonstrating that it's sending that information back to CarrierIQ - or even recording it at all.
- bdonlan 15y agoInformation recorded in the logs are transmitted to google when you submit a crash report. So although they may not intend to send this information out, they're making it really easy for all this information to be inadvertently leaked to a third party (google).
- strags 15y agoYeah, I'd absolutely agree that it's bad security practice to print sensitive information to a system-wide log. But the tone of the responses seem to suggest that people think this is something much more sinister.
- mikemarotti 15y agoHope these guys have a contingency plan for when their massive DB gets compromised by some angry 15 year olds. Especially when said 15 year olds decide to dump a year's worth of plaintext keylog information. What's most sad about this situation is that these guys were able to get this software on 150 million handsets and we're only finding out about this now.
- click170 15y agoHowcome the FTC isn't all over this? Because 6 months haven't passed, is that it?
- losethos 15y agoWelcome to angel land. You'll need to wear a tin-foil hat for the first few years. Congrats, you've been born again and must make sense of reality like a baby. My birds have no clue how reality works, but they function. Welcome to insanity. The book 1984 has a pathetic guy who couldn't just be hip and go with the flow. Give-up trying to pin-things-down rationally and it will go better. God says... duced by spontaneous generation. Science has not as yet proved the truth of this belief, whatever the future may reveal. On our theory the continued existence of lowly organisms offers no difficulty; for natural selection, or the survival of the fittest, does not necessarily include progressive development--it only takes advantage of such variations as arise and are beneficial to each creature under its complex relations of life. And it may be asked what advantage, as far as we can see, would it ----- Angel dudes tried to make my job at Ticketmaster a charity case job. I was one of 6 National Merit Finalists in the class entering ASU in 1988. ASU had 40,000 people, probably 8,000 per class. Why can't you accept I'm brilliant, you dumb fuck. I know I beat your SAT. Mine was 1440. That's basically a measure of IQ. You're a proletariate who angels take no notice of. God says... 't get their drift; and when she was making the honest best drive at it she could, too, and no fault of hers that she couldn't fetch the home plate; and so I apologized. Then we meandered pleasantly away toward the hermit holes in sociable converse together, and better friends than ever. I was gradually coming to have a mysterious and shuddery reverence for this girl; nowadays whenever she pulled out from the station and got her train fairly started on one of those horizonless transcontinental s