10 ms·

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter

by EwanToo 15y ago

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.

drivebyacct2 15y ago
Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, especially since it seems like makers of this type of software have piss-poor track records for their app security)
- yellowbkpk 15y ago
  Logging to logcat does not mean it's sending those keystrokes anywhere on the internet. Logcat is the local system log and doesn't necessarily get sent anywhere but to a ring buffer on the device.
- recoiledsnake 15y ago
  Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.
  - Fliko 15y ago
    It's still pretty dangerous even if it doesn't send keystrokes.
    - recoiledsnake 15y ago
      No one is disputing that. But it's wrong to claim that there is clear evidence that keystrokes are being sent just because they're being logged.
  - AJ007 15y ago
    There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?
    - recoiledsnake 15y ago
      If someone implies that there is proof that the perpetrator picked up the tape when there is no such evidence, are they right?
    - sycren 15y ago
      How did the perpetrator plant such a device in the first place? Did he have permission? If not, perhaps a different crime was committed.
      - seanp2k2 15y ago
        To use a situation analogous to the situation with CarrierIQ, he did not have permission and you never even knew he was there or that the camera was there. However, the camera is digital, it is connected to your power outlet with a battery-backed UPS, and it has an active wireless modem attached to it. Maybe he did send data, maybe he didn't. But he's also sent you a CnD notice and threatening to sue you if you tell anyone.
        sycren 15y ago
        I am a bit lost at all the down votes but he was recording data that breaches privacy acts. If he did send such data without permission it is a rootkit and can be unlawful (data protection act, uk). Because everyone has collectively found out about this at the same time a CnD would not work.
    - tptacek 15y ago
      By that logic we should all be very angry at our TTY drivers.
      - burgerbrain 15y ago
  - billybob 15y ago
    What useful metric would keystrokes be part of? "Users tend to press the T key a lot..."
    - mog_man 15y ago
      they can keep track of everything that you type, credit card info, wifi passwords, other passwords, sexting... so i guess nothing important, eh?
    - tedunangst 15y ago
      I would love it if somebody noticed that I hit the "return, backspace, space" combo over and over and made the return key slightly smaller.
- artursapek 15y ago
  Right, the argument is logged keystrokes never leave your phone because that amount of data from each Android/Blackberry phone would be a lot more thn 10 GB a day. I agree though, why are they logging it at all if the app isn't sending it to them? Very suspicious.
  - jff 15y ago
    You, uh... you can enter 10 GB of text on your phone per day? I think maybe if you recorded all of the touch events, you'd end up with many megabytes worth, but I doubt the average user will enter more than a few kilobytes worth of text in a day.
    - artursapek 15y ago
      That's a figure for all phones, not each phone. Read EwanToo's comment towards the top.
      - samstave 15y ago
        Text can be significantly compressed.
        artursapek 15y ago
        Yes I know. Unless the app sorts out valuable information from noise (passwords, account numbers, etc), I think this conspiracy theory is invalid.
    - therec 15y ago
      I agree with you they will very easily record all the touch events. If you were typing 10 characters per second (which already seems like quite a lot) after 24h you will not even have a megabyte of information. Just over a megabyte if you encode the character in Unicode. ;-) This is without even take into account that this information can be heavily compressed for the transfert.
    - EwanToo 15y ago
- click170 15y ago
  When you can show me a tcpdump of your password being sent to CarrierIQ I will believe they are capturing your password. All I've seen proof of so far is that it is capable of doing so because of how it is called before everything for anything, but let's not jump to conclusions here.
- pasbesoin 15y ago
  And, as been pointed out repeatedly in discussions about the "security" domain, when you add an ability, you inherently add a vector for that ability to be abused. Even if "raw data" are not currently being uploaded, how thin is the line between this being turned off and it being turned on? And who is in control of that decision? At an absolute minimum, the situation demands transparency. As for me, I'm a step closer to being firmly in Stallman's camp.
- EwanToo 15y ago
  Adb logcat showing the usb debugging output isn't really the same as storing on a file or uploading to a remote server, is it? They're obviously doing bad stuff, but I see no evidence of uploading your keystrokes
  - mrb 15y ago
    Neither drivebyacct2 nor the video claims the data is stored. Carrier IQ is collecting keystroke data, which you said they were not doing. The video clearly shows, when the user presses the "1" key: com.htc.android.iqagent.action.ui01 actionUI01:49,0 where 49 is the keycode for the "1" key. This means the Carrier IQ code is called to collect and process this event information. We just don't know what the code is doing with this information. Perhaps it is simply updating statistics and discarding it. So I guess your argument with drivebyacct2 is on the definition of "collecting"...
jsz0 15y ago
People aren't writing novels on their SmartPhones. The typed input from a normal volume of text messages, e-mails, and URLs is actually pretty minute when you think about it. Certainly it would be compressed before being uploaded to their servers. IIRC they cite 140 million active devices so if you figure 3kB per day, which is probably on the high side, that's only 400GB before compression. You can compress text down by about 90% these days. That works out to only 44GB of data uploaded per day.

by EwanToo 15y ago

drivebyacct2 15y ago

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, especially since it seems like makers of this type of software have piss-poor track records for their app security)

yellowbkpk 15y ago
Logging to logcat does not mean it's sending those keystrokes anywhere on the internet. Logcat is the local system log and doesn't necessarily get sent anywhere but to a ring buffer on the device.
recoiledsnake 15y ago
Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.
- Fliko 15y ago
  It's still pretty dangerous even if it doesn't send keystrokes.
  - recoiledsnake 15y ago
    No one is disputing that. But it's wrong to claim that there is clear evidence that keystrokes are being sent just because they're being logged.
- AJ007 15y ago
  There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?
  - recoiledsnake 15y ago
    If someone implies that there is proof that the perpetrator picked up the tape when there is no such evidence, are they right?
  - sycren 15y ago
    How did the perpetrator plant such a device in the first place? Did he have permission? If not, perhaps a different crime was committed.
    - seanp2k2 15y ago
      To use a situation analogous to the situation with CarrierIQ, he did not have permission and you never even knew he was there or that the camera was there. However, the camera is digital, it is connected to your power outlet with a battery-backed UPS, and it has an active wireless modem attached to it. Maybe he did send data, maybe he didn't. But he's also sent you a CnD notice and threatening to sue you if you tell anyone.
      - sycren 15y ago
        I am a bit lost at all the down votes but he was recording data that breaches privacy acts. If he did send such data without permission it is a rootkit and can be unlawful (data protection act, uk). Because everyone has collectively found out about this at the same time a CnD would not work.
  - tptacek 15y ago
    By that logic we should all be very angry at our TTY drivers.
    - burgerbrain 15y ago
- billybob 15y ago
  What useful metric would keystrokes be part of? "Users tend to press the T key a lot..."
  - mog_man 15y ago
    they can keep track of everything that you type, credit card info, wifi passwords, other passwords, sexting... so i guess nothing important, eh?
  - tedunangst 15y ago
    I would love it if somebody noticed that I hit the "return, backspace, space" combo over and over and made the return key slightly smaller.
artursapek 15y ago
Right, the argument is logged keystrokes never leave your phone because that amount of data from each Android/Blackberry phone would be a lot more thn 10 GB a day. I agree though, why are they logging it at all if the app isn't sending it to them? Very suspicious.
- jff 15y ago
  You, uh... you can enter 10 GB of text on your phone per day? I think maybe if you recorded all of the touch events, you'd end up with many megabytes worth, but I doubt the average user will enter more than a few kilobytes worth of text in a day.
  - artursapek 15y ago
    That's a figure for all phones, not each phone. Read EwanToo's comment towards the top.
    - samstave 15y ago
      Text can be significantly compressed.
      - artursapek 15y ago
        Yes I know. Unless the app sorts out valuable information from noise (passwords, account numbers, etc), I think this conspiracy theory is invalid.
  - therec 15y ago
    I agree with you they will very easily record all the touch events. If you were typing 10 characters per second (which already seems like quite a lot) after 24h you will not even have a megabyte of information. Just over a megabyte if you encode the character in Unicode. ;-) This is without even take into account that this information can be heavily compressed for the transfert.
  - EwanToo 15y ago
click170 15y ago
When you can show me a tcpdump of your password being sent to CarrierIQ I will believe they are capturing your password. All I've seen proof of so far is that it is capable of doing so because of how it is called before everything for anything, but let's not jump to conclusions here.
pasbesoin 15y ago
And, as been pointed out repeatedly in discussions about the "security" domain, when you add an ability, you inherently add a vector for that ability to be abused. Even if "raw data" are not currently being uploaded, how thin is the line between this being turned off and it being turned on? And who is in control of that decision? At an absolute minimum, the situation demands transparency. As for me, I'm a step closer to being firmly in Stallman's camp.
EwanToo 15y ago
Adb logcat showing the usb debugging output isn't really the same as storing on a file or uploading to a remote server, is it? They're obviously doing bad stuff, but I see no evidence of uploading your keystrokes
- mrb 15y ago
  Neither drivebyacct2 nor the video claims the data is stored. Carrier IQ is collecting keystroke data, which you said they were not doing. The video clearly shows, when the user presses the "1" key: com.htc.android.iqagent.action.ui01 actionUI01:49,0 where 49 is the keycode for the "1" key. This means the Carrier IQ code is called to collect and process this event information. We just don't know what the code is doing with this information. Perhaps it is simply updating statistics and discarding it. So I guess your argument with drivebyacct2 is on the definition of "collecting"...

jsz0 15y ago

People aren't writing novels on their SmartPhones. The typed input from a normal volume of text messages, e-mails, and URLs is actually pretty minute when you think about it. Certainly it would be compressed before being uploaded to their servers. IIRC they cite 140 million active devices so if you figure 3kB per day, which is probably on the high side, that's only 400GB before compression. You can compress text down by about 90% these days. That works out to only 44GB of data uploaded per day.