8 ms·
Apple: We Don’t Use Carrier IQ… In Most Of Our Products… Anymore.
- nirvana 15y agoI think what's really remarkable about this is that Apple issued a statement seemingly less than 24 hours after it became an issue. In the past, Apple has tended to wait a week or so before issuing statements, resulting in a lot of criticism and the issues sometimes steamrolling simply due to the fact that the charges aren't answered. I'm not at all surprised that Apple isn't violating users privacy.
- bigiain 15y agoI'm pretty sure Apple's "wait a week" clock began ticking when the initial flurry of reports about CarrierIQ on Android started circulating, not yesterday...
- st3fan 15y agoWhere 'wait a week' probably is: some high level manager or vp asks people to investigate this to get all the details before putting out any statements.
- gamble 15y agoApple's delays in PR announcements normally seem like they're the result of not wanting to say anything until they have something substantive to say. They're really not big on "we know it's a problem, hang tight..." announcements. In this case they're coincidentally a bit ahead of the ball, so there's no need to wait and formulate a plan.
- franksalim 15y agoI'm surprised the author didn't jump on this sentence: "With any diagnostic data sent to Apple, customers must actively opt-in to share this information..." As I understand it, Carrier IQ is about sending data to carriers. Apple only denied that data was silently sent to Apple. That's completely different than saying no data has been transmitted at all.
- Karunamon 15y agoWasn't one of the iPhone jailbreak devs quoted on twitter last night as saying that CIQ is only enabled (at all) if you enable diagnostic logging?
- ajross 15y agoAt the risk of driving an accusation of conspiracy theory, I'm reading that sentence exactly the same way. This is a "non-denial denial". They're denying something not alleged in the hopes that it distracts or confuses people about the real issue.
- doe88 15y agoI think, it would be a major issue if it was later revealed they deliberately misled the public with this sentence. I think the more logical interpretation is that if they (Apple) don't receive any data then no other party receive any data.
- conradev 15y agoWhile that is a good observation, it has been proven that no statistical data is sent to CarrierIQ when the preference is disabled. This has been determined by reverse engineering the daemons used for CarrierIQ reporting on various iOS versions. This has more information: http://blog.chpwn.com/post/13572216737 http://blog.chpwn.com/post/13572216737
- AllenKids 15y agoI'm sorry but upon Chpwn's investigation, didn't iOS version of the Carrier IQ software only record a few items such as your phone number, your country, your active phone calls and location data if activated? Any of which your carrier would already know anyway?
- GHFigs 15y agoFrom the description of "Diagnostics & Usage" reporting on the device itself, it sounds as though the carriers can only obtain that data via Apple. This would reconcile that wording with the finding that selecting "Don't Send" appears to disable Carrier IQ logging as well. [..] To help Apple’s partners and third-party developers improve their apps, products and services designed for use with Apple products, Apple may provide such partners or developers with a subset of diagnostic information that is relevant to that partner’s or developer’s app, product or service, as long as the diagnostic information is aggregated or in a form that does not personally identify you. http://daringfireball.net/misc/2011/12/ios-5-diagnostics-privacy-policy.text http://daringfireball.net/misc/2011/12/ios-5-diagnostics-pri...
- deleted 15y ago[deleted]
- funkah 15y agoAn earlier report said Carrier IQ was definitely in iOS 5, and perhaps earlier versions. So, which is it? Either way, ugh. Bad Apple.
- rajpaul 15y agoApple's statement confirms that it is still in some iOS 5 products.
- mvelie 15y agoIt's still on the iPhone 4
- ugh 15y agoFirst sentence: “We stopped supporting CarrierIQ with iOS 5 in most of our products and will remove it completely in a future software update.” That doesn’t contradict what you are saying at all.
- viscanti 15y agoYou're missing the point. Carrier IQ enables several different levels of functionality. It can allow anonymous usage tracking (like what Apple allows you to opt-in to), or it can log every keystroke. Apple hasn't ever had the key-logging installed. They're guilty of using a product that others used poorly. There's a big difference between asking users to opt-in to anonymous tracking and key logging; equating the two is a gross exaggeration. Apple acknowledges that some references to Carrier IQ are still in iOS 5, but the limited functionality has been completely disabled. The next step is to remove all the deactivated references. Doesn't seem to be anything inconsistent with their statements there.
- ugh 15y agoIf Carrier IQ on iOS only collects information about calls and location data during those calls and if it is turned off by default and if Apple is explicit about the data they collect† then there is no problem. It seems obvious to me that carriers or manufacturers can collect that data if the user explicitly agrees to it (by actually flipping a switch without being forced or tricked into doing so). Carrier IQ is only a problem if it is turned on by default and if it collects more data than is explicitly said∆. — † If the Diagnostics & Usage switch indeed controls Carrier IQ then we already know that the last two conditions are met. ∆ This is only the minimum viable evilness. Worse kinds of evil are imaginable, like not telling users anywhere that data is being or collected or making it hard for users to turn the collection of data off.
- pyre 15y ago> Carrier IQ is only a problem if it is turned on The problem being that having it installed is just another attack vector that houses potential vulnerabilities on your device.
- Anechoic 15y agoWouldn't the same be true of any diagnostic software?
- stuartd 15y agoThe same is true of any software, firmware, or indeed operating system, and probably a lot of hardware as well. Security By Tedium, I like to call it.
- Xuzz 15y agoI disassembled the iOS version of Carrier IQ, and it exits on startup if not enabled. Even when enabled, it runs as an unprivileged user and connects via SSL so should not be any "attack vector".
- robterrell 15y ago
- deleted 15y ago[deleted]
- nomdeplume 15y agodo I detect some Apple employees/shareholders in here? I think the (CIQ)video made pretty clear the fact that YOU CANT TURN IT OFF and that THERE IS NO OPT IN/OUT button because you would have to be digging around like a technophile to find it in the first place. I would not be at all surprised if Apple uses something like this. Wireshark anyone?
- runjake 15y agoThe CIQ video was of the Android software. Initial analysis of the iOS version of the CIQ software indicates it isn't nearly as intrusive as the Android version. And from all indications (the researcher vs. what Apple states) is that you can explicitly turn it off.
- diab0lic 15y agoDo you have a link to the video of CIQ on an Apple product where it cannot be disabled or opted out of? Or are you citing a video covering an Android phone and incorrectly drawing conclusions about an Apple product?
- evan_ 15y ago> Wireshark anyone? You're anyone, why don't you do it?
- nomdeplume 15y agoAll it would take is someone who knows what they are doing to go check real quick. report back whether or not the phone is throwing out information or not.
- dabeeeenster 15y agoHas anyone actually found evidence of Carrier IQ software ACTUALLY STORING personal data such as key-presses on Android or iOS? All I have seen is log events being generated from adb logcat, which is not the same thing, by any means.
- zmmmmm 15y agoThe log itself is at least temporarily persistent, so you can argue the mere existence of the logcat info is 'storage'. The issue then being that such logs could be read by third party apps, representing a security risk.
- bad_user 15y agoDoes it really matter? Why on earth would they be doing keylogging? What data can they get that doesn't violate my privacy? If they aren't using that data, then why the fuck is that code there tracking the keys pressed?
- pilsetnieks 15y agoOstensibly, they are looking at keystrokes to see if a particular key sequence is pressed while talking to customer support, thus indicating that it should send the diagnostics data to the operator. Ostensibly.
- idspispopd 15y agoCarrierIQ itself isn't the problem, it's a diagnostic device with legitimate functionality for mobile devices(we want our service to get better, this requires certain aspects of reporting.) The problem stems from CarrierIQ being implemented poorly, and reporting information which is not reasonable for diagnostic uses or privacy reasons. As such I feel like this is being blown out of proportion, Apple's use of carrier IQ has never been anything to worry about. A user can optionally choose to participate. (I.e it's not an opt-out scenario) and the information it sends is benign and not personally identifiable. The issue has been that some vendors have been adding full-capability CarrierIQ to android handsets which then have been shown to be reporting more than what can be considered reasonable, including allegations of key logging. This is obviously wrong and should be corrected. (Or simply removed.)
- zmmmmm 15y ago> have been shown to be reporting more than what can be considered reasonable Funny how you first lament that the issue is being blown out of proportion wrt Apple and then blow it out of proportion yourself. Nobody has shown what data is being reported or indeed, evidence that any data is being reported at all. They primary issue at this point seems to be that the temporary local logging of the data represents a security risk on these devices even if it is never reported.
- MatthewPhillips 15y agoI disagree that logging non-exceptions is ever acceptable in production with consumer products.
- OoTheNigerian 15y agoI am still wondering why I was down voted into oblivion for suggesting carrier IQ is not supposed to be the main party to be angry with http://news.ycombinator.com/item?id=3298924 http://news.ycombinator.com/item?id=3298924 Can someone please explain why the rage is not directed at phone manufacturers who asked for, and put this software in the phones they sold to customers?
- karolist 15y agoPeople rarely want to admit they were wrong. They were wrong to choose the manufacturer or carrier when they bought the phone with this. But they didn't choose the spyware/analytics software vendor, therefore they're not wrong and you're not attacking their intelligence and choice making by putting the blame on Carrier IQ. People gave up their privacy on the web (hey, you don't get mad at Google for sites having Google Analytics tracking code all over the web do you), now it'll slowly transfer to other platforms.
- somebear 15y ago> Can someone please explain why the rage is not directed at phone manufacturers [...] Because every single statement from phone manufacturers have indicated that it was the carriers that demanded this be put on the handsets (or did it themselves in cases of operator modifications). The only carrier I've heard say very clearly that they are not using Carrier IQ is Verizon.
- OoTheNigerian 15y agoBecause every single statement from phone manufacturers have indicated that it was the carriers that demanded this be put on the handsets Aww. Poor vulnerable and naive billion dollar phone manufacturers! </sarcasm> How does that exonerate the phone manufacturers? At the very least they should have disclosed this to the people they sold phones to. Even at that why is the rage not directed at the carriers? In addition, I doubt the carriers can make such modifications without the active participation of the phone manufacturers.
- lukeschlather 15y ago
- tvon 15y agoThe press release seems pretty clear to me, what's with the headline?
- rewiter2011 15y agohaha! must be hard to realise for some ppl that not only the gov is spying on them, but almost everyone else too. and you've paid thousands of dollars for this feature!
- munin 15y agoif you paid hundreds of dollars for a device, and you pay a 50-60 dollar a month contract ... you still may be the product..?
- josefresco 15y agoNo evidence yet that this information is being sold to third parties, or even used internally for sales purposes. Although the latter would be pretty obvious and not surprising (to me at least). Is there something buried in the TOS that alludes that they may do this?
- 101001010101 15y agoAll due respect, Apple should not need to use CarrierIQ. They are a hardware company that sells the hardware it makes direct to consumer. They are perfectly positioned and quite capable of writing their own "rootkits". Of course, when they do everything possible to prevent you from "rooting" the phone you purchase from them it's a tad more difficult to check for such things. For the average non-technical iPhone customer it would seem next to impossible.
- pflats 15y agoTrue, but it seems that CarrierIQ is, as its name implies, a service for the carriers. Since Apple doesn't let ATT et. al. customize iOS, it likely got into the OS as part of the bargain with them.
- 101001010101 15y agoRight. The way I see it, CarrierIQ gives carriers the kind of information that Apple could, in theory, gather quite easily. Maybe that was the idea behind CIQ? Just taking a wild guess.
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- billmcneale 15y agoSo Carrier IQ is still present in some iOS 5 and in all iOS prior to version 5. That's still an awful lot of places.