carrierIQ homepageAbout a month and a half ago, I penned the piece NSA’s Greatest Weapon In Surveillance? Outright Ignorance In Tech Consumers. The goal was to attempt to wake up the less than conscious in regards to where and with whom the true threats to privacy and security stem from. Those harping on innovative designs such as Glass as security threats are failing to see the forest due to the massive amount of tree bark in the way. This piece is another attempt at education from my perspective.
I have been hard on the large US carriers, and for good reason. Barring the smallest (and not by coincidence, the most innovative) of the 4, these guys exemplify the monopolistic behavior that has caused America to fall behind the world on many levels. Basically, from an innovation and financial performance perspective, they’re basically deadbeats! Hence,
One other reason many should be down on the deadbeat carriers is also a very fundamental given, that really shouldn’t be given – Privacy! Nearly all of the major carriers use the device that they sold you to snoop on you. US cellular carriers use an app that is basically one of the most widely dispersed spyware apps in this country. It can systematically syphon out location data, keystrokes and other aspects of e-mail and SMS conversations. Don’t belive me, this is a quote directly from the vendor of the spyware itself:
Network Operators and device manufacturers determine whether and how they deploy the iQ Agent and what metrics will be gathered and forwarded to the Network Operators. The iQ Agent receives instructions in the form of a profile, which activates the iQ Agent and defines what available metrics are to be collected and provides instructions on how to pre-process the data prior to uploading. The Embedded iQ Agent is not visible or discoverable by consumers. Since it is deeply embedded inside the device software, it cannot be deleted by consumers.
In non-nerd, anti-dork English, this says carriers decide what the spyware app and Trojan Horse rips from your device and sends back to the carrier. This spyware/Trojan Horse is purposely hidden and concealed from the owner of the device. As per Wikipedia:
- Spyware is software that aids in gathering information about a person or organization without their knowledge and that may send such information to another entity without the consumer’s consent, or that asserts control over a computer without the consumer’s knowledge.
- A Trojan horse, or Trojan, is a hacking program that is a non-self-replicating type of malware which gains privileged access to the operating system while appearing to perform a desirable function but instead drops a malicious payload, often including a backdoor allowing unauthorized access to the target’s computer.[1] These backdoors tend to be invisible to average users, but may cause the computer to run slowly.
Here’s a YouTube video showing the carrier spyware capturing keystrokes, SMS messages, emails, direct browsing activity, user names and passwords (in clear text, unencrypted) and other types of personal information. It also shows how aggressively the spyware is hidden from the enduser, and if found it is virtually impossible to stop or remove without rooting the phone. First a little Wikipedia background on the video’s author:
On November 12, 2011, researcher Trevor Eckhart stated in a post on androidsecuritytest.com[23] that Carrier IQ was logging information such as location without notifying users or allowing them to opt-out,[24] and that the information tracked included detailed keystroke logs,[25] potentially violating US federal law.[26]
On November 16, 2011, Carrier IQ sent Eckhart a cease and desist letter claiming that he was in copyright infringement by posting Carrier IQ training documents on his website and also making “false allegations.”[27][28]Eckhart sought and received the backing of user rights advocacy group Electronic Frontier Foundation (EFF).
On November 23, 2011, Carrier IQ backed down and apologized.[29] In the statement of apology, Carrier IQ denied allegations of keystroke logging and other forms of tracking, and offered to work with the EFF.[30]
On November 28, 2011, Eckhart published a YouTube video that demonstrates Carrier IQ software in the act of logging, as plain text, a variety of keystrokes. Included in the demonstration were clear-text captures of passwords to otherwise secure websites, and activities performed when the cellular network was disabled.[31] The video of the demonstration showed Carrier IQ’s software processing keystrokes, browser data, and text messages’ contents, but there was no indication that the information processed was recorded or transmitted. Carrier IQ responded with the statement, “The metrics and tools we derive are not designed to deliver such information, nor do we have any intention of developing such tools.”[32][33] A datasheet for a product called Experience Manager on Carrier IQ’s public website clearly states carriers can “Capture a vast array of experience data including screen transitions, button presses, service interactions and anomalies”.[34]
If the claims by Eckhart are true, the process of sending usage data is in conflict with Carrier IQ’s own privacy policy which states: “When Carrier IQ’s products are deployed, data gathering is done in a way where the end user is informed or involved.”[35]
According to Wikipedia, IQ Agent (the spyware in question) was first shipped in 2006 on embedded feature phones and has since been implemented on numerous devices and operating systems, including smartphones (Android, RIM,[8] iPhone), USB modems and tablets. It is currently running on over 150 million devices, making it one of the most ubiquitous of spyware packages known to this author.
Here’s some more interesting excerpts from said article:
On December 1, 2011, Carrier IQ issued a “clarification” (reference 1 December 2011: Important Clarification About the Data Received from Mobile Devices) to its November 23 statements: “While a few individuals have identified that there is a great deal of information available to the Carrier IQ software inside the handset, our software does not record, store or transmit the contents of SMS messages, email, photographs, audio or video. For example, we understand whether an SMS was sent accurately, but do not record or transmit the content of the SMS. We know which applications are draining your battery, but do not capture the screen… As a condition of its contracts with operators, Carrier IQ operates exclusively within that framework and under the laws of the applicable jurisdiction. The data we gather is transmitted over an encrypted channel and secured within our customers’ networks or in our audited and customer-approved facilities… Carrier IQ acts as an agent for the operators. Each implementation is different and the diagnostic information actually gathered is determined by our customers – the mobile operators. Carrier IQ does not gather any other data from devices. Carrier IQ is the consumer advocate to the mobile operator, explaining what works and what does not work. Three of the main complaints we hear from mobile device users are (1) dropped calls, (2) poor customer service, and (3) having to constantly recharge the device. Our software allows operators to figure out why problems are occurring, why calls are dropped, and how to extend the life of the battery. When a user calls to complain about a problem, our software helps operators’ customer service to more quickly identify the specific issue with the phone.”[39]
There has been debate whether Carrier IQ software actually sends the collected data in real time or if it is stored on the
phone and only gets read out later. The company clearly states on its web page that its software is able to provide real-time data: “Carrier IQ’s Mobile Service Intelligence solution eliminates guesswork by automatically providing accurate, real-timedata direct from the source – your customers’ handsets.” (emphasis added).[40]
Of course, on the same page I got there clarification (1 December 2011: Important Clarification About the Data Received from Mobile Devices) from, you can also find this press release: 19 October 2011: Nielsen and Carrier IQ Form Global Alliance to Measure Mobile Service Quality. The authors at Wikipedia picked this up as well, to wit:
Although the phone manufacturers and carriers by and large say the software is strictly used to monitor its phone systems and not to be used by third parties, a press release on October 19, 2011 touted a partnership with Nielsen Company. The press release said, “Together, they will deliver critical insights into the consumer experience of mobile phone and tablet users worldwide, which adhere to Nielsen’s measurement science and privacy standards. This alliance will leverage Carrier IQ’s technology platform to gather actionable intelligence on the performance of mobile devices and networks.”[48]
Long story, short (as if it isn’t already too late for that), instead of worrying about new Glasses taking a picture of you walking down the street (after 40 other cameras just did the same thing), you should be more focused on all of the info stored (against your will) and ripped from your cellular handset. Even if you were to give ALL of the carriers, and ALL of these spyware companies the benefit of the doubt, the way THIS Trojan horse is put together (client server relationship with complete push/pull capabilities), all the NSA has to do is flip a switch and the’ll know what flavor ‘snuff great grandma likes to chew!
Consider yourself warned! I doubt very seriously if this revolution will be televised (or even streamed from Netflix!).
It took me nearly an hour to get this stuff off of my device, and even more time to lock it down. Those who are interested in having this institutional spyware removed from their phones for a fee should contact support [at] boombustblog [dot] com. My son is starting a service that will do it for you, but you will void your warranty as a result of seeking said privacy. Of course, anyone who purchased insurance should be covered anyway, but always read the fine print..
Despite all of this I still believe Tech Is Far And Large The Biggest Thing This Millennium – Lehman, EU Crisis Included. I am actively looking to servce on the boards of tech companies. Security companies in the mobile space currently have my eye, but I’m looking to advise and serve on the boards of any company in the mobile computing space. For those who don’t know me, reference “Who is Reggie Middleton?“.
     |
via Zero Hedge http://feedproxy.google.com/~r/zerohedge/feed/~3/W2A3E1nN5PE/story01.htm Reggie Middleton