Carrier IQ

[bascule]

For those of you that have been living under a rock, Carrier IQ is software integrated into several Android handsets by carriers and was also integrated into iOS releases before iOS5. According to its creator it only supplies anonymous diagnostic information to carriers about errors occurring on their network. However, that hasn't stopped some from speculating that it can monitor a lot more, including:

• when they turn their phones on;
• when they turn their phones off;
• the phone numbers they dial;
• the contents of text messages they receive;
• the URLs of the websites they visit;the contents of their online search queries—even when those searches are encrypted; and
• the location of the customer using the smartphone—even when the customer has expressly denied permission for an app that is currently running to access his or her location.

How much do you trust the software on your phone? Do you use your phone to transmit sensitive information, such as bank account passwords? How much does software like Carrier IQ worry you?

(FWIW, Cyanogen released a statement saying CyanogenMod will never have Carrier IQ)

[Chris]

Re: Carrier IQ

For those of you that have been living under a rock, Carrier IQ is software integrated into several Android handsets by carriers and was also integrated into iOS releases before iOS5. According to its creator it only supplies anonymous diagnostic information to carriers about errors occurring on their network. However, that hasn't stopped some from speculating that it can monitor a lot more, including:

• when they turn their phones on;
• when they turn their phones off;
• the phone numbers they dial;
• the contents of text messages they receive;
• the URLs of the websites they visit;the contents of their online search queries—even when those searches are encrypted; and
• the location of the customer using the smartphone—even when the customer has expressly denied permission for an app that is currently running to access his or her location.

How much do you trust the software on your phone? Do you use your phone to transmit sensitive information, such as bank account passwords? How much does software like Carrier IQ worry you?

(FWIW, Cyanogen released a statement saying CyanogenMod will never have Carrier IQ)

Here's an article on how to find and get rid of CarrierIQ:
http://www.zdnet.com/blog/networking...97?tag=nl.e589

[Deviant Ollam]

Re: Carrier IQ

FWIW, Cyanogen released a statement saying CyanogenMod will never have Carrier IQ

yet one more in a long line of reasons for why i utterly love running CyanogenMod. it is one of the best decisions you can probably ever make with regard to your handset. (see if your hardware is compatible here)

[Griff1371]

Re: Carrier IQ

Carrier IQ is exactly why I still have my flip phone from years ago.

I'm in the process of re-reading 1984 by Orwell the parallels between the book and real life are starting to get more and more scary.

[astcell]

Re: Carrier IQ

TV is free because we endure commercials. I swear cell phones ought to be free between the ads and people like this group.

[Griff1371]

Re: Carrier IQ

TV is free because we endure commercials. I swear cell phones ought to be free between the ads and people like this group.

What's even more of a rip off is having to buy a cell phone full retail. Mine crapped out on me a couple years ago. I had to get one of the cheapest models and it was still 200 bucks. It was a down grade in tech too, but with all the malware and surveillance stuff on smartphones I'm kinda glad I got what I did.

[sintax_error]

Re: Carrier IQ

To answer your question, Bascule, not at all. I'm on board with Dev and running a ROM that doesn't include CIQ. I can see both sides of the ethics argument of including such software on the handsets. It can apparently divulge way more info than most people would feel comfortable with. On the other side of the coin, I'm sure that CIQ has delivered info enough to find and fix all manner of problems.

Am I defending CIQ here? hell no, just saying I think I see where their heads were when they decided to bundle it. Get consent before even monitoring, let alone collecting and transmitting data. That's where the issue lies, on none of the phones pre-loaded with this, did a message pop up on the first boot asking permission to collect anonymous data, even if that data were anonymous. Since CIQ really came into the light, there have been several apps designed and put up on the market to find and kill it. As of now, it's the users' responsibility to choose to do so.

EDIT: just some typographical errors

[mwerte]

Re: Carrier IQ

Even if you run a custom ROM though, can't they just see all your data further upstream?

[sintax_error]

Re: Carrier IQ

Even if you run a custom ROM though, can't they just see all your data further upstream?

Depends on who's looking, how intently, and how long after that data transaction. From what I understand, as long as you don't get yourself flagged by your carrier for whatever reason, you generally don't need to worry about what they are looking into as far as your traffic. If anyone has anything to cite that contradicts this as far as policies and incidents, I'd be interested in a good read.

[TheCotMan]

Re: Carrier IQ

Even if you run a custom ROM though, can't they just see all your data further upstream?

If you "own" your own ROM, and OS, and manage to "secure" the platform you and the people you communicate with it are using (phone, OS, Firmware) then you can use encryption. (Examples: RedPhone, TextSecure for android, but these are not the only examples.) With a platform you trust on both ends, and encryption, the phone company may know the source and destination for many of your frames/packets, but may not know the contents.

For privacy of identity and security pf *this*, it is more difficult. I don't know of any *commonly used* applications/services for android or Apple's iOS which provide encryption and a degree of "anonymity" to keep secret the identity of the sender and receiver while allowing the sender and receiver to validate each other as being each other when placing/receiving a call or SMS/text.

I understand tor is available, and with .onion pseudo TLD for DNS, and other intermediate redirections may be possible, and there are probably VoIP users using applications that support tor for voice service, but I doubt these are *common* on phones.

A point on the topic of CarrierIQ, is about holes in firmware meaning you cannot trust the OS running on that firmware. (What can the OS do if firmware can intercept input and generate output without the OS knowing?) If you can't trust the OS because you can't trust the firmware, encryption is not a reliable way to securely (privately) communicate with this device without your conversations being intercepted by "eve".

(Firmware backdoors do not guarantee total failure of OS security, but there is a long history to show how firmware backdoors/maintenance-loops/holes can be exploited to "own" an OS.)

[Xenos]

Re: Carrier IQ

<< Even if you run a custom ROM though, can't they just see all your data further upstream? >>

Idea on this tread ...
Rom ... Rom ...

Encrypt OS with specific algo ...

[DjDamyard]

Re: Carrier IQ

My trusted pigeon never fails...