Windows 7 - So, there's a rootkit hidden in millions of cellphones

The rootkit belongs to a company called Carrier IQ and it seems that it has low-level access to the system that allows it to spy on pretty much everything that you do with your handset. This, on the face of it, seems like an extremely serious breach of security, privacy and trust.

According to Carrier IQ the company is ‘not recording keystrokes or providing tracking tools.’ The video above seems to suggest otherwise.

When Eckhart initially labeled the software as a rootkit, Carrier IQ threatened him with legal action. Only when the Electronic Frontier Foundation stepped in did the company back off from this threat.

“Every button you press in the dialer before you call,” Eckhart says on the video, “it already gets sent off to the IQ application.”

The furore has angered many consumers, after it was found that the software, deeply embedded within the software of the world’s most popular mobile phone operating systems, was collecting information not limited to:

• when they turn their phones on;
• when they turn their phones off;
• the phone numbers they dial;
• the contents of text messages they receive;
• the URLs of the websites they visit; the contents of their online search queries — even when those searches are encrypted;
• and the location of the customer using the smartphone — even when the customer has expressly denied permission for an app that is currently running to access his or her location.

[UPDATE: According to a statement from Apple, the company stopped supporting Carrier IQ with iOS 5.0 on most of its devices, but the iPhone 4 still uses it.]

iPhone owners: Here’s how to disable the collection of diagnostic information on your handset.

So, it seems that there is a rootkit hidden in millions of Android, Symbian, BlackBerry, webOS and even iOS handset that logs everything we do.

Isn’t it wonderful? It turns out that a spyware rootkit from a company called Carrier IQ is on hundreds of millions of Android and iOS smartphones and tablets. Only Windows Phone-powered smartphones seems to have avoiding this program that reports on almost everything you do with your phone.

In the case of iPhones, it appears that Apple bakes this snooper into every phone. With other smartphones, the carriers, such as AT&T and Sprint, add it into your phones’ firmware before it gets into your hands.

Carrier IQ and the carriers aren’t talking much about their snooping ways.

You might have noticed that I didn’t list Windows Phone 7 OS earlier. That’s because it seems that Windows Phone handsets don’t have Carrier IQ installed.

Big Brother is everywhere...let the law suits begin!

Carrier IQ, the mobile phone network analysis company at the heart of the smartphone spyware scandal, isn’t talking to me, but it is talking to AllThingsD. To them, Andrew Coward, Carrier IQ’s VP of marketing, explained that “The software receives a huge amount of information from the operating system. But just because it receives it doesn’t mean that it’s being used to gather intelligence about the user or passed along to the carrier.” Tell it to the judge. The class-action lawsuits have already begun.

The first two class action lawsuits, which are being made on the basis of Federal Wiretap Act for unauthorized data collection, have been fired at Carrier IQ, HTC, and Samsung.

If you thought that the whole Security Saga was over and done with the triumph of the EFF and a very angry internet mob over CarrierIQ, you were sadly mistaken. You see? The fun part about doing research is that from time to time, you will run into bumps or things that will try to throw you off. I have personally done research for a few years and you will likely try to seek advise from the experts in the field of whatever you are trying to find. Our “experts” in this case are the good people over at CIQ, who so graciously decided to try and put a stop to the research last week. Well, as you are all aware by now, and as I stated a few moments ago, there was a formal apology letter posted by CarrierIQ on their website, which you can all read from the link that I just posted. However, there are a few items in here that we are not entirely happy with

Over the last week, Carrier IQ received quite a lot of attention. First, TrevE was served a Cease and Desist letter from Carrier IQ, including a prepared statement they insisted TrevE release on his website, denouncing his work. The Electronic Frontier Foundation responded on TrevE’s behalf, calling the C&D a violation of constitutional rights, and malicious. Carrier IQ apologized, calling the C&D, “misguided,” but made a statement denying many of the allegations.
Then TrevE released a video proving that every single allegation that Carrier IQ denied their software was capable of doing, their software actually does. And apparently not even the mighty iPhone is free of Carrier IQ data mining.