So, there's a rootkit hidden in millions of cellphones

[Borg 386]

The rootkit belongs to a company called Carrier IQ and it seems that it has low-level access to the system that allows it to spy on pretty much everything that you do with your handset. This, on the face of it, seems like an extremely serious breach of security, privacy and trust.

According to Carrier IQ the company is ‘not recording keystrokes or providing tracking tools.’ The video above seems to suggest otherwise.

When Eckhart initially labeled the software as a rootkit, Carrier IQ threatened him with legal action. Only when the Electronic Frontier Foundation stepped in did the company back off from this threat.

“Every button you press in the dialer before you call,” Eckhart says on the video, “it already gets sent off to the IQ application.”
​

The furore has angered many consumers, after it was found that the software, deeply embedded within the software of the world’s most popular mobile phone operating systems, was collecting information not limited to:

• when they turn their phones on;
• when they turn their phones off;
• the phone numbers they dial;
• the contents of text messages they receive;
• the URLs of the websites they visit; the contents of their online search queries — even when those searches are encrypted;
• and the location of the customer using the smartphone — even when the customer has expressly denied permission for an app that is currently running to access his or her location.

[UPDATE: According to a statement from Apple, the company stopped supporting Carrier IQ with iOS 5.0 on most of its devices, but the iPhone 4 still uses it.]

iPhone owners: Here’s how to disable the collection of diagnostic information on your handset.

So, it seems that there is a rootkit hidden in millions of Android, Symbian, BlackBerry, webOS and even iOS handset that logs everything we do.

Read More:

So, there's a rootkit hidden in millions of cellphones | ZDNet

Finding and cleaning out your smartphone’s Carrier IQ poison

Isn’t it wonderful? It turns out that a spyware rootkit from a company called Carrier IQ is on hundreds of millions of Android and iOS smartphones and tablets. Only Windows Phone-powered smartphones seems to have avoiding this program that reports on almost everything you do with your phone.

In the case of iPhones, it appears that Apple bakes this snooper into every phone. With other smartphones, the carriers, such as AT&T and Sprint, add it into your phones’ firmware before it gets into your hands.

Carrier IQ and the carriers aren’t talking much about their snooping ways.

Finding and cleaning out your smartphone’s Carrier IQ poison | ZDNet

You might have noticed that I didn’t list Windows Phone 7 OS earlier. That’s because it seems that Windows Phone handsets don’t have Carrier IQ installed.

Senator demands answers over Carrier IQ mobile phone tracking | ZDNet

 

[galaxys]

Big Brother is everywhere...let the law suits begin!

 

[seekermeister]

Glad that I don't use a cell phone. It would seem that the FCC would have a system in place to find problems such as this, before it being offered to the public, rather than after the fact.

 

[Hellriser]

Every time you are transferring information through other means than whisper near a waterfall, be sure that someone else is listening. Finding this "security breach" is just another hoax to make people think they are more secure now since the bad guys have been disclosed. I gave up being paranoid about privacy years ago. You pretty much can't fight it.

 

[seekermeister]

Paranoia is based on the concept of an imaginary fear...this is not imaginary. If one wishes to concede their privacy, that is their privilege, but all that accomplishes is to make it easier for it to be taken away.

 

[Faceofjoe421]

I already turned this and Location Services off

 

[Borg 386]

Big Brother is everywhere...let the law suits begin!

Didn't take long...

Carrier IQ tries to spin its way out of trouble

http://www.zdnet.com/blog/networking/carrier-iq-tries-to-spin-its-way-out-of-trouble/1710

Carrier IQ, the mobile phone network analysis company at the heart of the smartphone spyware scandal, isn’t talking to me, but it is talking to AllThingsD. To them, Andrew Coward, Carrier IQ’s VP of marketing, explained that “The software receives a huge amount of information from the operating system. But just because it receives it doesn’t mean that it’s being used to gather intelligence about the user or passed along to the carrier.” Tell it to the judge. The class-action lawsuits have already begun.

The first two class action lawsuits, which are being made on the basis of Federal Wiretap Act for unauthorized data collection, have been fired at Carrier IQ, HTC, and Samsung.

Carrier IQ speaks out: Points finger at networks, customers

http://www.zdnet.com/blog/btl/carri...inger-at-networks-customers/64528?tag=nl.e540

 

[seekermeister]

The lawsuits shouldn't stop there, because Carrier IQ couldn't have put the rootkit there without the other manufacturers being aware of it.

 

[Mashed1316]

Well, apparently BlackBerry smartphones are safe from this BS:

Carrier IQ not installed on BlackBerry phones, says RIM | The Verge

Since my phone is OEM, i don't know.. but i'll still check it

 

[ionbasa]

Video

More info from XDA Dev: The Storm Is Not Over Yet – Lets Talk About #CIQ | xda-developers

If you thought that the whole Security Saga was over and done with the triumph of the EFF and a very angry internet mob over CarrierIQ, you were sadly mistaken. You see? The fun part about doing research is that from time to time, you will run into bumps or things that will try to throw you off. I have personally done research for a few years and you will likely try to seek advise from the experts in the field of whatever you are trying to find. Our “experts” in this case are the good people over at CIQ, who so graciously decided to try and put a stop to the research last week. Well, as you are all aware by now, and as I stated a few moments ago, there was a formal apology letter posted by CarrierIQ on their website, which you can all read from the link that I just posted. However, there are a few items in here that we are not entirely happy with

More: Carrier IQ Creeps Out Everyone | xda-developers

Over the last week, Carrier IQ received quite a lot of attention. First, TrevE was served a Cease and Desist letter from Carrier IQ, including a prepared statement they insisted TrevE release on his website, denouncing his work. The Electronic Frontier Foundation responded on TrevE’s behalf, calling the C&D a violation of constitutional rights, and malicious. Carrier IQ apologized, calling the C&D, “misguided,” but made a statement denying many of the allegations.
Then TrevE released a video proving that every single allegation that Carrier IQ denied their software was capable of doing, their software actually does. And apparently not even the mighty iPhone is free of Carrier IQ data mining.

 

[FuturDreamz]

Well, apparently BlackBerry smartphones are safe from this BS:

Carrier IQ not installed on BlackBerry phones, says RIM | The Verge

Since my phone is OEM, i don't know.. but i'll still check it

On a BB, all carrier customizations are controlled by service books.

This also means that they can't preinstall applications, only stick a download link on your homescreen that pops back when you delete them (but they can be hidden no prob)

How CIQ get's onto Blackberrys is by being wrapped into one of the carrier's applications trojan-style, but even then it disappears when you delete the application.

 

[A Guy]

Lookout Releases Free Carrier IQ Detection App

A mobile security software company last Friday released a tool that detects Carrier IQ, the software embedded in numerous smartphones that has raised questions from users, privacy advocates and even Congress.

Lookout, best known for the Android security software by the same name, launched the free Carrier IQ Detector last week. It can be downloaded from the Android Market.

The tool only detects the presence of Carrier IQ on Android handsets: It does not scrub the software from the smartphone.

Lookout said that Carrier IQ was "deeply integrated with handset firmware [and] users would be required to attain special device privileges in order to remove it," then warned that doing so incorrectly could "put users at further risk of malware infection" and possibly make them unable to receive future phone updates.

Source

A Guy

 

[A Guy]

Removing CarrierIQ Is A Really Bad Idea For Most Mobile Phone Users

The controversy over stealthy monitoring software by CarrierIQ has raised important questions about user privacy and business ethics in the Brave New World of smart phones, tablets and the like. In the uproar over CarrierIQ's surreptitious monitoring of mobile phone users, various tools have appeared that claim to be able to detect the software. However - removing CarrierIQ from your phone is another matter entirely. And,while some sites have offered instructions on doing so, Kaspersky Lab researcher Tim Armstrong said that, for all but a few mobile phone hardware experts, doing a CarrierIQ-pendectomy is a bad idea.

"The software simply can’t be removed by the average user," Armstrong writes in a blog post on Securelist. "Even if a person ‘roots’ or ‘jailbreaks’ their phone to remove the software, there have been reports that this breaks functionality , or even ‘softbricks’ or temporarily renders the phone inoperable. Some other users are flashing custom ROM’s to their systems. These are customized full replacements of the vendor installed operating system. In some cases, users are still finding Carrier IQ files present after doing so.

Source

A Guy