CarrierIQ Tries To Silence Security Researcher 216
phaedrus5001 sends this quote from a story at Wired:
"A data-logging software company is seeking to squash an Android developer's critical research into its software that is secretly installed on millions of phones, but Trevor Eckhart is refusing to publicly apologize for his research and remove the company's training manuals from his website. Though the software is installed on millions of Android, Blackberry and Nokia phones, Carrier IQ was virtually unknown until the 25-year-old Eckhart analyzed its workings, recently revealing that the software secretly chronicles a user's phone experience, from its apps, battery life and texts. Some carriers prevent users who actually find the software from controlling what information is sent."
The EFF is hosting PDFs of CarrierIQ's C&D letter, as well as their response on Eckhart's behalf.
Re:Why blame CIQ? (Score:5, Interesting)
Wait, he shines the light of day on a key logger, data recorder and total invasion of privacy, customised for carriers so there are no opt-outs, and he's beating up on them for no reason?
Jesus....
Does rooting and CM7 get rid of it? (Score:5, Interesting)
This is the only question I have right now. It's only a minor process to root my phone and install CyanogenMod on it.
Someone I was speaking with today was theorizing that there is actually a hypervisor layer running on smart phones, so even if you do root it, you're still not really getting raw access to the hardware - you're just rooting one VM, and this spyware runs in the hypervisor. I don't know how true this is, but I figure someone here knows.
Re:does this really matter? (Score:4, Interesting)
On my work phone are items that are covered I part by. HIPPA +HITEC Act, PCI-DSS and more. Are these folks cOmplying with those laws? If they get breached I get to notify thousands of people who's data may be compromisd??
NothIng could go wrOng.....
Re:Why blame CIQ? (Score:5, Interesting)
I work for a handset OEM. The requirement to install CIQ on a handset is a mandatory requirement that has come in over the past year or two - the last phone we did just missed having to have it implemented. It is the carriers who get the logging information and we have to do the porting. I agree that users should absolutely have the ability to opt-out of this kind of snooping, but so far there's no requirement for such a setting. I *do* expect to see it very soon though if the carriers know what's good for them. Pressure to drop preloaded craplets worked with Sprint and to a certain extent AT&T, so I expect those to be first with an amended set of requirements, if indeed they don't drop CIQ like a stone for all the bad press they've caused.
Re:He should remove it. (Score:4, Interesting)
What would a private company with no visible gov't affiliations care about any of that?
Why don't you ask Qwest's CEO, I think he gets out of jail sometime this decade for not bending over for Bush's warrantless wiretaps. Oh, sorry, I meant violating his job as CEO to make every penny possible by getting his government contracts cancelled for not bending over for Bush's warrantless wiretaps. Hmm, it doesn't sound much better that way either. How do you spin it so you can claim that these telcom companies have no visible government affiliations?
Consumer compensation (Score:4, Interesting)
I was hoping someone can convince CarrierIQ to pay the millions of smartphone users that have the software installed on their phone.
If I were to find this software on my phone, might it generally be a violation of the Terms so I can opt out of the contract?
Re:This is why I do not use Android (Score:0, Interesting)
Interestingly enough there's a job posting on CarrierIQ's website seeking a senior software engineer with 1+ years coding experience on the iPhone.
Re:He should remove it. (Score:2, Interesting)
>>if the Pope had this sort of data way back, all you Protestant apostates could have been burned at the stake, along with that wench, Joan of Arc.
Sorry, I hate feeding trolls, but I'm boggling at this statement.
You honestly are accusing the Catholic church of burning one of their patron saints at the stake? The English very explicitly didn't allow Jean D'Arc to appeal to the Pope, as they were running a show trial (threatening the English churchmen with death if they failed to burn her).