AfterDawn: Tech news

Another security researcher examines Carrier IQ - says keylogging concerns are unfounded

Written by Rich Fiscus @ 05 Dec 2011 3:57 User comments (7)

Another security researcher examines Carrier IQ - says keylogging concerns are unfounded It appears the most serious allegations about Carrier IQ, the diagnostics software secretly installed and run with root access on a variety of smartphones, may be unfounded.
Carrier IQ comes pre-installed on a number of smartphones, most notably Sprint and AT&T branded Android smartphones, and is sold as a diagnostic tool to help carriers monitor problems with their mobile networks.

The software's existence was discovered last month by a security researcher named Trevor Eckhart, who calls it a rootkit.

While Carrier IQ disagrees with that description, there appears to be no question it is installed without the user's knowledge or permission and runs secretly (hidden from user view) with privileged access. That's the basic definition of a rootkit.

Further revelations by Eckhart include Carrier IQ having the capability of logging every keystroke the user makes and secretly reporting the contents of SMS messages and encrypted communications to the carrier.



Another security researcher, Dan Rosenberg has performed his own analysis of the Carrier IQ implementation on a Samsung Epic 4G Touch and concluded Eckhart's conclusions were in error. According to Rosenberg, claims that Carrier IQ has a keylogger or is capable of sending carriers the contents of SMS messages or webpages are completely false, at least for the Samsung phone he looked at.

He wrote:

  1. CarrierIQ cannot record SMS text bodies, web page contents, or email content even if carriers and handset manufacturers wished to abuse it to do so. There is simply no metric that contains this information.
  2. CarrierIQ (on this particular phone) can record which dialer buttons are pressed, in order to determine the destination of a phone call. I?m not a lawyer, but I would expect cell carriers already have legal access to this information.
  3. CarrierIQ (on this particular phone) cannot record any other keystrokes besides those that occur using the dialer.
  4. CarrierIQ can report GPS location data in some situations.
  5. CarrierIQ can record the URLs that are being visited (including for HTTPS resources), but not the contents of those pages or other HTTP data.


He goes on to say:

I am using the word ?cannot? literally, as in ?is not capable of, in the present tense, without being altered by modifying its code and installing a new version on the phone?. It seems obvious to me that CarrierIQ could be modified in the future to perform nefarious actions: so could any application on your phone. Keep in mind CIQ is integrated by the OEM and to my knowledge has never been modified after installation, except in terms of profiles, which simply dictate which subset of available metrics defined by the OEM are collected.


Perhaps more importantly, Rosenberg notes that while Carrier IQ develops and sells the software, it is the carriers who choose what data to collect and what information and choices their customers have. While it is reasonable to take issue with Carrier IQ for what their software makes possible, the carriers need to be held responsible for their own choices.

Previous Next  

7 user comments

15.12.2011 17:21

Spin, spin, spin, damage control, and more spin.

25.12.2011 17:32

Originally posted by jookycola:
Spin, spin, spin, damage control, and more spin.
My sentiments exactly... I wouldn't call this "guns don't kill people, people kill people" scenario, but you certainly know a key logger is illegal... you can own a gun legally (dependent on your local, let's not start a snarky spittle contest folks). I would say the ONLY exception would be for law enforcement & cell phone carriers don't constitute that. Same as these idiots who call you on the phone demanding you pay for loans of credit debts. Are they a bank or the original debtor? NO!? So why are you giving them money? They're not a financial institution. As I used to tell my soldiers CYA.

35.12.2011 19:10

I agree as well, if they aren't interested in the information why track it is my first question... Besides the key tracking, the stuff i found will monitor all sorts of information about you. There is no way I could accept anyone knowing half of the information they are tracking that I wouldn't consider as an invasion of privacy...

45.12.2011 23:19

Quote:
most notably Sprint and AT&T branded Android smartphones

Why was Android bolded? More importantly, why is is most notable for being on some Android phones when it is on EVERY iPhone?

Quote:
While it is reasonable to take issue with Carrier IQ for what their software makes possible, the carriers need to be held responsible for their own choices.

Absolutely.

56.12.2011 06:51

Here's a more detailed description of what it does and what it doesn't do. So it looks like it doesnt KEYLOG anything.

66.12.2011 09:28

That's some defense....

"...claims that Carrier IQ has a keylogger or is capable of sending carriers the contents of SMS messages or webpages are completely false, at least for the Samsung phone he looked at."

So it doesn't key log ON THAT PHONE, but might on others.

76.12.2011 11:31

wow... one phone down... Probably one of about three companies that actively research & develop hardware solutions against this very thing. Not to mention the fact this is new technology (Carrier IQ is also new software) implemented over the last year, may be year & a half.

I can't immediately quote from where, but it has already been stated that older & less advanced phones are incapable of seeing the software; much less it is a fact that removing the software is already known to be a impossibility (at present attempts). So why wouldn't Carrier IQ also have a function to hide known illegal activity? It's called Carrier IQ Covering Their Asses (CYA).

This message has been edited since its posting. Latest edit was made on 06 Dec 2011 @ 11:32

Comments have been disabled for this article.

News archive