Post by hurricanemaxi on Dec 5, 2011 10:07:56 GMT -6
The company Carrier IQ became an overnight pariah this week after a security researcher published information suggesting that software it makes could potentially be used to significantly violate the privacy of millions of smartphone users.
The researcher is Trevor Eckhart, and he said that the way Carrier IQ's application is used could allow it to tell your cellphone carrier all sorts of things about when and how you use your phone -- info like what applications you use, geographic location, what buttons are being pressed and usage history -- all without you knowing. Since stuff like URLs, text messages, credit card numbers and who knows what else are all entered by way of the phone's keypad, it seems Carrier IQ could be used to spy on some very sensitive stuff.
So why would anyone who's not a malware-slinging cybercrook ever put something like that on someone's phone without telling them? Well, Carrier IQ is actually meant to be a metrics service for use by wireless carriers. They tuck this app into users' phones to get a better idea of how their customers are using the network and get a highly detailed picture of what kind of performance they're seeing.
That's the way it's supposed to work, anyway. But Eckhart says that the way Carrier IQ looks in its raw form is very different than how it looks once it's been cooked into the phones wireless carriers sell. Straight Carrier IQ software is up front with the user about its presence -- it has you filling out forms when there's a problem, volunteering info and generally serving the same purpose as the comment card the waiter hands you when you're paying your bill at a restaurant.
But once carriers get their hands on Carrier IQ, according to Eckhart, they make it work behind the scenes. Most users aren't even aware it's there. So instead of asking for comments, the waiter's hiding under your table, listening to what you're saying about the restaurant and possibly overhearing a lot of other stuff too. From Eckhart's point of view, the software should be characterized as a rootkit.
Once the story began circulating, carriers and phone makers wasted little time distancing themselves from Carrier IQ, if they could honestly do so. Verizon, Research In Motion (Nasdaq: RIMM) and Nokia (NYSE: NOK) told us they don't use the software, and HTC reportedly said that if you find it in their phones, it wasn't their decision -- talk to your carrier. The software is reportedly found in some iPhones -- Apple (Nasdaq: AAPL) dumped it when it came out with iOS 5, but even if you're running something older, it's limited in what it reports and it's only active when the phone's in diagnostic mode.
Meanwhile, the news caught the attention of at least one U.S. senator. Minnesota's Al Franken has written a letter to Carrier IQ demanding to know exactly what kind of data the software logs, under what circumstances it's transmitted, to whom, what's done with it, how long it's kept, how it's protected, and why the company doesn't think it's in violation of federal privacy laws.
text message from computer
wandbündige Türen
The researcher is Trevor Eckhart, and he said that the way Carrier IQ's application is used could allow it to tell your cellphone carrier all sorts of things about when and how you use your phone -- info like what applications you use, geographic location, what buttons are being pressed and usage history -- all without you knowing. Since stuff like URLs, text messages, credit card numbers and who knows what else are all entered by way of the phone's keypad, it seems Carrier IQ could be used to spy on some very sensitive stuff.
So why would anyone who's not a malware-slinging cybercrook ever put something like that on someone's phone without telling them? Well, Carrier IQ is actually meant to be a metrics service for use by wireless carriers. They tuck this app into users' phones to get a better idea of how their customers are using the network and get a highly detailed picture of what kind of performance they're seeing.
That's the way it's supposed to work, anyway. But Eckhart says that the way Carrier IQ looks in its raw form is very different than how it looks once it's been cooked into the phones wireless carriers sell. Straight Carrier IQ software is up front with the user about its presence -- it has you filling out forms when there's a problem, volunteering info and generally serving the same purpose as the comment card the waiter hands you when you're paying your bill at a restaurant.
But once carriers get their hands on Carrier IQ, according to Eckhart, they make it work behind the scenes. Most users aren't even aware it's there. So instead of asking for comments, the waiter's hiding under your table, listening to what you're saying about the restaurant and possibly overhearing a lot of other stuff too. From Eckhart's point of view, the software should be characterized as a rootkit.
Once the story began circulating, carriers and phone makers wasted little time distancing themselves from Carrier IQ, if they could honestly do so. Verizon, Research In Motion (Nasdaq: RIMM) and Nokia (NYSE: NOK) told us they don't use the software, and HTC reportedly said that if you find it in their phones, it wasn't their decision -- talk to your carrier. The software is reportedly found in some iPhones -- Apple (Nasdaq: AAPL) dumped it when it came out with iOS 5, but even if you're running something older, it's limited in what it reports and it's only active when the phone's in diagnostic mode.
Meanwhile, the news caught the attention of at least one U.S. senator. Minnesota's Al Franken has written a letter to Carrier IQ demanding to know exactly what kind of data the software logs, under what circumstances it's transmitted, to whom, what's done with it, how long it's kept, how it's protected, and why the company doesn't think it's in violation of federal privacy laws.
text message from computer
wandbündige Türen