Carrier IQ Tries to Silence Security Research Exposing Its Rootkit, gets Pinned Down by the EFF
By on November 22nd, 2011

The first impression of the  Carrier IQ website is almost as if it manufactures IQ. Their website has IQ pasted all over it and this gives an intimidating feeling. However, that is for starters, and the best part of the story is yet to come! Carrier IQ feeds on our ignorance. It is a major manufacturer of rootkit software for carriers like Sprint, Verizon and more.

carrier-iq

Carrier IQ describes itself as:

Carrier IQ is the market leader in Mobile Service Intelligence solutions that have revolutionized the way mobile operators and device vendors gather and manage information from end users.

Now, that is a nice way to put it. However, it simply means that Carrier IQ gathers information from mobile-device users and sends them back to carriers and device manufacturers. Even before we question the type of information that is sent back, a better question is “Why does information need to be sent back at all?” The type of information being sent back is varied, and ranges from network-usage to application-usage. If you had have heard of Apple tracking user locations, Carrier IQ goes way beyond that.  Carrier IQ can log much more than location. It can log your network activity, location data, application activity and everything else.

The data collection policy of Carrier IQ states ‘triggers’ and ‘metrics’ as two entities. Triggers are events on the phone that users can carry out. Unsurprisingly, the  Carrier IQ test UI  lists almost all possible events on Android as triggers. In essence, Carrier IQ is a rootkit.

The worst aspect of Carrier IQ is that it stays on your phone as a backdoor and does not require user permissions to run. Forget user permissions, it runs without a hint of being there on your phone.

The presence of Carrier IQ and their operations was hidden, until Trevor Eckhart from  revealed it. This was unacceptable for Carrier IQ because they had setup an empire, selling user data. No one came close to questioning them until today. As a response, Carrier IQ went ahead and filed a cease and desists against the expose article, and removed all its training material (that explained better how it worked) from its website.

However, Carrier IQ did not stop at that. It also demanded Eckhart to declare that all his research was false and give away the list of people he had contacted on the matter. This is when Eckhart turned to the EFF for help and being the organization that EFF is, it offered to protect the  First Amendment for Eckhart.  EFF’s analysis says that Carrier IQ has not much of a case here and these are baseless threats. As pointed out by EFF, Carrier IQ just realized the  Streisand effect.

Are you comfortable with Carrier IQ spying on you? Share your thoughts with us.

Update:

In an email statement that I received yesterday, Carrier IQ states that it has since withdrawn the c&D against Eckhart,  and has also apologized to  Eckhart and the EFF for this erratic behavior.

Tags:
Author: Chinmoy Kanjilal Google Profile for Chinmoy Kanjilal
Chinmoy Kanjilal is a FOSS enthusiast and evangelist. He is passionate about Android. Security exploits turn him on and he loves to tinker with computer networks. He rants occasionally at Techarraz.com. You can connect with him on Twitter @ckandroid.

Chinmoy Kanjilal has written and can be contacted at chinmoy@techie-buzz.com.

Leave a Reply

Name (required)

Website (optional)

 
 
Copyright 2006-2012 Techie Buzz. All Rights Reserved. Our content may not be reproduced on other websites. Content Delivery by MaxCDN