Does your smartphone run Carrier IQ? Find out here The roster of confirmed smartphone manufacturers and network providers using the controversial Carrier IQ tracking software has grown to include Apple, AT&T, Sprint, HTC, and Samsung. Verizon, Nokia, and Research in Motion, meanwhile, have denied reports saying they employ it. In a statement that was widely reported on Thursday …
I had a quick investigation of this on my iPhone 4s (running iOS 5.0.1) today. Conclusion: it's a non-issue on the iPhone.
Basically, for it to monitor anything at all, you have to manually activate usage + diagnostics collection. For it to monitor anything related to location, you have to turn on location services. I've had both enabled since I bought it on launch day (it's a dev phone, sometimes extra logs are useful). So what did I find?
First, the logs are easy to access. You can read them on the phone, buried a bit in the settings app (under usage). There's a lot of logs. Most are reporting various issues with the networks, some are app crash reports, and there's a bunch of power management and disk usage logging data.
How anonymous is it then, and what does it collect? Well, every report has my device ID, and a 'profile ID' (presumably carrier IQ's ID to match my device?). The device ID could tie my device to my account because apple have my details. Apart from that, it's anonymous - no personal info in anything I opened. I guess it's anonymous, but could be tied to me quite easily by apple (probably not by carrier IQ).
As to what it collects:
Calls: it just seems to log the end of a call. No numbers or anything. Presumably so they can track failed/dropped call rates.
Keylogging: Nope, nothing of the sort.
Emails/texts/IM: Didn't see anything at all.
Network data: All I saw were some reports that DHCP took a long time (that would be the crappy wifi at work). No IP address or anything.
Location data: The only entries were when an app requested my location. It didn't contain any location data at all, just the accuracy level the app requested and the accuracy level the GPS was able to provide (in meters).
Everything else was about the same. No personal data, no tracking, no key logging, really nothing to be concerned about at all. I'll leave it turned on :)
"Everything else was about the same. No personal data, no tracking, no key logging, really nothing to be concerned about at all. I'll leave it turned on :)"
First off I have an Evo3D with Sprint. Just so we understand where I am coming from.
Seriously? Are you out of you mind supporting this? The data is personal and IS trackable to you regardless of what they want you to believe. They need to know where the data came from so they can fix coverage issues for calls and the such that need it. They need to know what apps crashed and WHY, not to mention what was going on at the time, which guess what, leads back to you since not ever person is going to have the EXACT same setup as you do.
While I can understand the reasons for something like this it does not mean I agree with it. Can it be a good tool, sure. But at the same time the providers need to inform us of this ahead of time as opposed to us being informed by a security expert saying "Oh hey guess what I found out."
Now on to Sprint. While they seem to have been the most forthcoming of the companies on if and why they use this as well as what it logs, I doubt that they are telling everything. I still applaud them for admitting instead of denying or giving bullshit answers like the rest. Noika and RIM may be innocent this does not mean that the providers didnt install some custom image on the phones with it installed.
We should all stop being fanbois for a moment and think about the implications of something like this.
I think maybe people have misconstrued what I was saying there. I'm not some kind of crazed fanboy who thinks because apple put it on, it's the best thing ever. Let me clarify a bit.
Am I "supporting" this? Kind of, in a limited way. I'm generally a hardliner on privacy (still watching phorm closely and waiting for it to die :)
Should it be installed and enabled by default on all phones? *FUCK NO!*
Should it be installed but optional and limited? Yes. The ios5 implementation I've been looking at seems very useful for tracking down issues, and if say I had the battery issue I'd definitely want this running to help apple get it fixed. If I didn't have a serious use for it, I'd want it turned off.
Why am I leaving it enabled? Because I'm an iOS developer, and can see those logs being useful in testing. If apple get some benefit from it too, fine. I'd leave it turned off if I wasn't using it.
Am I really concerned about the privacy implications here? No:
1. because it's voluntary and disabled by default
2. because it's not doing anything all that bad anyway, and what it is doing is within the privacy policy
3. because it's *not* sending any location data (presumably it does this if you ask for assistance and they put the device in diagnostics mode - i.e. when you actually want them to have that data)
4. because it's not sending any personal data. And I've checked out that device ID by the way, and I was wrong in thinking it was the serial number - it isn't the device serial number or UDID or any other device ID I know of. It's probably a random string so they can tie my reports together. They could presumably tie this data to my account by IP address if they wanted to though.
So basically it's something that is useful, it's voluntary, it's off by default, and even if you turn it on it's not much to worry about.
Of course all of that *ONLY* applies to the iOS 5.0.1 implementation I've looked at. The youtube video showing one of the android implementations running a key logger and such, on the other hand - that's totally out of order, and I hope whoever was behind that debacle gets smeared in honey and raped by a bear :)
This kind of diagnostic tool can be a good thing, but it has to be opt-in, non-commercially motivated, and it has to be as anonymous as possible.
I'm glad that Chris 19 investigated, and concluded that there are no hidden functions, unwanted communications with the carrier, all that sort of stuff.
I feel so much more at ease now.
C'mon man!
The fact that this software is even close to a phone, and all carriers 'ensuring' all their customers that they did not install it, and if it's installed it's just for monitoring and quality assurance: who are they trying to bamboozle here?
I don't care if senators go after CarrierIQ -- it's the carriers that they need to go after!
They are installing this software and allowing CarrierIQ to be the man in the middle to monitor your usage and god knows what.
And under what pretense will they be able to slip away? 'Oh, it was mentioned in the T&C that you accepted by signing up with us, right here where it says that we're allowed to monitor usage to improve our services for you'.
The fact that Apple said 'oh, we're no longer using it' does not make these guys innocent! They are just as rotten as any other carrier.
I'm calling shenanigans!!
Lets calm the hysteria shall we?
Firstly until independent researchers strip the various phones down we still have no idea of the capabilities of carrier iq on any phones except Android. Even then it needs to be confirmed by others.
Apples explicit request for opt in to this monitoring is the way to go - as long as whats being tracked is easily available to review. Ps they are not a carrier! Chris I think you are being a little naive to assume that you can see everything being tracked on iPhone - I suspect you are correct but we should wait for independent review to confirm.
This problem still seems mostly limited to the US carriers, they need to be absolutely transparent as to what CIQ can do on each of their phones.
No, I was enjoying all the hysteria! An embedded tool to help support diagnose what is wrong with your device - must be spyware! Batten down the hatches, women and kids first, etc, etc!
I'm reminded of an event a few years back when we had an intermitant networking issue with some new Nortel switches talking to older CISCO switches and an hp-ux cluster. As part of the diagnostic work we were doing in conjunction with hp Support, we turned on a tool called nettl (which can only be run by root) that is in hp-ux, which can monitor/examine all the packets flying in and out of the servers and provide all types of filtering so you can quickly identify network issues. We left it to run for a week so we could catch a good amount of data. Towards the end of the week I got a call from our CIO saying that a network security insultant had indentified a trojan on our hp-ux servers that was logging all the data communicated in the cluster.....
This is not hysteria, i'm a bit upset. And apparently to get things done, you have to speak up, shout sometimes, or at least speak louder than others. At least that's what I'm getting from living in the US for a while.
It sounds almost like you and Eric Schmidt (sp?) from Google go hand in hand -- [paraphrasing here] "if you're worried about being tracked, maybe you're doing something you shouldn't "
I don't like these diversion techniques of senator(s) writing letters to the software manufacturers, when the real stuff is happening through / at the carriers. Smells of diversion techniques. Well, it's not working for me! Ha!
Mergers for the sake of ('it's better for the customer, trust us'), tracking of activity on your phone ('no, just to find out any issues with connectivity, trust us'). Bah! Humbug!
Off-topic: is it really still 'your' phone? what do the T&Cs say about that? Apparently consoles are no longer considered yours, according to the manufacturers? Maybe by signing up with a carrier you're just getting a license / permission to use their phone, on their network.
Think a bit harder people! Looks like all that swiping on tablets is making us become dumber. We're slowly forgetting to figure out what's behind all this. These carriers are not there for you.
They're just in it for the money.
Which they happily will take from you.
And if they can get usage information in the process, without having to pay you? That's even better.
We're being dumbed down, and in the process of it, we're lovin' it.
Tin foil hats are not necessary. Black sunglasses are not required. Just look around, and start thinking a bit.
In your own, paranoid way, you're both hitting the nail right on the head and at the same time swinging blindly in the dark:
"....They're just in it for the money....." EXACTLY! Nail right on the head. Now, please tell me where is the "money" in spying on their customers? There is no monetary gain from it (apart from maybe a minor amount from location-based advertising/search) for the carriers. In fact, the EXACT opposite, as the carriers would LOSE money with people dumping their phones if the carriers were actually caught spying on customers. So, why would they risk it? Oh, and just to be completely clear, at this point no-one has actually caught the carriers using CarrierIQ to spy on anyone. No-one has proof that anyone has used their phone cam to film them or their surroundings, there is no smoking gun. It is nothing more than presumption - "I found a hunting rifle in your pickup so you MUST be planning to murder me!"
The reality is the carriers are in it to make money, and to make money they need to provide a good service, and to provide that service they need diagnostic tools, and to me it seems that is what CarrierIQ is, period. The only people hyping this whole idea are people like A$$nut, who have a vested interest in driving the paranoia and herding the sheeple.
Yep, agreed. For all I know my phone could be filming me while I'm typing this and streaming the video straight to apple. (I'm actually serious there, it's entirely possible and without running a packet sniffer it's impossible to tell).
I'm just going on what I can see, which *should* be all there is (and I really hope that's all). Time will tell, I bet there's plenty of people checking just now.
Yes and no.
Yes, you're right about your findings. I too was kind of surprised to find this option deeply buried away in Outlook 2010 (File -> Options -> Trust centre -> Trust settings -> Privacy options; here you have several options, from grabbing updates, contacting office.com to the CEIP you mentioned). And its all opt-in.
No, you're also overlooking the obvious.. If you use an illegal version of Windows then MS will have no problem with detecting this and taking action. I've seen this with a laptop from a customer one day: a black background clearly stating that the version is illegal. Changing the background would only last for a few minutes; then it was down to "marked as warezer" again. For the record; this was on Windows XP. I have only encountered this once and quite frankly it doesn't interest me enough to dive into the matter (I have no idea how this works on the more current Windows versions).
But concluding: whether you like it or not, some information about your environment /will/ be sent to Microsoft no matter what.
So while I agree that MS does a good thing with keeping that stuff opt-in, lets not ignore the other side of the medal here.
Not on my htc Sensation either...
That said, I think this is mainly a US issue, all the providers in Europe seem to be stating that they have never used CIQ.
T-Mobile, O2, Vodafone and E-Plus in Germany have all said they don't use the software (report on heise.de) and htc said to them, that they only install the software on certain models for specific US carriers, which require the software to be installed.
heise.de checked all smartphones in their offices and found no traces of CIQ on any of them (iOS, Android etc.).
According to Zack Whittaker, over on ZDNet, the story is much the same for the UK carriers, none of them use it. At least one was approached by CIQ, but they didn't want to touch it.
".....all the providers in Europe seem to be stating that they have never used CIQ....." No, no, NO! You'll never qualify for a gold-plated tinfoil hat with a sensible attitude like that! You should immediately leap to the paranoid conclusion that the European carriers must therefore be using something even more evil.....
WP7 presumably has its own logging + diagnostics tools instead, give that some scrutiny please ;)
It's not Carrier IQ that's the problem from what I've seen - it's what some companies are telling it to do. MS might be doing far worse stuff with their tools for all we know. I suspect it'll be pretty harmless though - and hopefully turned off by default. We'll see.
According to Ars Tecnica, Apple have said the iPhone 4 is the only one on iOS 5 still with with Carrier IQ.
http://arstechnica.com/tech-policy/news/2011/12/apple-carrier-iq-still-on-iphone-4-but-we-dont-read-your-e-mail-and-texts.ars
The 4S doesn't have it. Presumably the information you see is from Apple's own diagnostics package. That said the information on the 4 isn't that much different.
Interesting. I sold my 4 recently unfortunately, only got a 4s and a 3gs. The 3gs has the exact same data (same filenames, same content + formatting). The main logs all start with "awdd_2011-...", anyone with a 4 care to check?
Just saw a big log of an iMessage conversation in there too. Lots of data, details of the wifi network, encryption type etc. But no private data, no SSIDs, no phone numbers/usernames, just the useful bits if you're trying to fix an issue with the system.
I think apple + microsoft have come out of this looking pretty good. Why? Not because they're closed gardens or whatever, just because they both limit what the carriers are allowed to put on the phone. If android ends up going the same way as a result of this, everyone will win :)
I believe the data is anonymised as Apple say (there's a field called isAnonymous which is set to true). Some of the records do include mast/cell, including power levels and up/download speeds for the cell.
There's no need to link any of it back to me, since the purpose seems clearly to diagnose the cell, not my particular phone.
As for access to this data, it doesn't seem to be backed up anywhere else, so presumably the only access would be via jailbreak. It also seems to clear anything older than 7 days.
There's no GPS data apart from accuracy (i.e. it says "app asked for position, OS provided position to within 500m"). There's no actual location at all that I've seen. Possibly they can turn that on if you have an issue and agree to let them run full diagnostics. No cell tower data I've seen, just accuracy.
Wifi data: nothing beyond "Connected to wifi, using WEP" type logs. No SSIDs, no locations, no addresses.
No personal info tying me to the data. There is a device ID attached, which I assumed was the serial number of the phone (which ties it to my account easily), but I've checked and it isn't. I suspect it's just a random number. They could of course check the IP it was sent from and match it against say app store logins though, so it's possible to associate it with me.
Worst case, say I committed a crime. They could tie these reports back to me, and determine things like when I sent texts or made phone calls or used a GPS app, but without any phone numbers or locations attached. Mildly interesting at best, and they'd get much more info from the phone company.
Some US carriers require that it be installed, Apple installed it, along with htc and Samsung on specific models for certain US carriers...
Okay, they're in the process of pulling it now, if people bother to update - I still have friends here using iOS 3.n, because they've never connected their iPhone to a computer!
Android phones not going to those US carriers don't have the software installed (see my comment above, heise.de tested all of their Android and iOS devices and none had the software installed).
This is a fail for the US carriers, it has little of nothing to do with individual 'phones or their manufacturers, the CIQ software is just another piece of carrier crapware that gets pre-installed on branded phones.
Well, at least not the major problem. I actually believe carriers when they say they only want to use CarrierIQ to help customers. But in a world where police feel free to seize and strip data off your phone without a warrant, it doesn't help that the information would have been only transfered to the carrier after encryption, or how well they protect anonymity in handling the data. They have to not log it in the first place.
The intended use may be as described.
The means of achieving it are hideous. It is not the first time this has happened and it is a normal result of carrier procurement which relies on "procurement specialists" nowdays and has no engineering oversight whatsoever.
When something like that is procured by a carrier you are _NOT_ _ALLOWED_ to actually look inside and say "no, we are not buying this, this is done the wrong way". As an engineer you have no right to do so. The consluttants improving business processes in the carrier have revoked it and removed it from the architectural and procurement processes as it is "bad for business".
This post has been deleted by its author
In the original story they quoted from a statement by the company VP of marketing :-
“Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.”
So yes, that data is being transmitted somewhere without your knowledge, without knowing who has access to that data and without knowing for what purposes they will use that data.
Don't blame El Reg for your lack of reading and comprehension skills.
I did read that in the original story and at no point did I blame El Reg.
“Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.”
This quote is vague and does not specify what data is being sent. It could be the personal data that was shown in the usb data log video or it could simply be a non-personalised overview of data which doesn't include keystrokes and such like.
So before you get on your high horse, YOU try comprehend the data :)
As with all these monitoring applications one of the questions to be asked is who is paying for the traffic? I use a Samsung and with a Vodafone PAYG sim when the credit ran out I used to get alerts saying that there is not enough credit left to send an SMS which was rather surprising as I never send messages and there aren't any in the history. I now use a different provider so I will have to let the credit run down to see if occurs with a them or if it's phone related issue.
An AT&T spokesman, meanwhile, said only: “In line with our privacy policy, we solely use CIQ software data to improve wireless network and service performance.”
This is a very open statement.
One could interpret that by capturing this information, it could be used to better target advertisements etc... Which could be done under the guise of improving your experience.
So while deny and potential illegal snooping, they could also be admitting to doing so at the same time.
It's definitely a potential lawsuit (civil) against both the carrier and the company.
indeed. We monitored your phone and saw you had issues logging onto "pr0n are us" when you were away from your normal "home" cell. So we have boosted the signal when you are in the "away" cell so you can surf better.
Oh and we have powered down the cell you are in at the moment as you seem to be calling someone not in your normal pattern.
Have a nice day citizen.
Parse the text carefully!
The statement "we solely use CIQ software data to improve wireless network and service performance" does NOT mean the same as "we use CIQ software data solely to improve wireless network and service performance". The former merely states that AT&T improves wireless network and service performance using only CIQ software data and from no other source; it contains no explicit exclusion that CIQ software data is used by AT&T for other more sinister purposes.....
I want to see some packet sniffing going on to see if this data really is being sent off somewhere. Are they actively snooping on the world or are they just overzealous with their logging.
If the data is just sitting in a log file on the phone and not being sent off anywhere then it's not that much different from your phones regular call logs, sms inbox and sent items storage and so on. It's a bit more intrusive but are they really snooping on us?
Thing is a local log is just that, a debug dump into a local filesystem, something almost all devs put into be able to get to the root of problems quickly. This has the potential to be something more insidious and until we get full disclosure from the still very tight lipped CIQ, best to assume the worse.
More people are waking up to the fact that they are not seen as customers to the MegaCorps(tm) but simply seen as products to bought and sold, products that pay for the privilege of being treated like commodities. We don't mind paying for the MegaCorps services but we'd like some simple, common decency to be treated like human beings, not marketable cash-cows to be used and abused!
Heya,
My original comment was meant to be removed after I spoke with the author of this article earlier in the day. When I noticed it hadn't been removed, I again withdrew it.
My concern was that comments on other stories about Carrier IQ hadn't been approved, yet the article had been updated to reflect the concerns outlined in those comments. With the comment count suspiciously low, I wanted to know if El Reg is reporting fairly on this story.
I want to see sniffed data from a consumer. The quote from Carrier IQ doesn't make it clear what data is/isn't sent back to them. For all we know, it could just have launched apps sent back, nothing more. So far there's not been any proof that our sensitive data (such as keyboard presses) is being sent to them or anyone else.
It can not be uninstalled. It can not be turned off. It can not be killed. It fakes it death in the service manager when manually stopped. Surely it's nothing important at all.
Dan Rosenberg is likely right but I'd like the option to kill it. Superfluous features are the first target of a hacker.
"vzw-collector.demo.carrieriq.com, vzw-dis.demo.carrieriq.com and hupload-vzw99.carrieriq.com. None of the three URLs responded to pings at time of writing."
Author is showing their ignorance here.
First, those aren't URLs, they're hostnames. Second, the fact they don't respond to a ping proves absolutely nothing about the reachability of a host these days. In fact, a quick portscan reveals TCP/443 is open on these 'URLs' (sic) which is presumably the ingress point for collected device information.
Even if there were no TCP ports open however, it would be pretty unwise to assume the hosts were 'down' or otherwise incapable or receiving collected information. For example, an VPN daemon listening on a single UDP port using a hashing algorithm would be incredibly difficult to illicit any kind of response from without having the corresponding key (preloaded onto the phones themselves).
The only real use for ICMP echo these days is to check the reachability of a device that you know is a) unfirewalled and b) on the same network segment. Anything else is just likely to yield misinformation.
Current location, calls made, call received. Your mobile operator already knows these things - just not as conveniently. You could not sue about this collection, as it is nothing new above the information that your carrier already has (and could be produced for law enforcement).
However, key-presses, messages, app usage. That's spooky stuff.
"leaves open the possibility that earlier iDevices"
no, it means what apple said, that if your iDevice has iOS4 or earlier still, then you might have CarrierIQ running on there.
but as has been pointed out elsewhere, the resources that CarrierIQ is able to snoop on under iOS are much less than those it can report back when running on Android.
Your phone needs to be rooted to enable some of the functions, including any disabling. I *think* you have to pay for a key to unlock the disabling functions. That being said, my Google phone has nothing on it that app can identify, but my HTC Desire S has.
Mine's the one with two phone in the pocket - DOh!
"He also dug up this page, which appears to show IP address lookups for the subdomains vzw-collector.demo.carrieriq.com, vzw-dis.demo.carrieriq.com and hupload-vzw99.carrieriq.com."
The logical assumption would be these were created as part of a marketing presentation to VZW to get them on board as a customer, don't ya think? Perhaps VZW even did a trial implementation to see what they thought of the service. With all the uproar we'll probably never get an admission from VZW as to the origination of them.
"an independent researcher has documented secretly monitors users' key presses even when they're entered into webpages protected by the SSL protocol."
Gosh, and there was me thinking that even if I should out my username, password and PIN when logging into my online banking it doesn't matter because the connection between my browser and the server is encrypted.
This is meant to be a technical website, if you think that a keylogger on your machine is going to be prevented from logging just because you are using an HTTPS connection then quite frankly I think you're in the wrong place. And shame on the Reg for such Daily Mail-esque reporting.
"even when they're entered into webpages protected by the SSL protocol".
SSL is protecting the transport of information. It is not designed, intended, or able, to protect against a key logger. 3 articles on this have all made this sensationalist statement, as though it is in some way breaking the security that SSL provides. If I had a key logger on my PC it would also be able to read things typed into a web page 'protected by SSL', because SSL is protecting me from bad people outside of my PC, not the bad people on it.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
