Phones with preinstalled spyware CarrierIQ - maemo.org

nephridium | # 1 | 2011-11-17, 05:14 | Report

Just saw this post up on slashdot that claims "many" Android, Nokia and Blackberry phones come loaded with "rootkit" like spyware capable of logging and uploading user info such as key strokes, detailed app usage, web pages visited, location info etc. - all sorts of info certain people and organisations would pay a lot of money for.

Apparently it's all based on a tool called CarrierIQ, their website is very frank about their mission (emphasis mine):

Originally Posted by

CarrierIQ is the leading provider of Mobile Service Intelligence Solutions to the Wireless Industry. As the only embedded analytics company to support millions of devices simultaneously, we give Wireless Carriers unprecedented insight into customer's mobile experience.

Is this a bad joke? this seems to have been going on for quite some time without most people noticing. it's sad that there is no really free option for handset users. Sure, we could compile our own Cyanogenmod for Android or choose our own firmware for our Maemo devices, but as long as there are binary blobs there's no way to know for sure nothing fishy is happening in the background.

Has anyone here found this software on their device(s)?

The Following 8 Users Say Thank You to nephridium For This Useful Post:
Daneel, davedickson, demolition, Estel, ezameht, MartinK, netspionage, zdanee

pusak gaoq | # 2 | 2011-11-17, 05:48 | Report

you forget to add Apple on your list cause i believe apple were the one who started implant carrierIQ on all of they devices....

the truth is the is no software in our device that can give full detail what we are using in our devices but the program so called carrierIQ is implanted in our SIMS....its our SIMS that connected us with our carrier...that is how carrierIQ really works...all carrier got all details from our SIMS...

Using A Postpaid (contracts) with some carriers are most likely been monitor 24/7....

Last edited by pusak gaoq; 2011-11-17 at 05:52.

The Following 3 Users Say Thank You to pusak gaoq For This Useful Post:
anim1, netspionage, panjgoori

Estel | # 3 | 2011-11-17, 05:53 | Report

http://www.xda-developers.com/androi...on-carrier-iq/

No comment... I wonder how legal is that, in countries that regulate who and why can gather information (like Poland). Seriously, I'm going to investigate this legal-wise.

Last edited by Estel; 2011-11-18 at 21:09.

The Following 3 Users Say Thank You to Estel For This Useful Post:
demolition, IsaacDFP, PMaff

sulu | # 4 | 2011-11-17, 07:12 | Report

Wireshark (respectively the CLI variant tshark [1]) might be useful to examine the network traffic for unusual activity. Maybe somebody is interested to port it to some of our mobile pltforms. ;-)

[1] http://packages.debian.org/wheezy/tshark

The Following 4 Users Say Thank You to sulu For This Useful Post:
demolition, Estel, netspionage, strange1712

reinob | # 5 | 2011-11-17, 09:54 | Report

Originally Posted by Estel View Post

http://www.xda-developers.com/androi...on-carrier-iq/

No comment... I wonder how leag is that, in countries that regulate who and why can gather informations (like Poland). Seriously, I'm going to investigate this legal-wise.

Don't know for sure, but this looks like your typical US carrier thing, combined with Android's "openness" (my a**) and HTC/Samsung saying "me too" to everything they see.

Funny the articles always say "but also Blackberry and Nokia, etc." but at least after a cursory search I haven't found anything besides Android-related details.

Don't want to sound fan-boyish, but I'd bet that no unlocked Nokia (at least Symbian and Maemo) comes with that crap.

The Following 3 Users Say Thank You to reinob For This Useful Post:
Estel, GrimyHR, strange1712

vi_ | # 6 | 2011-11-17, 09:58 | Report

Originally Posted by reinob View Post

Don't know for sure, but this looks like your typical US carrier thing, combined with Android's "openness" (my a**) and HTC/Samsung saying "me too" to everything they see.

Funny the articles always say "but also Blackberry and Nokia, etc." but at least after a cursory search I haven't found anything besides Android-related details.

Don't want to sound fan-boyish, but I'd bet that no unlocked Nokia (at least Symbian and Maemo) comes with that crap.

Yup, up to at least the E72 (my last symbian) there was no spyware on a 'stock' Nokia.

Originally Posted by

Wireshark (respectively the CLI variant tshark [1]) might be useful to examine the network traffic for unusual activity. Maybe somebody is interested to port it to some of our mobile pltforms. ;-)

Bro! Wireshark AND tshark are ALREADY available for the n900!

Also,

OSS FTW!

The Following 10 Users Say Thank You to vi_ For This Useful Post:
demolition, Estel, GrimyHR, handaxe, MartinK, Mentalist Traceur, ste-phan, strange1712, sulu, zdanee

sulu | # 7 | 2011-11-17, 10:13 | Report

Originally Posted by vi_ View Post

Also,

OSS FTW!

chris_r | # 8 | 2011-11-17, 15:52 | Report

Originally Posted by pusak gaoq View Post

the truth is the is no software in our device that can give full detail what we are using in our devices but the program so called carrierIQ is implanted in our SIMS....its our SIMS that connected us with our carrier...that is how carrierIQ really works...all carrier got all details from our SIMS...

The program is too big to fit on a SIM card. It's embedded in the device's firmware. One way to get around this (on Android anyway) is to use a custom mod such as Cyanogenmod that neglects to include the CarrierIQ software.

See: http://androidsecuritytest.com/featu...ers/carrieriq/

The Following 6 Users Say Thank You to chris_r For This Useful Post:
Ashbeck, demolition, Estel, handaxe, shanttu, strange1712

anonymous | # 9 | 2011-11-18, 16:56 | Report

I wonder if Cherry has anything to do with it.

http://maemo.org/packages/view/cherry/
http://wiki.maemo.org/PR1.2_compulso...a_subscription

Weird little program that no one understands, sends SMS.

http://talk.maemo.org/showthread.php?t=57214
http://talk.maemo.org/showthread.php?t=56243

And yes, it still exists in the N9.
http://talk.maemo.org/showthread.php?t=73264

The Following 2 Users Say Thank You to anonymous For This Useful Post:
demolition, Estel

reinob | # 10 | 2011-11-18, 18:56 | Report

@anonymous,

AFAIK Cherry is like "My Nokia" for Symbian. You register (by sending an SMS, with PR1.2 it happened automatically..) and then you receive Nokia "spam" from time to time.

In short: nothing to do with the IQ thing!

The Following 3 Users Say Thank You to reinob For This Useful Post:
demolition, Estel, strange1712