Google all the way, Android rules.

You love to hate google, well, try again.

Do Posts with links in them do not get published?  I ask because I submitted a Post over 18 hours ago with a very detailed write up of what I think might of happened around this Carrier IQ business and it has been in the “waiting to be approved by moderator” state since then.  The Post had links to all my reference material.

Could a moderator please review it?  Thanks.

Though the entire issue is stupid. You’d think they can track performance on their side, and if they did need to track from user devices, it would be an opt-in AND designed by them so they can’t get any backfire from another company tracking a whole bunch of stuff.

I guarantee that data is indeed stored on the local disk.  In the training video labeled “device to packages to metrics” you see an “Upload Reason” column in the data grid. Some of the entries are labeled as “Archive Full”.  What this implies is that the application records and archives some amount of data when in an offline mode, meaning no cell tower coverage.  It then pushes the data across the wire when the archive is full and the device has cell phone coverage again.

It would be a worthless product if they were incapable of reporting crashes while you didn’t have cell phone coverage, thus the reason why they have to archive it.  This is standard practice for mobile applications, log locally when out of range.  Any decent mobile app has to expect that there will not be cell phone coverage 24×7 so you must log locally until you get coverage again.

Can I prove they log locally while not having cell coverage? No, but just imagine the scenario that your phone crashes under this hypothetic condition of 1) you are not in cell range 2) you start some app, ie Netflix.  How would the service providers, Carrier IQ’s customer, ever know that this condition causes problems if Carrier IQ isn’t logging to disk when out of coverage?  Isn’t the whole point of the product to track and report problems?

The training videos, I think produced outside of the US, clearly show a date of 2007 and 2009 so this has been out in the wild for quite some time and has given hackers plenty of time to do their deeds.

As stated in the article above (and many others), this is software that is loaded on by the carriers.

The video shows keypresses being logged to a verbose logcat over a USB cord in debug mode. That’s not even close to sending every key press over a non-secure channel.

It’s shocking how poorly the media is covering this. There may be a key logger here. Carrier IQ may be stealing all your text messages and saving them somewhere. Or maybe not. Setting up an event handler that verbosely logs events isn’t a great programming practice, but it’s neither a rootkit nor a keylogger. Your keys are logged in multiple places throughout every single operating system, sometimes from the os, sometimes a third party module compiled in (carrier IQ). That’s just the way operating systems work. Normally, the keys are not logged verbosely, but it’s hard to call that a vulnerability as you need to put the phone in debug mode and connect a usb cable to it to even see that data.

However, my guess is that they aren’t because it wouldn’t be that hard to really test what data is being logged and what is being sent home. You can simply run the phone for a while, and then inspect the phones harddrives for Carrier IQ’s file and run a network packet capture program to capture all the data being sent from your phone (over wifi, it’s a little trickier over the cell network, but probably possible). The fact that no one has been able to do this yet and the second video still didn’t actually prove anything, sort of implies to me that there really is nothing that sinister going on her. Your mileage may vary.

And why so secretive? Why not make it a visible opt in? I’ve turned off the Diagnostics and Usage option on my iphone, thereby shutting it off, but apparently the option to do so is not available to Android and RIM users.

Iphone users? eh, good luck with the jailbreak

i hope the government / military looks into this

this could be a big national security hole

even if unintentional

someone really has to look at what this thing can do and how other can exploit this hole.

this is my biggest concern. when i first read about it and saw the video, i though omg, all the very sensitive stuff being transmitted and this looks like a hole that can be exploited by hackers or worse.

i was so concern that i wrote a letter to my senator and send him all the details i could find

think about it law enforcement, lawyers, judges, prodectors, local, state, federal government officials and staff, military officials from the highest rank down to the lowest, heads of corporations. all use cell phones and pass some very sensitive and important communications

think about something like troops being called up and deployed and moved around and all of it going over phone calls over cell phones and this software eavesdropping on the communications

perhaps the company is honestly not transmitting it or storing it or using it, but why have software that can that perhaps hackers or worse can exploit.

i can understand if i had called my carrier with a problem or they saw a problem on the network they could activate this sort of stuff or law enforcement, but all the time, down to the keystroke, getting request / response, messages, ect, regardless of wheter its currently transmitted, stored and used.

and no opt out, way to uninstall but to root the device and void the warrenty and done clandestinely