Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

BUSTED! Secret app on millions of phones logs key taps
The Register (UK) ^ | 30th November 2011 | Dan Goodin

Posted on 11/30/2011 2:14:08 AM PST by Mount Athos

An Android app developer has published what he says is conclusive proof that millions of smartphones are secretly monitoring the key presses, geographic locations, and received messages of its users.

In a YouTube video posted on Monday, Trevor Eckhart showed how software from a Silicon Valley company known as Carrier IQ recorded in real time the keys he pressed into a stock EVO handset, which he had reset to factory settings just prior to the demonstration. Using a packet sniffer while his device was in airplane mode, he demonstrated how each numeric tap and every received text message is logged by the software.

Ironically, he says, the Carrier IQ software recorded the “hello world” dispatch even before it was displayed on his handset.

Eckhart then connected the device to a Wi-Fi network and pointed his browser at Google. Even though he denied the search giant's request that he share his physical location, the Carrier IQ software recorded it. The secret app then recorded the precise input of his search query – again, “hello world” – even though he typed it into a page that uses the SSL, or secure sockets layer, protocol to encrypt data sent between the device and the servers.

“We can see that Carrier IQ is querying these strings over my wireless network [with] no 3G connectivity and it is reading HTTPS,” the 25-year-old Eckhart says.

The video was posted four days after Carrier IQ withdrew legal threats against Eckhart for calling its software a “rootkit.” The Connecticut-based programmer said the characterization is accurate because the software is designed to obscure its presence by bypassing typical operating-system functions.

In an interview last week, Carrier IQ VP of Marketing Andrew Coward rejected claims the software posed a privacy threat because it never captured key presses.

“Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.”

Coward went on to say that Carrier IQ was a diagnostic tool designed to give network carriers and device manufacturers detailed information about the causes of dropped calls and other performance issues.

Eckhart said he chose the HTC phone purely for demonstration purposes. Blackberrys, other Android-powered handsets, and smartphones from Nokia contain the same snooping software, he claims.

The 17-minute video concluded with questions, including: “Why does SMSNotify get called and show to be dispatching text messages to [Carrier IQ]?” and “Why is my browser data being read, especially HTTPS on my Wi-Fi?”

The Register has put the same questions to Carrier IQ, and will update this post if the company responds. ®


TOPICS: Crime/Corruption; News/Current Events
KEYWORDS: smartphone; smartphones; spyware

1 posted on 11/30/2011 2:14:12 AM PST by Mount Athos
[ Post Reply | Private Reply | View Replies]

To: Mount Athos

“All your key taps are belong to us—and everything they say, including all your passwords.”


2 posted on 11/30/2011 2:19:01 AM PST by aruanan
[ Post Reply | Private Reply | To 1 | View Replies]

To: Mount Athos

Interesting video at 7:00
http://www.youtube.com/watch?feature=player_embedded&v=T17XQI_AYNo


3 posted on 11/30/2011 2:20:40 AM PST by Mount Athos (A Giant luxury mega-mansion for Gore, a Government Green EcoShack made of poo for you)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Mount Athos

Obama knows all!


4 posted on 11/30/2011 2:27:59 AM PST by appeal2 (Don't steal, the government hates competition.)
[ Post Reply | Private Reply | To 3 | View Replies]

To: appeal2

Yeah.... omni-evil


5 posted on 11/30/2011 2:37:55 AM PST by Donnafrflorida (Thru HIM all things are possible.)
[ Post Reply | Private Reply | To 4 | View Replies]

To: Mount Athos

I expect government all over the world to sue this company into oblivion over this, if true! Ought to interesting to see how the company responds!


6 posted on 11/30/2011 2:44:25 AM PST by rawhide
[ Post Reply | Private Reply | To 1 | View Replies]

To: Pontiac

for later


7 posted on 11/30/2011 2:58:25 AM PST by Pontiac (The welfare state must fail because it is contrary to human nature and diminishes the human spirit.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: rawhide
I expect government all over the world to sue this company into oblivion over this, if true!

If it is true that it is on all smart phones it should be all of the smart phone manufacturers that are sued

These phones came preloaded with the software.

8 posted on 11/30/2011 3:00:35 AM PST by Pontiac (The welfare state must fail because it is contrary to human nature and diminishes the human spirit.)
[ Post Reply | Private Reply | To 6 | View Replies]

To: Mount Athos

NSA backdoor?


9 posted on 11/30/2011 3:11:50 AM PST by Petruchio (I Think . . . Therefor I FReep.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: aruanan

Carrier IQ withdraws ‘misguided’ cease-and-desist letter, apologizes to security advocate TrevE

http://www.androidcentral.com/carrier-iq-withdraws-misguided-cease-and-desist-letter-apologizes-security-advocate-treve


10 posted on 11/30/2011 3:14:44 AM PST by A. Morgan (Ayn Rand: "You can avoid reality, but you cannot avoid the consequences of avoiding reality.")
[ Post Reply | Private Reply | To 2 | View Replies]

To: rawhide
Ought to interesting to see how the company responds!

They already responded right in the article. They are trying to muddy the waters (of course) by claiming it's not done real time. The issue is not real time or not, its the snooping, theft and storage of person information. IIRC Apple just went through this, didn't they?

Coward went on to say that Carrier IQ was a diagnostic tool designed to give network carriers and device manufacturers detailed information about the causes of dropped calls and other performance issues.

11 posted on 11/30/2011 3:16:00 AM PST by expat1000
[ Post Reply | Private Reply | To 6 | View Replies]

To: rawhide

What makes you think it isn’t government demanding these back doors and collecting the data?


12 posted on 11/30/2011 3:18:02 AM PST by DB
[ Post Reply | Private Reply | To 6 | View Replies]

To: aruanan

“someone set us up the bomb?”


13 posted on 11/30/2011 3:32:10 AM PST by Bullish (Recovery won't begin until Obama loses HIS job.)
[ Post Reply | Private Reply | To 2 | View Replies]

To: Mount Athos

Root your phone and remove the app.


14 posted on 11/30/2011 3:36:48 AM PST by Blado (2008: Year Zero of the Zombie Apocalypse.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: expat1000

That’s like saying you’re not spying if you record video of someone rather than using a live feed.


15 posted on 11/30/2011 3:49:21 AM PST by FLAMING DEATH (Are you better off than you were $4 trillion ago?)
[ Post Reply | Private Reply | To 11 | View Replies]

To: Mount Athos
It sounds as if every enterprising British tabloid journalist must buy this app! (See Levenson Inquiry).
16 posted on 11/30/2011 3:51:26 AM PST by GAB-1955 (I write books, serve my country, love my wife and daughter, and believe in the Resurrection.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Bullish

Sounds like the motherload for identity thieves if this ever got hacked. This Carrier IQ company seems as shady as they get. Hope they get hammered by class action suits and put out of business.


17 posted on 11/30/2011 4:14:29 AM PST by BOBWADE
[ Post Reply | Private Reply | To 13 | View Replies]

To: rawhide

“I expect government...”

That’s funny right there. I expect “government” is precisely where it all started.


18 posted on 11/30/2011 4:44:24 AM PST by mo
[ Post Reply | Private Reply | To 6 | View Replies]

To: mo
App created for DHS, NSA, CIA, FBI and an additional 75,000 fed goobermint workers (2009-2010) to analyze all the info.........MS OS's all have certain 'hidden tweaks' than can be used to do much the same w/ any browser. LINUX and its apps are somewhat more secure in that respect, however, it is not impregnable in the hands of a skilled hacker.

This type of crap has been around a long time for 'security' reasons.

19 posted on 11/30/2011 5:16:20 AM PST by RSmithOpt (Liberalism: Highway to Hell)
[ Post Reply | Private Reply | To 18 | View Replies]

To: Mount Athos

Buy disposable phones, use them and toss them.

Or keep your smartphone as if its a pet scorpion, in time regardless it will sting you.

Its in its nature.


20 posted on 11/30/2011 5:19:31 AM PST by Eye of Unk
[ Post Reply | Private Reply | To 1 | View Replies]

To: Blado

details could prove useful for those who aren’t techies


21 posted on 11/30/2011 5:30:17 AM PST by phockthis
[ Post Reply | Private Reply | To 14 | View Replies]

To: Petruchio

Win7 has back doors put into the OS at the request of our US intel agencies.


22 posted on 11/30/2011 6:20:56 AM PST by Jack Hydrazine (It's the end of the world as we know it and I feel fine!)
[ Post Reply | Private Reply | To 9 | View Replies]

To: Eye of Unk

“Buy disposable phones, use them and toss them.”

I never quite understood how that has more than limited utility. It’s useful to a point as long as everybody doesn’t do it, but if everybody does it how do you keep up with the constantly changing phone numbers in order to call the people you want to call?


23 posted on 11/30/2011 6:32:49 AM PST by KrisKrinkle (Blessed be those who know the depth and breadth of their ignorance. Cursed be those who don't.)
[ Post Reply | Private Reply | To 20 | View Replies]

To: Mount Athos
Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.”

Oh, well, that makes me feel much better.


24 posted on 11/30/2011 6:43:40 AM PST by reagan_fanatic (A communist is just a liberal in a hurry)
[ Post Reply | Private Reply | To 1 | View Replies]

To: expat1000; Swordmaker
Apple just went through this, didn't they?
Why yes, now that you mention it, I think they did. In that case, AFAIK, only the privacy of location data was at issue. We are told here that CIQ is also a key logger and even a voice "wiretap."
Eckhart said he chose the HTC phone purely for demonstration purposes. Blackberrys, other Android-powered handsets, and smartphones from Nokia contain the same snooping software, he claims.
I notice the omission of any claim that CIQ spyware is in the iPhone.

25 posted on 11/30/2011 7:51:17 AM PST by conservatism_IS_compassion (DRAFT PALIN)
[ Post Reply | Private Reply | To 11 | View Replies]

To: Mount Athos

Where is the app to kill this?


26 posted on 11/30/2011 8:05:00 AM PST by US_MilitaryRules (Unnngh! To many PDS people!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: RSmithOpt
LINUX and its apps are somewhat more secure in that respect, however, it is not impregnable in the hands of a skilled hacker.

You site that the MS OS's have this built in and Linux is more secure, but the story here is about Android having it - which is Linux based.

27 posted on 11/30/2011 8:29:48 AM PST by 5thGenTexan
[ Post Reply | Private Reply | To 19 | View Replies]

To: 5thGenTexan

True.....there are several versions of LINUX however, and Android doesn’t use a full blown version.


28 posted on 11/30/2011 12:13:49 PM PST by RSmithOpt (Liberalism: Highway to Hell)
[ Post Reply | Private Reply | To 27 | View Replies]

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson