Be Excellent To Each Other

If the Carrier IQ scandal disturbed you, then prepare to be truly spooked: a Bureau of Investigative Journalism panel, headed by Wikileaks founder Julian Assange, says that surveillance companies are selling software that turns your smartphone into a spying tool. The software allegedly allows intelligence operations to take pictures without your knowledge, read and alter messages, and track your location.

Pratap Chatterjee of the Bureau of Investigative Journalism says that your phone can be used to record and upload data even when in standby mode. That data can include your location, images from your camera, and recordings of conversations. He said that iOS, Blackberry, and Windows Mobile (Windows Phone?) could run the spyware.

Assange was more blunt:

Who here has an iPhone, who has a Blackberry, who uses Gmail? Well you’re all screwed. The reality is that intelligence operations are selling right now mass surveillance systems for all those products.

The term intelligence operations conjures images of the CIA and MI5, but the documents specifically reference corporations, not governments. Businesses profiting from your private data is disturbing in itself, but if your every move and conversation is logged and processed on a server farm, it would be easy for governments to get access.

This isn’t the first time that privacy advocates have raised red flags about smartphone tracking. Earlier this year Apple released an iOS software update specifically to put out a location tracking media firestorm. More recently, US wireless carriers have been dodging and denying questions about the Carrier IQ software on Android and iPhones that may send user data — including keystrokes — to the company’s servers.

The panel’s allegations are the most sensational from 287 surveillance industry documents released today by Wikileaks. If you have the stomach, you can read them at the link below:

Jesus Diaz - If you have any decently-modern phone, everything you do is being recorded by hidden software lurking inside. It even circumvents web encryption and grabs everything — including your passwords and Google queries.

Worse: it’s the handset manufacturers and the networks who—in the name of “making your user experience better”—install this software without any way for you to opt-out. This video, recorded by 25-year-old Android developer Trevor Eckhart, shows how it works. This is bad. Really bad.

Fast forward to 9:00 for the damning sequence.

The spying software is developed by a company called Carrier IQ. In their site, the company says they are “the only embedded analytics company to support millions of devices simultaneously, we give Wireless Carriers and Handset Manufacturers unprecedented insight into their customers’ mobile experience.”

It seems like a good goal and, indeed, most manufacturers and networks agree: according to Eckhart, the spyware is included in most Android phones out there. Carrier IQ software is also included in Blackberry and Nokia smartphones, so it probably works exactly the same in those smartphones as well. It doesn’t even matter if your phone was purchased free of networks contracts. As Eckhart shows in this video, it’s always there.

The problem is that it does a lot more than log anonymous generic data. It grabs everything.

Carrier IQ’s software is installed in your phone at the deepest level. You don’t know it’s there. You are never warned this is happening. You can’t opt-in and you certainly can’t opt-out.

The commercial spyware sits between the user and the applications in the phone so, no matter how secure and private your apps are, the spyware intercepts anything you do. From your location to your web browsing addresses and passwords to the content of your text messages.

This even happens using a private Wi-Fi connection instead of the network’s 3G connection.

The company denied all this in a public statement (PDF):

While we look at many aspects of a device’s performance, we are counting and summarizing performance, not recording keystrokes or providing tracking tools

But the video clearly demonstrates that this is not true: Keystrokes submit unique key codes to Carrier IQ. Even secure connections are intercepted by the spyware, allowing it to record your moves in the open. These connections to the web are encrypted but, since Carrier IQ’s spyware sits between the browser and the user, it grabs it and sends it in plain text.

The spyware can even log your location, even if the user declines to allow an app to know where it is. The hidden Carrier IQ app ignores your desires, intercepts the data and gets your location anyway.

But what can you do to avoid this? Unfortunately, not much. The hidden spyware is always running, and there’s no option in any of the menus to deactivate it. Unless you’re a grade-A blackbelt hacker, you’re out of luck. Even Eckhart, who is a developer, finds it difficult to remove:

“Why is this not opt-in and why is it so hard to fully remove?”

It’s an excellent question. One that urgently needs an answer, from Carrier IQ, but especially from every handset manufacturer and network involved in this situation. [Android Security Test and Carrier IQ via Threat Level]

Image Credit: Android Spy Software

UPDATE: We’re still not 100 per cent sure if Carrier IQ is limited to the US, or affects other phone users around the world. But reading into this some more, it seems rooting your phone is one way to navigate around this issue.

UPDATE 2: Darrell Jones spotted the news that traces of Carrier IQ have been found in iOS, too.

UPDATE 3: Nokia’s PR agency gave us the following statement:

“I know you’ve followed today’s news that software from CarrierIQ has been found on Nokia devices. I wanted to quickly reach out following your story to let you know that in fact, CarrierIQ does not ship products for any Nokia devices. Therefore, these reports are inaccurate.”

Already largely debunked: http://latimesblogs.latimes.com/technol ... ivacy.html

Did you miss the bit where the independent security researchers who have partially reverse engineered the code agreed it wasn't scary?