ABOUT WARE: CarrierIQ

Mostrar mensagens com a etiqueta CarrierIQ. Mostrar todas as mensagens

sábado, 3 de dezembro de 2011

Carrier IQ faces lawsuits, lawmaker seeks FTC probe

01:07 António Carreiro No comments

Larry Lenhart, CEO of Carrier IQ, talks about the software in this promotional video. The company is facing lawsuits and potential regulatory probes over its mobile diagnostic software that critics say violates user privacy.

Larry Lenhart, CEO of Carrier IQ, talks about the software in this screenshot of a promotional video. The company is facing lawsuits and potential regulatory probes over its mobile diagnostic software that critics say violates user privacy.

(Credit: Carrier IQ)

Carrier IQ's woes continue to multiply.

The Mountain View, Calif., startup now faces four lawsuits over allegations that its cellphone software violates the privacy of mobile users. A congressman has also asked the U.S. Federal Trade Commission today to investigate those charges.

The developments aren't terribly surprising given the media firestorm around Carrier IQ, which programmer Trevor Eckhart alleges records keystrokes from mobile phones and sends all sorts of personal information off the phone. Carrier IQ denies that and says limited data is gathered for diagnostic purposes only. (CNET has a FAQ with more detailed information about exactlywhat Carrier IQ is doing to your mobile device.)

A lawsuit filed today in federal court in San Jose, Calif., alleges that Carrier IQ "is involved in installing spyware on mobile phones and using that hidden software to siphon off private consumer data without consumer consent," attorney Ira Rothken told CNET. The suit accuses Carrier IQ of violating various federal and state laws, including the California Anti-Spyware Statute and the right to privacy provision of the California Constitution.

A separate suit filed in the court yesterday targeted Carrier IQ and phone makers HTC and Samsung, also alleging violations of the Federal Wiretap Act and California's Unfair Business Practice Act. "The lawsuit alleges that, in reality, the program does record keystrokes and the content of messages, and could transmit the information to third parties, possibly including information sent to secure websites using HTTPS security protocols used in e-commerce and other security-sensitive sites such as banking," according to a statement plaintiff attorney Steve W. Berman released today.

Lawsuits also were filed in Chicago and St. Louis yesterday against Carrier IQ, HTC and Samsung for alleged violation of the Federal Wiretap Act, according to Paid Content. The law forbids the interception of "oral, wire or electronic communications." Penalties are $100 per day per violation.

"The company has not seen or been served on any lawsuit, so we cannot comment on the allegations at this time," Carrier IQ said in a statement today. "Carrier IQ is aware of various commentators alleging Carrier IQ has violated wiretap laws and we vigorously disagree with these assertions."

Meanwhile, Rep. Edward Markey (D-Massachusetts) asked the FTC to investigate the Carrier IQ situation. "This software raises a number of privacy concerns for Android, Blackberry, and Nokia users," Markey wrote in a letter to the commission. "Consumers neither have knowledge of this data collection, nor what Carrier IQ intends to do with this information. As a co-Chair of the Congressional Bi-Partisan Privacy Caucus, I am concerned that this practice violates the privacy rights of consumers."

The data regulator in Germany has sent a letter to Apple requesting further information, according to the Paid Content report. Apple said yesterday that it stopped using Carrier IQ before releasing iOS 5 last month and will remove it entirely from its products in a future software update.

The Consumer Watchdog activist group asked the U.S. Justice Department and the Federal Communications Commission to investigate the "Spyphone Scandal." "The probe should extend beyond the software developer, Carrier IQ, and include operating systems developers like Google and Apple as well as carriers and device manufacturers, the nonpartisan, nonprofit public interest group said.

Sen. Al Franken, a Minnesota Democrat, sent a letter to Carrier IQ yesterday asking it to answer questions about the data it gathers by December 14.

The lawsuits do not name the carriers, despite the fact that Carrier IQ says it is merely doing their bidding. The carriers decide what types of data to collect, how much and when, Andrew Coward, vice president of marketing at Carrier IQ, told CNET. The carriers ask the device manufacturers to pre-load the software on their phones.

So far, Verizon says it does not use Carrier IQ, while Sprint, AT&T and T-Mobile say they use it to improve network performance.

"T-Mobile utilizes the Carrier IQ diagnostic tool to troubleshoot device and network performance with the goal of enhancing network reliability and our customers' experience," the carrier said in a statement sent to CNET today. "T-Mobile does not use this diagnostic tool to obtain the content of text, email or voice messages, or the specific destinations of a customers' internet activity, nor is the tool used for marketing purposes."

Nokia and BlackBerry maker Research in Motion say they do not pre-install Carrier IQ on their phones, while HTC, Samsung and Motorola say they pre-install it at the carrier's request. Google, meanwhile, says it does not use it on Nexus devices.

Carrier IQ is getting vilified for making a "rootkit keylogger" while carriers are the ones in control of the data, which is collected without notice to or permission from users.

How Carrier IQ was wrongly accused of keylogging

00:59 António Carreiro No comments

In just a handful of days, a startup company named Carrier IQ has been subjected to extraordinary public vilification, with reports accusing it of making a "rootkit keylogger" that "creeps out everyone" or is the "rootkit of all evil."

The only problem, which is always a risk when a public lynching takes place, is that Carrier IQ appears to be not guilty of the charges lodged against it.

The most serious charge against Carrier IQ, a venture capital-funded startup in Mountain View, Calif., that makes diagnostic software for carriers, has been that it records keystrokes and transmits them to carriers. One article on a Mac Web site breathlessly reported that "Carrier IQ probably violated federal wiretap laws in millions of cases." (See CNET's FAQ and related articles.)

Well, no. There's zero evidence that Carrier IQ captured, recorded, or transmitted any keystrokes. But that didn't stop the self-appointed lynch mob on blogs and on Twitter (#OccupyCarriers, that would be you).

Dan Rosenberg, an exceptionally talented security consultant who has discovered more than 100 vulnerabilities in the Linux kernel, FreeBSD, and GNU utilities, extracted a copy of Carrier IQ's software from his own Android phones. He then analyzed the assembly language code with a debugger that allowed him to look under the hood.

"The application does not record and transmit keystroke data back to carriers," Rosenberg told CNET. His reverse-engineering showed that "there is no code in Carrier IQ that actually records keystrokes for data collection purposes."

Carrier IQ has given Rebecca Bace, a well-known security expert who's advised startups including Tripwire and Qualys, access to the company's engineers and internal documents. (Bace says she has no financial relationship with Carrier IQ.)

Bace told CNET that: "I'm comfortable that the designers and implementers expended a great deal of discipline in focusing on the espoused goals of the software--to serve as a diagnostic aid for assuring quality of service and experience for mobile carriers."

Threatening to sue a security researcher, even a newly minted one, isn't exactly the way to make friends nowadays--especially after the last decade has seen a parade of ill-received threats from Cisco Systems, Hewlett-Packard, voting machine makers, and the Recording Industry Association of America.Andrew Coward, Carrier IQ's vice president for marketing, acknowledged last night that the company may not have taken the best approach in responding to public criticism, which started with a blog post by Trevor Eckhart, a 25-year old system administrator in Connecticut who noticed unusual software on HTC Evo devices. He dubbed it a rootkit, leading to legal threats from Carrier IQ, an intervention by the Electronic Frontier Foundation, and an embarrassing bit of backtracking a few days later.

That legal threat, not unreasonably, led critics to assume the worst. "That's really been part of our challenge in responding to the allegations," Coward told CNET. The company decided it needed to be more forthcoming after "going back and saying, 'No, we don't, no we don't,' which is where we started, didn't really work." (The company also released a public statementyesterday.)

There's now a "vast misunderstanding of what we do," Coward says.

This won't have been the first time a company was subjected to an Internet-wide rush to judgment. In March, Samsung was cleared of false allegations lodged by a security specialist who claimed that keylogging software was installed on two of the company's laptops. Network World, which published the unverified accusations, subsequently deleted the original article.

The real privacy issues
That Carrier IQ is innocent of the keylogging accusation, the most serious charge, does not, however, mean there are no privacy concerns.

Coward acknowledged that the company's software, which is designed to be installed by carriers, can report back what applications are being used and what URLs are visited. Carrier IQ doesn't make these decisions; rather, they sell configurable software and the carriers decide what options to enable.

"It's up to them whether they do or don't collect that information," Coward says.

The information is used to summarize how the device is working so carriers can improve their networks, he said. It also helps them when they're forced to field calls from outraged customers wondering why their handset keeps crashing or runs out of battery life in a few hours.

Typically the data dump to a carrier is configured to be sent daily, either over Wi-Fi or the carrier's networks, Coward said. "The device ends up storing about 200 kilobytes of data," he says. "That's typical upload size. When it gets to the point that it's full, it'll do an upload or it'll drop data and start wrapping and store summary information." (Customers aren't charged for the upload, and it's disabled when the phone is roaming.)

It's true that carriers already know what URLs you're visiting when you use their network--meaning that, in many cases, Carrier IQ can be configured to send them data they already have. Privacy concerns arise when a list of URLs is stored on the device and accessible to forensic analysis, when a list of URLs visited on a Wi-Fi network is transmitted, or when encrypted HTTPS URLs are leaked. (Remember, Apple's log of locations accessible to forensic analysis landed it in hot water earlier this year.)

In this case, the software can be configured to send data directly to the carriers or to Carrier IQ's data center. "The data is not controlled by us, regardless of which model is used," Coward says. "We have no rights to the data. We cannot sell it, lease it, rent it, share it. The operators are extremely strict about that, as you might expect."

Because the Carrier IQ software can be configured to send information about URLs and active applications, it's the carriers themselves who owe their customers an explanation. Whether it's a serious privacy concern depends on how well they disclose to their customers that such monitoring is possible (which doesn't seem to be the case). Or whether an easy opt-out mechanism is available (ditto).

Sprint said yesterday that: "We collect enough information to understand the customer experience with devices on our network and how to address any connection problems, but we do not and cannot look at the contents of messages, photos, videos, etc., using this tool."

That doesn't provide enough details to understand what's going on. Nor does AT&T's statement, which merely says that Carrier IQ is used in accordance with the company's privacy policies.

But when Sen. Al Franken, the Minnesota Democrat, wrote a letter (PDF) yesterday asking what data are collected, he didn't address it to Sprint and AT&T, who combined have probably the most influential lobbying operation in the nation's capital. In his own letter (PDF) today, Rep. Ed Markey, the Massachusetts Democrat, didn't either.

That's a shame. The carriers should be more forthcoming. And the politicians and class action lawyers (two, at last count, have been filed) are taking aim at the wrong targets.

Controversy, confusion over Carrier IQ

19:11 António Carreiro No comments

week in review Controversy over a mobile data-logger flared this week, even though there's still confusion over how the software works and what data it transmits. Some security experts say the threat is overblown.

Carrier IQ, a company that provides tracking tools to carriers and phone vendors, came under fire for allegedly monitoring Android- and iOS-based smartphones. According to Androidresearcher Trevor Eckhart, an outspoken critic of the company's technology, the company's software running on Android devices can record and relay all kinds of information, including keystrokes, SMS messages in plain text, and even browsing history.

The company's software has also been found on the iPhone, running on every iOS version dating back to iOS 3. However, Apple responded yesterday, saying it hasn't used Carrier IQ since it released iOS 5 last month and will remove it entirely from its products "in a future software update."

BlackBerry maker Research in Motion also told CNET it has neither pre-installed Carrier IQ on its devices nor authorized carriers to do so.

Carrier IQ says the software is designed to give carriers usage and other stats so they can improve the network and service. Mobile security researchers CNET has spoken with say that they believe that the risk posed by Carrier IQ's software has been overblown. Just what is Carrier IQ's software doing on your phone? And do you really need to worry about it? CNET addresses those questions in this FAQ.
• Android app tells you if Carrier IQ is on your phone--kinda
• Cell-phone tracking mall operator has second thoughts

More headlines

FCC report slams AT&T's takeover of T-Mobile

Regulators say the proposed $39 billion wireless megamerger would lead to huge job losses and less competition. AT&T calls the decision to release the report "troubling."
• AT&T to FCC: You're totally 'one-sided' on T-Mobile deal
• AT&T and Deutsche Telekom discuss a plan B?
• AT&T hopes Leap deal will enable T-Mobile buy: report
• So what's T-Mobile's backup plan?
• AT&T and T-Mobile merger madness recap (FAQ)

Facebook privacy practices get FTC shakeup

To settle charges of deception, Facebook agrees to get consumers' permission before it changes the way it shares their information.
• Facebook's FTC settlement won't change much, if anything