Most phones ship with rootkit

[SandEagle]

http://yro.slashdot.org/story/11/11/16/1517248/carrieriq-most-phones-ship-with-rootkit

http://www.xda-developers.com/android/the-rootkit-of-all-evil-ciq/

"According to a developer on the XDA forums, TrevE, many Android, Nokia, and BlackBerry smartphones have software called Carrier IQ that allows your carrier full access into your handset, including keylogging, which apps have been run, URLs that have been loaded in the browser, etc." Since this was submitted, a few more details have come to light. The software was designed to give carriers useful feedback on aggregate usage patterns, but the software runs as root and the privacy implications are pretty severe.

 

[jersiq]

So, I was browsing the first article where the evidence of the "metrics" (via a grainy ass picture) and I am failing to find any issue.

http://www.xda-developers.com/wp-content/uploads/2011/11/metrics.png?139d23

So, let's walk through the ones highlighted in green, as I assume those are the ones people are concerned about :shrug

Registration Message, access channel. -> Well duh, you phone has to register on the network, so the network knows where to inform you you have an incoming call. Unless you only want to make calls, right? The network also need to authenticate you as someone able to use their network.

Neighbor List Message -> well duh, your phone, in order to hand off between towers, needs to know the neighbors of the tower you are on. It is sent to the phone in a list.

PACA message -> not so much a duh, as it's a further CDMA parameter that most wouldn't know. Priority Access and Channel Assignment If you really want to look, here is a public 3GPP document which has references to PACA:
http://www.3gpp2.org/public_html/specs/A.S0007-A_v2.0.pdf

Send Burst DTMF message -> Color me silly, but the MTSO needs to know if the high low tones are DTMF (Dual Tone Multi Frequency) or not.

User Zone Update Request Message -> This goes back to mobility. In a particular geographic area there are multiple zones. As a mobile crosses into a different zone (also known as a paging area) the network need to know WHERE to contact the mobile in case of an incoming call. If you are really bored, look at the references here:

http://www.youtube.com/watch?v=S2HYOvh2kww

In Traffic System Parameters Message -> Wow, Imagine that, we are able to receive system information while in a call. How awesome is that? That means I can go from one cell site to another without having to hang my call up and restart it when I am in the vicinity of another site. Aren't those engineers so smart! Again for reference, look in the extended parameters as presented by Agilent:
http://wireless.agilent.com/rfcomms/refdocs/cdma2k/c2kla_settable_overhead_msgs.html#CIHCDBDI

Use browser search for Extended Parameters. Things like PN (this is important in CDMA), Mobile Country Code, Mobile Network Code. You kind of need these things to complete a call.

I am not going to go through the rest, as I have screwed with these parameters over the course of 10 years in the business. I don't know if they made that pic grainy on purpose, but those are all standard CDMA 2000 parameters, do a google search on most of the keywords.

 

[gsaldivar]

I was thinking the same thing, most of this looks like signal telemetry gathering. While it's *possible* to configure these tools to grab personal information, it doesn't look like that is the intent here...

 

[swanysto]

Most ROMS I have seen(at least for my phone) remove CIQ. We are going to have to get used to it. Civil Liberties are pretty much on their way out, and have been for a while. Even if the carriers are logging all our info, you think anything will get done to stop it? Most of it is for marketing purposes, but they could always just play the terrorism card.

 

[alent1234]

makes you think how good most of these ROM's work

 

[AstroManLuca]

Most ROMS I have seen(at least for my phone) remove CIQ. We are going to have to get used to it. Civil Liberties are pretty much on their way out, and have been for a while. Even if the carriers are logging all our info, you think anything will get done to stop it? Most of it is for marketing purposes, but they could always just play the terrorism card.

Yeah my phone has a custom ROM with CIQ removed.

One point I've heard raised before was who is going to sift through all this data that's being collected? I understand why a lot of people are uncomfortable at the prospect of their personal data being collected, but at some point, there is SO MUCH data being collected on SO MANY people that you're basically still anonymous anyway.