Carrier IQ – The untold story
Somewhere sometime and for some reason
George had been waiting for this day to come for a long time. He had it all planned out, and as he sat motionless in a tree that was in a yard not his own, George suddenly wished that he was not quite so afraid of great heights and that it had not rained so much the night before, because he had almost slipped and fallen on his way up the tree. But it was worth it. Tonight, Stephanie would be home alone while her parents were out to dinner. “See you at 9 tonight honey and don’t forget to set the alarm. The password is 69347.” George smiled at the thought that people believed that their cell phone communications were private.
He could have found a way to get physical access to the girl’s cell phone, and he thought that it would have been a lot more fun that way. He could have knocked on the door pretending to be from the telephone company. “I am doing routine work in the area and oh by the way, do you or any of your family use a cell phone with our company?” he would say. And he knew that 99% of the time people would assume that he really was from the telephone company because of the fake uniform and so wouldn’t think twice before handing over every cell phone in the house. No not this time. He wanted to play it safe, and luckily for him, Stephanie’s cell phone already had just what he needed built in to the device by default so there was no need to install anything. It was already there and the average user would never find it because it was cleverly hidden. It loaded when she turned on the phone and there was no easy way to force it to quit. That is if she ever even knew it was there.
So his day had finally come. With his special device he put together one day, George was able to intercept any and all information going in or going out of Stephanie’s cell phone. He was even able to see what she was up to just by her using the device. What keys she pressed, what she typed, what web sites she visited, what her password was to her bank account, and most importantly now, the fact that her parents would be out to dinner until 9 pm and that the passcode for the home alarm was 69347. George was going to have fun tonight.
Carrier IQ – What took us so long to find it?
If you haven’t heard of Carrier IQ by now then you should find out about it. If, like me, you have only recently heard of Carrier IQ then apparently we are out of the loop because they have been around for a while. In fact, the first thing you will notice when watching their training video is that the copyright date is 2005-2007.
And what exactly is the company up to?
I did what any responsible information consumer would do and went to take a look at the Carrier IQ website myself.
When you head over to their overview page, you will see what it is exactly that Carrier IQ is selling.
What caught my eye was what they have to say about their Carrier IQ Insight Experience Manager.
Carrier IQ Insight Experience Manager
From the website itself:
IQ Insight Experience Manager
Boost Revenues with Improved Mobile Customer Experience
IQ Insight Experience Manager provides a level of visibility into true customer experience that was, previously unavailable in the mobile industry. Based on Carrier IQ’s leading Mobile Service Intelligence technology, IQ Insight Experience Manager uses data directly from the mobile phone itself to give a precise view of how users interact with both their phones and the services delivered through them, even if the phone is not communicating with the network.
With user experience increasingly viewed as the key differentiator between mobile providers, IQ Insight enables you to align your business improvements with the things customers truly value. Identify exactly how your customers interact with services and which ones they use. See which content they consume, even offline. Identify problems in service delivery, including the inability to connect to the service at all. This actionable intelligence enables you to focus on critical quality and customer satisfaction issues.
What are you doing CIQ?
Trevor Eckhart made a video (linked to at bottom) in which you can clearly see that CIQ is doing such things as:
- Hiding itself – by not showing up in the applications list
- Running whether or not you want it to – by not allowing you to disable or turn off the process.
- Recording what numbers your press when calling someone
- Recording, in plain text, the contents of your text messages
- Recording, in plain text, the search terms you type into a search engine even when that search is done through your wireless connection and by using SSH.
What are you REALLY doing?
It is my opinion that the use of CIQ or any other similar software service has nothing to do with actual diagnostics that would be useful in improving the quality of service for device customers and has more to do with collecting data on user behavior for the benefit of marketers, advertisers, and the intelligence community.
That was 2005 but this is 2012
If this is what they could do in 2005, then imagine what is going on now in 2012. When a week is a lifetime in terms of technological progression, then we really need to watch over ourselves more closely because, it seems, no one else is doing that for us.
Also, expect to see developers jump in by making software that supposedly looks for, disables, and prevents this type of thing. But in the end, who is to say that the ones creating the “security software” won’t be the same ones who are violating our privacy now.
Somewhere sometime and for some reason
Imagine that you are at a protest somewhere and the city sends in the police to clear out the peaceful protesters. You reach for your phone to send instant messages of the news to your friends and on Twitter but they never receive the message because it was intercepted and deleted before they ever received it.
- Download the Carrier IQ product information and training videos.
- Read more about Carrier IQ and its service offerings.
- Read story of how CIQ was found running on someone’s Mobile Phone on Androidsecuritytest.com
- Learn more about Mobile phone terminology such as Firmware, Stock & Custom ROMs, and Flashing, visit www.addictivetips.com article on it here
- Watch the YouTube Video of Carrier IQ in action
My neighbor was known for his wild parties. I could never sleep at night with all the crashing noises outside as he and his friends threw empty beer bottles against the brick wall. I tried calling him but he told me that it was a free country and that I should screw off. I couldn’t think of a way to get through to him so one day I started polishing my sniper rifle in the window opposite his house, like I always do but this time with the shades wide open. And Ill be darned; he hasn’t thrown a party since.
How a Game Theorist Might Look at SOPA
Sometimes it’s impractical to pick up the phone and have a talk with the world about what you would like to accomplish, so sometimes it’s a lot easier to find alternative means of sending your message. Something that is strong enough to get your attention but subtle enough to convey what it is that can’t be said outright.
We (the government) would like the ability to immediately deny access to a website that, shall we say,”endangers public health” and worry about the little details like court orders etc later.
SEC. 102. ACTION BY ATTORNEY GENERAL TO PROTECT U.S. CUSTOMERS AND PREVENT U.S. SUPPORT OF FOREIGN INFRINGING SITES.
(b) ACTION BY THE ATTORNEY GENERAL.—
(5) RELIEF.—On application of the Attorney General following the commencement of an action under this section, the court may issue a temporary restraining order, a preliminary injunction, or an in-junction, in accordance with rule 65 of the Federal Rules of Civil Procedure, against a registrant of a domain name used by the foreign infringing site or an owner or operator of the foreign infringing site or, in an action brought in rem under paragraph (2), against the foreign infringing site or a portion of such site, or the domain name used by such site, to cease and desist from undertaking any further activity as a foreign infringing site.
Now Before you object, let me tell you how we can make your life difficult if you choose not to cooperate with us.
(4) ENFORCEMENT OF ORDERS.– (A) IN GENERAL.—To ensure compliance with orders issued pursuant to this section, the Attorney General may bring an action for injunctive relief—(i) against any entity served under paragraph (1) that knowingly and willfully fails to comply with the requirements of this subsection to compel such entity to comply with such requirements; or
(c) ACTIONS BASED ON COURT ORDERS.—
2) REASONABLE MEASURES.
(A) SERVICE PROVIDERS.—
(i) IN GENERAL.—A service provider (also Internet Search Engines, Payment Network Providers, Internet Advertising Services) shall take technically feasible and reason- able measures designed to prevent access by its subscribers located within the United States to the foreign infringing site (or portion thereof) that is subject to the order, including measures designed to prevent the domain name of the foreign infringing site (or portion thereof) from resolving to that domain name’s Internet Protocol address. Such actions shall be taken as expeditiously as possible, but in any case within 5 days after being served with a copy of the order, or within such time as the court may order.
But we don’t REALLY want to make your life more difficult. Look harder and you will see.
(ii) LIMITATIONS.—A service provider shall not be required- I) other than as directed under this subparagraph, to modify its network, software, systems, or facilities; and
4) ENFORCEMENT OF ORDERS.—
C) DEFENSE.—A defendant in an action under subparagraph (A)(i) may establish an afirmative defense by showing that the defendant does not have the technical means to comply with this subsection without incurring an unreasonable economic burden, or that the order is not authorized by this subsection.
What do you say we forget the whole thing? But we will need a small favor from you. Do the job for us. It will be our little secret.
SEC. 105. IMMUNITY FOR TAKING VOLUNTARY ACTION AGAINST SITES THAT ENDANGER PUBLIC HEALTH.
(a) REFUSAL OF SERVICE.—A service provider, payment network provider, Internet advertising service, advertiser, Internet search engine, domain name registry, or domain name registrar, acting in good faith and based on credible evidence, may stop providing or refuse to provide services to an Internet site that endangers thepublic health.
(b) IMMUNITY FROM LIABILITY.—An entity described in subsection (a), including its directors, officers, employees, or agents, that ceases or refuses to provide services under subsection (a) shall not be liable to any person under any Federal or State law for such action.
Things aren’t always as they appear to be, and many different readers may interpret things in their own special way. Sometimes, if we watch very carefully, we may observe the magician’s secret while he is busy trying to keep us fixated on his other hand waving about in the air.
Solutions and Recommendations
- Read the bill for yourself.
- Don’t rely on second and third-hand interpretations from your favorite website (or even mine!)
- Don’t let others frame the issue for you because, before you know it, you will be looking at the issue in the way they want you to, which keeps you from seeing the real issue itself.
- Resist the urge to constrain your interpretations to only a few possibilities. Make a list of questions as you read that strike you as odd or that connect from one area of knowledge to the next. Have you seen any similar patterns before?
- Put yourself in the actors’ shoes. If you were in the shoes of each party, what would you do?
govtrack.us > Congress > Legislation > H.R. 3261: Stop Online Piracy Act
PDF version of SOPA I used for interpretation (mirror site)
Black Hat 2011: “Staring into the Abyss: The Dark Side of Security and Professional Intelligence” by Richard Thieme
Richard Thieme, esteemed writer, speaker, and thinker on important topics such as the relationship between culture and technology as well as the spiritual dimensions of technology, gave a fast-paced yet very deep talk at the 2011 Black Hat Convention held at Caesar’s Palace in Las Vegas.
Listen Carefully Or You Will Miss It All
One must listen carefully to Richard Thieme speaking because the talk is nested and there different levels of meaning. Thieme sets the stage by saying
“I’m going to try and build a bigger picture of the security world than we are usually in the habit of hearing described in all of the conferences we go to and try and look at some of the nested realities in which security is really taking place and ask ourselves whether the word security itself is appropriate to what is in fact the behaviors that actually take place inside the ‘security space.’”
The World Is Grey
We often hear of hackers being classified according to their “ethics” into White hat hackers, Black hat hackers, and Grey hat hackers but Thieme challenges the notion that the terms mean anything and that they can be so easily pigeonholed.
“As we grow and go through developmental changes, hopefully our view of things gets more sophisticated, more nuanced, more complex, and that usually means a greater sense of the grayness of all things. You hear about black hat hackers and grey hat hackers and white hat hackers and they are often defined imprecisely. “It’s all grey. The world is Grey. Distinctions that seemed clear and precise in our earlier life all go liquid on us and we realize that everything is not as binary as the code which is hackable.” “The truth is fudged all the time. We are all in it together; The world is grey. Hacking is a subset of the world, therefore hacking is grey.”"A black hat hacker is a hacker. A grey hat hacker is a hacker who knows when to fudge the truth; and a white hat hacker is a hacker who put the truth down somewhere and can’t remember where he put it.”
The Myth That Is Called Security
“So when we talk about the problems that confront security the weakest link in the chain is frequently the definition of the problem and the definition of the problem is really not what we think it is.”"Security vendors sell solutions that address our fears, real or imaginary, and they sell the tools that can do what they can do. They can’t sell the tools that can’t do what they can’t do.”"People lose the ability to think critically about information. People don’t know what is true so they believe simplest explanation that will secure their world so they can wake up in world that is same as when they went to sleep.”
The Problem Is Built Into The System Itself
Richard Thieme talks about being approached by a company that wanted him to work in the area of Brand Defense. It was explained to him that his job would be to create credible looking websites for the company where people could go to criticize the company or ask questions regarding a problem. Sound familiar? The goal was to control and direct the conversation in the direction that would be in the company’s own good. If someone got too close to the truth, Thieme stated, it was time to “blow it up” or to inflect the conversation.
Be real with yourself. Don’t let that nagging feeling go untended. Do not rely on others to take care of the issues you see, because then you give all your power away. If you see some odd process going on in the background of your computer or your mobile phone, don’t rely on your favorite website to update you on the news. Start learning more about computers. And don’t forget to get the free and useful tool Wireshark so you can get started yourself in seeing what the fuss is all about.
I Want To Hear More Of What Richard Thieme Has To Say
You can learn more about Richard Thieme on his personal website.
If you think hes speaking style is elloquent then you just might find his books fun to read as well. You can download kindle versions of his books on Amazon.com
Richard Thieme Books
Mind Games by Richard Thieme. (From Amazon.com Description) Mind Games is a unique collection of 19 stories of brave new worlds
and alternate realities – stories of computer hackers, deception and
intelligence, puzzling anomalies, spirituality and mysteries of
consciousness, the paranormal, UFOs, alien life forms – in short,
everyday life in the 21st century.
Islands in the ClickStream by Richard Thieme. (From Amazon.com Description) CNN called Richard Thieme “a member of the cyber avant-garde”. Digital Delirium named him “one of the most creative minds of the digital generation”. Now Richard Thieme’s wisdom on the social and cultural dimensions of technology is available in a single volume. “Islands in the Clickstream” ranges beyond the impact of technology to spirituality, psychological insight, and social commentary. Now that people are used to living in virtual worlds and move easily between online and offline worlds, they want to connect that experience to the deeper issues of our lives, including spiritual issues. Some examples include “Dreams Engineers Have”, “The Crazy Lady on the Treadmill”, and “Whistleblowers and Team Players”. These essays raise serious questions for thoughtful readers. They have attracted favorable commentary from around the world and a fanatic, almost rabid fan base.
YouTube Video | DEFCON 19: The Dark Side of Crime-fighting, Security, and Professional Intelligence
The speech was also given at Defcon 19, and as of December 1, 2011, can be seen on Youtube.