How Carrier IQ was wrongly accused of keylogging

Please change title to "How Carrier IQ's PR Department is able to post articles on cnet".

"There's zero evidence that Carrier IQ captured, recorded, or transmitted any keystrokes"

...except the 17 minute Youtube Video that showed Carrier IQ capturing, and recording keystrokes.

Data really is an attractive nuisance. It is not too hard to see how many legitimate carrier questions could be answered to the benefit of consumers by having phones log data. Perhaps the simplest one is "Where do I have areas of weak coverage and so more dropped/distorted calls?" If a large percentage of the handsets can log GPS + signal strength info over a long period of time, the phones that are in suitcases (erroneously recording poor signal strength) and those in airplanes (erroneously recording great signal strength) will be balanced out by real world scenarios. Given 12 months of data (which covers various weather conditions, and correlating by date) one could quickly and efficiently decide where additiona transmitter/receiver resources should be deployed, and under what conditions it might make sense to bring up more resources and when you could shut them down (rain for example absorbs 1.5 - 2.5 Ghz radio signals.

Of course that information can be accumulated much more painfully by driving around in a van to pick up this information. And the quality will be both better and worse, better in the sense that a signal-quality-van could have equipment to evaluate the signal strength very accurately, but worse in that you wouldn't get the time of day and conditional variation from weather.

The 'attractive nuisance' aspect of it however comes into play when you've created a logging/monitoring platform and now you can collect other kinds of information. Like warrantless wiretappers who are unable to restrain themselves from listening in on conversations they have no reason to listen to, once the infrastructure is there the humans in the loop seem unable to prevent themselves from succumbing to their desire to 'know.'

I had a long discussion with some law enforcement types at a security conference along these lines (I was advocating outright bans on some of the tools they consider 'essential' for fighting crime). The economic cost of not using the tools is higher (higher taxes (to pay for more cops), higher phone bills (to pay for signal strength vans)) and, until it is actualized, only a "potential" risk of abuse. That is such a terribly hard equation for people to evaluate on instinct.

It should be noted that (having finally watched the video) what he is accusing Carrier IQ of is key logging, but he does not demonstrate key logging of the keyboard (he demonstrates key logging of two of the hardware keys and the numeric phone dialer, but never demonstrates the same behavior when using the virtual keyboard -- he does show that the unencrypted url is being sent (which means that the Carrier IQ software has hooks into the browser where it shouldn't) but does not demonstrate key logging of, say, a password typed into a web page on an encrypted connection.

If the article made this point it might have some credibility. As it is, it simply looks like Carrier IQ's PR department working overtime.

Turns out they aren't wrongly accused of keylogging. Carrier IQ, likely in partnership with either the Handset Vendor and/or the carrier were responsible for the storing of personal information.

Here is a pretty good quotation from their director of marketing: ""We're as surprised as anybody to see all that information flowing," Andrew Coward, Carrier IQ's director of marketing, told CNNMoney in an interview. "It raises a lot of questions for the industry -- and not [only] for Carrier IQ.""

Not keylogging does not absolve Carrier IQ. This article doesn't exactly say that, but it gives the impression that it's all one big misunderstanding from an overzealous "newly minted" security researcher.

That people jumped to conclusions that it was transmitting keystrokes, when "no no no, it merely has that potential, you see!" well, what do you expect?

I'm calling B.S. on carriers don't charge for your key-logging data.

My wire had some billing/technical issues and we worked through AT&T's data transmission logs, there were unexplainable uploads that seemed like telemetry or some kind of debugging. They denied it and told us it was our data uploads.

Now I know what that probably was ;)

Open up the tele-comm industry, this is really scare stuff!

Quote: It's true that carriers already know what URLs you're visiting when you use their network

Is that true for https?

Nobody ever accused carrier IQ of hacking the software onto the phones all by themselves.

Tracking all URLs is half as bad as tracking keys.

And forgive me if I don't find claims that it doesn't record the keystroke data that it's sent anyway in a customizable app very reassuring.

Isn't it a little early to say "wrongly," while the companies are still playing hot potato?

This reminds me of the story that the media ran hard on for "...hackers launched a cyber attack against a water facility in central Illinois."

More and more tech sites now are turning into these media engines that just want pageviews, their spinning a small story with very little facts into a Fox type news story, it's very sad to see, and will continue to happen, so they can be bought by the AOLs of the world.

The Russian hack never happened http://www.tgdaily.com/security-features/59984-the-russian-h...

How, in the same article, do you say "an expert examined the assembly of the software and determined there is no code that records or reports back" then follow that a little later with "carrier IQ doesn't make the decision, they provide the software with flags that the carriers can configure to record and/or report back".... These two statements don't really mesh up.

Who is Declan McCullagh and why should we believe he invented the Internet?

This is stupid. If they don't want to be accused of being a keylogger and/or rootkit, they should

(1) not allow keypress events to be sent to their software;

(2) force carriers to not hide their executable and show users what information they are collecting on their phones;

(3) keep a record of information, again to be shown to users on demand from the program installed on their phones, that has been uploaded;

(4) manage to answer simple questions, like (i) could you forward keystrokes, sms, ssh passwords, ssl passwords, etc, (ii) can your software contact your servers and download new control instructions, (iii) has this ever happened, (iv) under what circumstances would it happen

(5) easily give users the ability to shut down the flow of information and remove the program, including in all future updates

Really, this isn't rocket science.