Secret app on millions of phones logs key taps • Hacker News Board

Re: Secret app on millions of phones logs key taps

#21

Post by interlagos » Wed, Nov 30, 2011, 4:34 PM UTC

hackoder wrote: post #19

interlagos wrote: post #11

Earlier quoted context omitted.

>All user data (since it is a keylogger?) being logged and sent to a third party without user knowledge or consent Where does anyone say that it is being sent to a third party? This rather noob-ish developer noted that they have a keyboard hook, but in no way does that mean that they send all of your keystrokes to a third party. Honestly I think I expect too much from HN. The level of discourse on here is absolutely…

I dont see how meta comments on HN help the discussion? Directly from the article: > “Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.” The issue is, we don't know what this software is gathering and sending. It is not being done with consent. But you're right, this needs to be looked into before gettin…

I'm sure people consented through some random paragraph in a two hundred page long EULA, usually under the guise of quality monitoring.

The meta is pertinent. I expect the sort of knee-jerk reaction among non-software developers. I don't among a more educated in the realm crowd.

There is little chance this company is recording, much less transmitting, everything you type, every message you receive, etc. I would hazard a guess that they do, however, record basic usage patterns to let the carrier know how people are using their devices ("6975 characters average per day, send 256 messages while receiving 12. Spends an average 37 seconds in the dialer.").

Re: Secret app on millions of phones logs key taps

#22

Post by dignan » Wed, Nov 30, 2011, 4:35 PM UTC

funkah wrote: post #17

Before reading, I guessed that "millions of phones" meant millions of Android phones. Because if this was happening on iPhones, that would merit mention in the headline. Funny how that works.

FTA: "Eckhart said he chose the HTC phone purely for demonstration purposes. Blackberrys, other Android-powered handsets, and smartphones from Nokia contain the same snooping software, he claims."

It's not "Android" phones alone, it seems like everything but iPhones and Windows phones. Thus, the title is accurate.

Re: Secret app on millions of phones logs key taps

#23

Post by kayzee » Wed, Nov 30, 2011, 4:37 PM UTC

mcritz wrote: post #2

Remember when people were up in arms about how much location data iPhones stored locally? This is 1000 times worse.

I agree with this (maybe not 1000x worse, but still).

Anything Apple does wrong is blown out of proportion. Yes the Apple collected data wasn't encrypted, but now it is.

What if this data is compromised at this CIQ company? I hope the data is traceable to an IMEI number ONLY which would make it okay, but still! Why do they need to receive text messages coming in to the phone???

Re: Secret app on millions of phones logs key taps

#24

Post by DevX101 » Wed, Nov 30, 2011, 4:41 PM UTC

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network.

If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for 30 seconds[1]:

Carrier IQ's Mobile Service Intelligence Platform (MSIP)...receives raw data (known as Metrics) from phones and converts them into reliable, repeatable Measures which feed into analytic applications.

Or you can read this comment from a discussion last week where a CarrierIQ recruiter told an HN member that they collect 10s of gigabytes of data PER DAY.[2]

These guys are indeed collecting RAW DATA from actions on your phone. There are tremendous opportunities for abuse here, should CarrierIQ decide to do so. CarrierIQ in blatant violation of privacy norms and could do enormous damage to national security of many countries, conduct corporate espionage, or simply violate the citizens' expectation of privacy when using their phone.

This is dangerous and should be stopped immediately.

1. http://www.carrieriq.com/overview/mobileservice/index.htm 2. http://news.ycombinator.com/item?id=3264264

Re: Secret app on millions of phones logs key taps

#25

Post by EwanToo » Wed, Nov 30, 2011, 4:45 PM UTC

DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB.

From your link to the recruiter:

Each handset collects and reports 100's of metrics of device and user behavior in real time.

That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.

Re: Secret app on millions of phones logs key taps

#26

Post by jgrahamc » Wed, Nov 30, 2011, 4:49 PM UTC

DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's realistic that they are sending all my URLs, all my keystrokes etc. in a few hundred bytes.

Re: Secret app on millions of phones logs key taps

#27

Post by law » Wed, Nov 30, 2011, 4:50 PM UTC

jgrahamc wrote: post #12

Does it really? http://blog.jgc.org/2011/11/getting-little-tired-of-security... There's no evidence that it sends this information to the company and no evidence that it actually logs it. Only that APIs are called containing it.

The part about logging/transmitting personal info is a red herring. The real issue is failing to provide an opportunity for users to assent to the installation of this software on their device. It makes no difference to me whether data is being logged or transmitted over a network. However, I'm terrified that a phone manufacturer would install a very hidden program with root-like privileges, offering a single point of failure. A malicious user could potentially exploit this program's vulnerabilities to access everything on your phone.

Re: Secret app on millions of phones logs key taps

#28

Post by mootothemax » Wed, Nov 30, 2011, 4:59 PM UTC

jgrahamc wrote: post #26

DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

I don't think it's realistic that they are sending all my URLs, all my keystrokes etc. in a few hundred bytes.

I tend to agree with you, but at the same time wonder how they're aggregating the data; they could store each day's raw data in however many GB, then crunch it down later.

The only other potential issue that jumps out at me is bandwidth; I'd find it strange if the data isn't being compressed, but if it is, you could cram quite a lot of useful information into those few hundred bytes ;)

Re: Secret app on millions of phones logs key taps

#29

Post by kevin_jacobs » Wed, Nov 30, 2011, 5:00 PM UTC

As a WP7 user, I emailed HTC yesterday asking whether or not this software (or similar products) are used on their WP7 devices. Here's the response I got:

"Dear Kevin Jacobs,

I understand you would like more information about the Carrier IQ software, or any software of this nature on your device. I understand your concerns about this issue and protecting my privacy is definitely one of my top priorities as well.

We have not had any reports of any kind of software like this on any Windows Phone 7 device. This type of software has been used on Android devices, but since Microsoft developed this operating system I am sure they did not include any software of this kind.

Let me know if I have successfully answered your question, please click here to complete this.

To send a reply to this message, please click here.

Sincerely,

Kathleen

HTC"

Re: Secret app on millions of phones logs key taps

#30

Post by babebridou » Wed, Nov 30, 2011, 5:00 PM UTC

I just checked on my Motorola Atrix. I didn't see any CarrierIQ process, but the Blur framework is logging tons of stuff on ADB, such as all key inputs for the autocompletion software or every swipe movement on the home screen, but no https query appear to be logged at first glance. "Search Intent" terms on the other hand are logged. I never really trusted Blur because until the latest few versions of the ADT the LogCat console was messed up with debug messages from EON & Blur and it was a pain to keep it somewhat static and readable for my own devs, but these couple reports on keylogging frameworks make me look twice at my own phone now.

I'd like to run wireshark to check out what's really going out of my phone when I'm on the wifi - I'm a bit of a novice in that area (network monitoring), does anyone have any pointers of things to look for?