Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

31–40 of 193 posts

Re: Secret app on millions of phones logs key taps

#31

Post by DevX101 »

jgrahamc wrote: post #26
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

Whether they are sending a full log report of my actions TODAY is beside the main point.

I do however know two things. 1) That their local software processes almost every key stroke made. 2) And that they do send at least some portion of this data back to their servers.

At this point it would be trivial for them to send my private information TOMORROW if they decided to do so. I don't know that they don't have a subroutine to begin sending all of my SMS back to their servers if they decide to so for profit or under government coercion.

If they have no plans of using my Google searches, they shouldn't process it in the first place.

Re: Secret app on millions of phones logs key taps

#32

Post by adolph »

babebridou wrote: post #30

I just checked on my Motorola Atrix. I didn't see any CarrierIQ process, but the Blur framework is logging tons of stuff on ADB, such as all key inputs for the autocompletion software or every swipe movement on the home screen, but no https query appear to be logged at first glance. "Search Intent" terms on the other hand are logged. I never really trusted Blur because until the latest few versions of the ADT the Log…

I think in this instance the application Charles would be more helpful than Wireshark. See the below article for how someone analyzed wifi traffic from iPad:

http://waxy.org/2011/02/how_i_indexed_the_daily/

Re: Secret app on millions of phones logs key taps

#33

Post by CaptainZapp »

revscat wrote: post #16
runjake wrote: post #8

It should be noted that there's no evidence (yet) of what is sent to other entities, only what is captured by the software on the device. This is bad enough, though. But, let's keep our head about this and calmly demand an explanation from HTC. Why them? Because they signed the binaries with their certificate, presumably at the request of carriers, but HTC is the first in line. And don't believe the response from Car…

To be fair, the response from CarrierIQ implies that this is the case: "In an interview last week, Carrier IQ VP of Marketing Andrew Coward rejected claims the software posed a privacy threat because it never captured key presses. “Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.” Note that last clause…

And why exactly, should I believe Mr. Coward?

Besides: Reading weasel words like 'usually' in corporate statements just makes me shudder.

Re: Secret app on millions of phones logs key taps

#35

Post by drivebyacct2 »

EwanToo wrote: post #25
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.

Did you read any of the articles or watch the video?

The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes.

(edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, especially since it seems like makers of this type of software have piss-poor track records for their app security)

Re: Secret app on millions of phones logs key taps

#36

Post by runjake »

revscat wrote: post #16
runjake wrote: post #8

It should be noted that there's no evidence (yet) of what is sent to other entities, only what is captured by the software on the device. This is bad enough, though. But, let's keep our head about this and calmly demand an explanation from HTC. Why them? Because they signed the binaries with their certificate, presumably at the request of carriers, but HTC is the first in line. And don't believe the response from Car…

To be fair, the response from CarrierIQ implies that this is the case: "In an interview last week, Carrier IQ VP of Marketing Andrew Coward rejected claims the software posed a privacy threat because it never captured key presses. “Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.” Note that last clause…

What does it matter if it's real time or not? It's still creepy, and it's still my privacy.

Re: Secret app on millions of phones logs key taps

#37

Post by smokinn »

funkah wrote: post #17

Before reading, I guessed that "millions of phones" meant millions of Android phones. Because if this was happening on iPhones, that would merit mention in the headline. Funny how that works.

And you guessed wrong.

It says iphones and blackberrys are equally affected.

Re: Secret app on millions of phones logs key taps

#38

Post by yellowbkpk »

drivebyacct2 wrote: post #35
EwanToo wrote: post #25

Earlier quoted context omitted.

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, espec…

Logging to logcat does not mean it's sending those keystrokes anywhere on the internet. Logcat is the local system log and doesn't necessarily get sent anywhere but to a ring buffer on the device.

Re: Secret app on millions of phones logs key taps

#39

Post by recoiledsnake »

drivebyacct2 wrote: post #35
EwanToo wrote: post #25

Earlier quoted context omitted.

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, espec…

Logging is not the same as sending over the network.

What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes?

Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

Re: Secret app on millions of phones logs key taps

#40

Post by artursapek »

drivebyacct2 wrote: post #35
EwanToo wrote: post #25

Earlier quoted context omitted.

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, espec…

Right, the argument is logged keystrokes never leave your phone because that amount of data from each Android/Blackberry phone would be a lot more thn 10 GB a day. I agree though, why are they logging it at all if the app isn't sending it to them? Very suspicious.
Post reply on HN