[olug] [OT]: Researcher's Video Shows Secret Software on Millions of Phones Logging Everything

[Dave Weis]

The carriers don't need to capture your text messages on the handset, the messages have been passed through multiple devices capable of keeping copies instead of using a 3rd party app on the handset. 

I don't think the creator of the video understood the difference between logging a requested URL and data encrypted via https. Google queries show the query string in the URL and that's the data that was logged with a https prefix. If he had gone to a hotmail or gmail page, it wouldn't have listed the full text of each email or reply in the URL.

It would have been easier to gauge the level of anger if the discoverer had posted a packet capture or some indication of what actually left the handset instead of debugging messages. 
 

> -----Original Message-----
> From: olug-bounces at olug.org [mailto:olug-bounces at olug.org] On 
> Behalf Of Christopher Cashell
> Sent: Wednesday, November 30, 2011 6:35 PM
> To: Omaha Linux User Group
> Subject: Re: [olug] [OT]: Researcher's Video Shows Secret 
> Software on Millions of Phones Logging Everything
> 
> On Wed, Nov 30, 2011 at 6:07 PM, Dan Linder <dan at linder.org> wrote:
> > From what I understand, the "Carrier IQ" tool is the electronic 
> > version of the Verizion guy who says "Can you hear me now?" 
>  Each time 
> > your phone drops a call, gets a high rate of errors, etc, this tool 
> > logs that information and will upload it to the carrier as an 
> > additional datapoint for their coverage team to use.
> 
> That was my original thought, and how I pretty much wrote off 
> the concerns, too.  Now, I'm not so sure.  Capturing the full 
> content of text messages, and web browser searches (performed 
> with HTTPS, over wifi, with all other radios disabled) by a 
> third-party application goes way beyond what I'd consider 
> reasonable technical or service quality data.  The fact that 
> someone has verified that it is capturing this information, 
> along with a lot more, is very disconcerting.
> 
> > The conspiracy theory side of me says "Yeah, but what else?" and it 
> > may be true.  Sadly we might never know unless it was made FOSS.
> 
> Not sure if you read the full article or watched the video, but Mr.
> Trevor Eckhart has done a pretty thorough analysis of the 
> software's activity, showing an extent that seems to be very 
> suspicious at best, and very scary at worst.  If it's logging 
> (and potentially sending) a google search query performed 
> over HTTPS, is it also logging (and potentially sending) 
> credit card numbers and other personal information to them?
> 
> At the very least, this needs further investigation, and 
> should have an option for disabling (and removing) it.
> 
> > Dan
> 
> --
> Christopher
> _______________________________________________
> OLUG mailing list
> OLUG at olug.org
> https://lists.olug.org/mailman/listinfo/olug
>