best non prescription allergy medicine

The Carrier IQ Saga (So Far) — And Some Questions That Need Answers

from the answers-we-may-never-get dept

The story so far: security researcher Trevor Eckhart exposed some very disturbing
information about the “Carrier IQ” application
here.
This set off a
small
firestorm,
which quickly got much bigger when
Carrier IQ responded by attempting to
bully and threaten
him into silence. This
did not go over well.
After he refused to back down, they
retracted the threats
and
apologized.

Eckhart followed up by posting
part two of his research,
demonstrating some of his findings on video. Considerable discussion of that demonstration
ensued, for example
here
and
here
and
here.
Some critics of Eckhart’s research have opined that it’s
overblown
or
not rigorous enough.
But
further analysis
and
commentary
suggests that the problem could well be worse than we currently know.
Stephen Wicker of Cornell
University has explored some of the implications, and his comments seem especially apropos given that
Carrier IQ has publicly admitted
holding a treasure trove of data.
Dan Rosenberg has done further
in-depth research on the detailed
workings of Carrier IQ, leading to rather a lot of discussion about
Carrier IQ’s capabilities — there’s some disagreement among researchers
over what Carrier IQ is doing versus what it could be doing, e.g.:
Is Carrier IQ’s Data-Logging Phone Software Helpful or a Hacker’s Goldmine?

Meanwhile,
the scandal grew,
questions were raised about whether it
violated federal wiretap laws,
a least one
US Senator noticed,
and Carrier IQ issued an
inept press release.
Phone vendors and carriers have been begun backing away from Carrier IQ as quickly as possible;
there were denials from
Verizon
and
Apple .
T-Mobile has
posted internal and external quick guides about Carrier IQ.

Some of the denials were
more credible than others.
There has been some
skepticism about Carrier IQ’s statements, given
their own marketing claims
and the
non-answers to some questions.
There’s also been discussion about the claims made in
Carrier IQ’s patent.

Then the
lawsuits
started, see
Hagens Berman
and
Sianna Straite
and
8 companies hit with lawsuit
for some details on three of them.

Attempts to figure out
which phones are infected with Carrier IQ are ongoing.
For example, the
Google Nexus Android phones and original Xoom tablet seem to not be infected, nor do phones
used on UK-based mobile networks, but traces of are present
in some versions of iOS, although their function
isn’t entirely clear.
A preliminary/beta
application
that tries to detect it is now available.
Methods for
removing it have been discussed.

Meanhile,
A Freedom of Information Act request’s response has indicated (per the FBI) that
Carrier IQ files have been used for “law enforcement purposes”,
but Carrier IQ has denied this.
And there seems to be a growing realization that all of this has somehow
become standard practice;
as Dennis Fisher astutely observes,
With Mobile Devices, Users Are the Product, Not the Buyer.

Those are the details; now what about the implications?

Debate continues about whether Carrier’s IQ is a rootkit and/or spyware.
Some have observed that if it’s a rootkit, it’s a rather poorly-concealed one.
But it’s been made unkillable, and it harvests keystrokes — two properties
most often associated with malicious software. And there’s no question that
Carrier IQ really did attempt to suppress Eckhart’s publication of his
findings.

But even if we grant, for the purpose of argument, that it’s not a rootkit
and not spyware, it still has an impact on the aggregate system security
of the phone: it provides a good deal of pre-existing functionality that
any attacker can leverage. In other words, intruding malware doesn’t need
to implement the vast array of functions that Carrier IQ already has;
it just has to activate and tap into them.

Which brings me to a set of questions that probably should have
been publicly debated and answered before software like this was installed
on an estimated 150 million phones. I’m not talking about the questions
that involve the details of Carrier IQ — because I think we’ll get
answers to those from researchers and from legal proceedings.
I’m talking about larger questions that apply to all phones — indeed,
to all mobile devices — such as:

  • What kind of debugging or performance-monitoring software should be
    included?

  • Who should be responsible for that software’s installation? Its maintenance?

  • Should the source code for that software be published so that we can
    all see exactly what it does?

  • Should device owners be allowed to turn it off/deinstall it —
    or, should they be asked for permission to install it/turn it on?

  • Will carriers or manufacturers pay the bandwidth charges for users
    whose devices transmit this data?

  • Should carriers or manufacturers pay phone owners for access to
    the device owners’ data?

  • Where’s the dividing line between performance-measuring data that
    can be used to assess and improve services, and personal data?
    Is there such a dividing line?

  • Will data transmission be encrypted? How?

  • Will data be anonymized or stripped or otherwise made less
    personally-identifiable? Will this be done before or
    after transmission or both? Will this process be
    full-documented and available for public review?

  • What data will be sent — and will device owners be able to exert
    some fine-grained control over what and when?

  • Who is is responsible for the security of the data gathered?

  • Who will have access to that data?

  • When will that data be destroyed?

  • Who will be accountable if/when security on the data repository is breached?

  • What are the privacy implications of such a large collection of diverse data?

  • Will it be available to law enforcement agencies?

    (Actually, I think I can answer that one: “yes”. I think it’s a
    given that any such collection of data will be targeted for acquisition
    by every law enforcement agency in every country. Some of them
    are bound to get it. See “FBI”, above, for a case in point.)

Lots of questions, I know. Perhaps I could summarize that list by
asking these three instead: (1) Who owns your mobile device?
(2) Who owns the software installed on your mobile device?
and (3) Who owns your data?

19 Comments | Leave a Comment..

Article source: http://www.techdirt.com/blog/wireless/articles/20111219/15144417133/carrier-iq-saga-so-far-some-questions-that-need-answers.shtml

Share
Posted in Mobile Security Tagged with: , , , , , , , , ,

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>