What You Need to Know about Carrier IQ, Your Privacy, and Your Phone

Evan Keiser
January 4, 2012 | COMMENTS

Have you heard about the tracking software built into just about every smartphone on the market?

Trevor Eckhart, an independent security researcher, recently posted a video  examining hidden software from a vendor named Carrier IQ which comes pre-installed on the most popular mobile devices on the market today, including HTC, Blackberry, Apple and many others. In the video Trevor, shows how Carrier IQ’s software logs every Google search query and text message; the URLs of websites searched; and phone numbers entered into the keypad. This information is then sent back to your mobile phone carrier. Eckhart’s video shows how even data sent over supposedly secure connections to websites via HTTPS were logged as well.

After disclosing this information to Carrier IQ and questioning the company about the purpose behind what is, essentially, a rootkit, Eckhart was threatened with a cease-and-desist order. Fortunately, Eckhart was able to retain the Electronic Frontier Foundation after which the company backed off on its threats.

Carrier IQ now states that their software is for “gathering information off of the handset to understand the mobile-user experience, where phone calls are dropped, where signal quality is poor, why applications crash and battery life” for the benefit of mobile phone carriers. Despite the company’s statements, Perimeter feels the Carrier IQ software introduces significant privacy concerns. Users should have been notified of these information-gathering activities, and given the option to “opt-out” from the get-go.

The best way to determine whether your mobile service provider uses Carrier IQ is to watch closely for their press releases. As of now, only Sprint has admitted to using the software on their customers’ phones. Verizon has indicated they do not use Carrier IQ and we are still waiting to see statements from T-Mobile to surface.

Unless you have a rooted Android device you will not be able to determine if your phone is running Carrier IQ. Thankfully, Gizmodo is keeping an up to date list on phones which are confirmed to not have Carrier IQ installed. Blackberry has issued a statement indicating that they do not ship their products with Carrier IQ but that does not mean your carrier didn’t slip it on your phone. Apple has indicated that it doesn’t collect any personal information, keystrokes, or messages.

Apple claims they stopped supporting Carrier IQ with iOS 5 in most of their products and plan to remove it completely in a future software update, though the company has not given out a timeline for when the update will be released. For those of you using an iPhone, here are some quick steps on disabling Carrier IQ:

1. Go into Settings.
2. Go into General.
3. Go into About.
4. Go into Diagnostics and Usage.
5. Click Don’t Send. On the chance that your iPhone does indeed have Carrier IQ installed, the information it is gathering will no longer be sent to Apple.

This is a developing story. We will continue to monitor the ongoing investigations about Carrier IQ’s capabilities and how the carriers are storing and using this data.

PerimeterUSA.com is a provider of information security services that delivers enterprise-class protection and compliance for businesses of any size. Reprinted with permission from http://blog.perimeterusa.com.