Shared publicly  - 
 
So, this happened

Verizon approached me as well in regards to them not having Carrier IQ on their phones. Then, they got real quiet when I asked them to explain this



204.235.122.217 vzw-collector.demo.carrieriq.com
204.235.122.218 vzw-dis.demo.carrieriq.com
204.235.122.251 hupload-vzw99.carrieriq.com


No comment? Hmmm.
23
20
Thomas Sohmers's profile photoBret Holtz's profile photoZev Mo Green's profile photoRussell Holly's profile photo
67 comments
 
FWIW, I just scanned my Motorola Droid Pro (VzW) and it looks like CIQ is not present and running. Or at least it isn't using the string iqagent.
 
+Jason Bautista My concern is that they ditched Carrier IQ for something else, or that it exists on older devices (Or devices that are _not phones_)
 
+Russell Holly That worries me as well. I my other Droid devices are running CM7 (all VzW) so there isn't anything to be gained from those. I'll see if I can get a logcat running and pay closer attention to the outputs. I do not remember seeing anything out of the ordinary last time, but then again I wasn't aware of CIQ then.
 
The ironic thing is that I present to networking people all the time and one of the things I talk about is network security. The comment that resonates with them is "Network security is great in order to keep people out of your network. But what do you do with those who already have access to your network? What if the problem is someone is supposed to have access to your network?" To a certain extent this is what the Carrier IQ story feels like. Carriers already have access to your device so you wouldn't think something to this level that would violate that trust. Carriers are PROHIBITED from listening in to your phone calls without a warrant. Law enforcement cannot look at your phone records without a warrant. Now a piece of software on your phone can send your habbits, phone calls and SMS strings to a PRIVATE 3rd party? Very troubling indeed.
 
Theres an app you can get that detects Carrier IQ and so far of the people I've read about testing their Verizon phone, nobody has found it. I'd be more surprised finding stuff like that on Verizon's site, but it's not. It could be a failed sales pitch or something.
 
+Jason Bautista hopefully that'll last, seems like every year the feds push the phrase "No reasonable expectation of privacy" more and more
 
+Keyan Mobli also brought up a good point the other day. Everyone knows that carrieriq is logging a lot of things, but so is logcat in android.. Has anyone tested to see what data is actually being sent back to the mothership?
 
+Russell Holly are those links you posted dead now or are they getting DDoSed lol ? I have tried opening them a few times and they time out. Thanks.
 
+Jon Niola this has been known about for quite some time now, it's only recently that people are going crazy about it
 
That's the beauty of all of this, I am surrounded by assholes who take smug pleasure in saying "We've known about this for years".

If you can say that, and it is true, fuck you. You are part of the problem by not making people aware of this.
 
+Jon Niola as mentioned above, what's the harm in your device collecting it if it's not actually sent off anywhere? Until someone can show what actual data is being uploaded, there is no reason to claim it's 'crossing lines'. I think if you looked in to exactly what each carrier was getting out of carrieriq you'd be a bit shocked at how little of the information that is logged is actually sent off. If no information is sent it's logging data in many of the same ways that logcat does.
 
+Chris Sewell No, logging in general has been known for years. Anonymous location and usage info. Not keylogging which captures passwords and private correspondence alike. Even if the carrier doesn't use this info or keeps it anonymous, it still opens a huge security hole for hackers to play with. This particular program was outed a few months ago but only now has caught the attention of people with Trevor Eckhart's latest video. I don't think people understood that it wasn't just another tracker before.
 
+Manny Brum actually, this companies method of collecting data has been 'outed' years ago, not months. It was only recent that it became a big deal again.

My question is not what the carrier does with the information. I'm asking what information the carrier actually gets. What information is actually being sent out from the device. His video shows it logging information. Again, for the third time, logcat does much of the same. The difference would be when carrieriq actually sends this information from the device to someone else. Be it a carrier, or carrieriq .etc.

Everyone is freaking out about the amount of data logged (and yes, I believe logged is a correct term until someone shows where the data is actually being stored long term) but so far no one has gone ahead and figured out what data is actually being sent out from the device.

If no information is being sent out, then there is nothing to be freaking out about. If anonymous location and usage info is being sent out, then how would it be different from "logging in general"?

I agree there should be an opt in/out for the service, and that it shouldn't be so vague. But you have no information to back up a claim of a carrier collecting keylogging data.

+Russell Holly really?
 
+Chris Sewell RE: LOGCAT

logcat is available as a shell command to individual devices and is a debug tool. So someone needs to connect to your device, enable USB debugging and then launch a shell against your device while you are using it and turn on logcat and spits out EVERYTHING your device is doing. CarrierIQ on the other hand is running in the background all the time and is monitoring specific things it seems and sends a report to a remote 3rd party. That is why a lot of people are calling it a rootkit.
 
+Jason Bautista again, what is reporting to a 3'rd party? To answer "everything it's logged" is vastly incorrect
 
+Jason Bautista also, the device is always logging, even when you're not running logcat. my way of putting it may have been off, but your device logs everything even without carrieriq

/dev/log/main
 
+Chris Sewell I agree what information is actually sent from the application is the question. However my beef with the application is that it is capable of capturing a lot more information as released videos on XDA show. If there is a known application with these capabilities then all it would take is another application to hijack the other application to do more nefarious things. As the known application is silently running on a lot of smartphone platforms the potential security risks are exponential.
 
+Jason Bautista hijacking the log from carrieriq is just as easy as to hijack the log your device already produces...
 
+Chris Sewell except that Carrier IQ logs keystrokes so login/password combos and other info is at risk. Loggers typically collect app usage/web usage/location and other things like that, plus they aren't all that hidden if you want to go in and see what is being collected.
 
+Manny Brum keystrokes in the dialer are recorded, nowhere else. Unless you have a physical keyboard.
 
+Chris Sewell I get where you are coming from now. Yes, you are correct. For me the differences being there is a log on the device (like any other computer) vs an active piece of software that could possibly be running in the background installed by the carrier/manufacturer sending personal information that I did not get the option to opt-out of. But thinking of it more I am sure if I read somewhere in my contract that there is a 1 sentence blurb that validates the possible existence of something like CarrierIQ on my phone even though from what I have been able to ascertain it does not. edit - or rather my phone does not have CIQ installed
 
+Jason Bautista don't get me wrong I want it gone just as much as the next guy, it's a big reason to love roms such as CyanogenMod. I'm not trying to argue that carrieriq is a good thing, or that it should stay. I'm just frustrated at the amount of misinformation going around. Or rather, misleading information.

I've yet to see a single blogger write about what data is actually being sent off from the device, and to where. Every blogger is riding the fear train and enjoying the hits to the site from people wanting to know more about how horrible carrieriq is (and it is horrible, it's nasty and needs to be gone imo). But I'm certain the amount of data being sent from your device != the amount of data that CAN be sent from your device.

I want it gone because it CAN send data from my device, not because it IS. Everyone is assuming that carrieriq takes EVERYTHING it logs and ships it off in a nice package to be datamined.

I want to see a single blogger take the time and energy to pair up with a dev and someone with networking skills and actually take notes of the information being sent out from a device or two from each carrier. But, that'll likely never happen (or at least take a long, long time to do so based off of past experience with blogs).

PS: +Manny Brum I wasn't saying logcat was easy to hijack. There are permissions involved. The apps (carrieriq) private data should be safe unless they are dumb and put it in the sd card.
 
+Russell Holly Then how did Carrier IQ detect Trevor Eckhart's encrypted searches on an Evo 3D (with only a software keyboard)? The logical explanation was that it detected the keystrokes before encryption (I doubt they're busting the encryption).
 
+Manny Brum i'm not saying that carrieriq isn't logging, and i never said that your device always logs MORE than carrieriq. Certainly carrieriq is logging things they shouldn't be. But accessing that data from another app isn't as easy as you think. Again, it'd be as easy as taking the data you'd get from logcat. There are permissions involved.

Also bringing me back to my original points. It's not that I don't want it gone (I do), I'm just questioning what all data is actually being sent.
 
FWIW, just ran unfiltered logcat against my Motorola Droid Pro (VzW) and I am not seeing any extraneous strings being invoked when I press buttons in my phone.
 
+Jason Bautista now if carrieriq logged that, and never actually sent it off. would you agree that carrieriq isn't as bad as what the general (misinformed imo) public is making it out to be?


(Edit: just read your comment, cool)
 
+Manny Brum phones logs != carrieriq logs. And that would be a security flaw on HTC's end, not carrieriq....
 
+Chris Sewell Chris, I don't pretend to be as knowledgeable on the Android platform as you, Russell, or others. But it seems to me you're splitting some dangerous hair here. If CarrierIQ is tracking keystrokes, regardless of whether it's sending them anywhere, isn't it a potential threat? Why did they put that feature into their software, if it wasn't intended to be used? As a developer, I'm not getting this. I design systems that include intense auditing of what users do because these systems track confidential data about people's health. So we're flat paranoid. Keylogging is an essential part of that paranoia, and the users I deal with know they're being monitored. But I'm having trouble understanding how I'm not supposed to be worried about software tracking my keystrokes because the software isn't actually uploading it anywhere.
 
+Bret Holtz unfortunately a few people have been maintaining the thought that I'm in favor of carrieriq staying on the device. This is as wrong of an assumption as people assuming carrieriq transmists ALL logged data from the device to somewhere else.

If you take the time to go back and read through the comments, you'll see that I'm not arguing that carrieriq isn't nasty stuff. I'm just attempting to promote people to be a bit more knowledgeable on the topic at hand. Let me break it down a bit for you by listing out my points


-It's very obvious that the general consensus is the following
--everything carrieriq logs is sent from the device to <insert a place other than the device>

-A lot of people fail to understand the differences between the following statements:
--carrieriq transmits all of the logged data
--carrieriq can transmit all of the logged data

-the data logged by carrieriq is similar (read: not exactly the same, but share a lot of the same features) to the logs that android already produces. And as mentioned above, isn't easy to get to (about as easy as it is to 'hijack' the device logs) from a 3'rd party app (other than carrieriq)

(again, let me reiterate what I seem to constantly have to in order to keep everyone on the same page of "i don't like carrieriq anymore than you do".

I understand and 110% agree that carrieriq is bad, should be gone or at the VERY least have a legit and clear opt in/out option &/or be easily removable and made VERY clear to the end user that it's a) there and b) how to remove it. I want carrieriq removed entirely, personally, but in the mean time I'd rather people not panic thinking that carrieriq transmits EVERYTHING it logs (or anything near it). I'd rather them be upset that it CAN transmit its logs.

If I seem to be repeating myself a few times even within this post, it's because imo you, and others, are coming to the conclusion that I'm for some reason fighting FOR carrieriq. When in fact I'm just hoping to prompt someone to actually gather some facts on what data carrieriq is actually transmitting, before misleading people in to thinking "OMG CARRIERIQ STEALS ALL YOUR DATA AND GIVES IT TO THE CARRIERS AND SELLS IT AND STUFFS!!!!" which is how I personally feel the vast majority of people reading 100% of the blog posts currently in circulation react.

Not one blogger has taken the time to investigate anything further than what was seen in that brief youtube video from XDA showing what carrieriq CAN send out. Nor has anyone stepped up with a video showing what carrieriq DOES send out.
 
tl;dr: someone make a video of their device TRANSMITTING via carrieriq to a carrier / manufacturer / carrieriq databases (off of the device) actual data logged by carrieriq. carrieriq sucks balls and should be nuked from all devices. can != did/is/will
 
+Chris Sewell No, I didn't come to the conclusion that you endorsed CarrierIQ - just seemed like you were suggesting it isn't as big a deal as people are making it out to be. While you are correct that people should not be panicking that their data has been delivered or sold, it's still a big, fat, hairy deal. Let's move the Occupy Wall St. gang into CarrierIQ headquarters. Sounds like a win-win to me. ;-)
 
+Bret Holtz imo it isn't as big of a deal as people are making it out to be, at least not without more supporting data of what is being sent from a device. OWS would just build a treefort and sit in it with a dog :\ </occupyoaklandreference>


maybe my perception of everyone elses reactions is incorrect, but I personally see people freaking the fuck out over this with only the first half of the data that, imo, is needed before you can freak the fuck out
 
Does a for-profit company benefit monetarily from logcat logs?
 
+Andrew Krug do they or could they?

Datamining is, and has for quite some time, been profitable for many companies. Be it little data or specific data.

So could logcat logs be valuable to a for-profit company? Absolutely.

Is logcat logs currently allowing a for-profit company to profit? (I'm assuming you mean in the same way carrieriq is)? Doubt it.

I'm fine with carrieriq collecting some data, personally. Like some radio info (my reception in certain areas, so i guess a mix of location data as well) as long as it's anonymous. This may help a carrier focus on increasing coverage in my area .etc. Some people, however, may not be. And thus I agree carrieriq needs to be gone, have an opt in/out or something along those lines. Definitely needs changing big time.

But is carrieriq stealing an epic fuckton of my data and profiting from it? Are they uploading passwords and other secure information that they have no right uploading / mining? This is the kind of information that I'm looking for, before flipping shit like so many other people are after jumping to the conclusion that: everything carrieriq can log = everything carrieriq ships off to be mined and sold for no other reasons than to fill pockets with money.
 
+Chris Sewell This reminds me of when people though WiFi would cause cancer or that modern airplane avionics will fail and cause planes to crash if you use your phone on a plane.
 
+Jason Bautista "sir, turn off your phone, the plane could crash"
"wait, you spent HOW MUCH FUCKING MONEY on this plane and my cell phone can take it out of the sky at 40,000 feet?!"


fucking hate that.... so much.... why aren't terrorists skyping during takeoff then?
 
+Chris Sewell , if your Aunt had testicles she could be your Uncle, lol. Could is irrelevant in the discussion of comparing actual business models and the use of data currently being logged. CIQ has a whole business centered around the collection and somehow the use of data your phone provides it. I agree with you that the million dollar question is WHAT are they receiving and storing remotely.

From a corporate standpoint though, why would you devote resources to develop the logging capabilities proven in TrevE's video if you are not going to use it? There are three scenarios. The first being, CIQ has poor project management and gold plated a bunch of stuff by adding in features not requested and thereby wasting company resources IF they are not going to send all of the data being logged. Second, they have a rogue programmer(s) adding in functionality that the company does not know about because they claimed to not be doing what was demonstrated in the video. Third, they are collecting and receiving all the data demonstrated in the video. Which seems most likely? Actually all three. Which bring us back to your question of WHAT is being received.
 
+Andrew Krug and again. I'm all for the obliterating of carrieriq. I'm just trying to influence people to knowledge up a bit more on the topic rather than taking what we have now (what carrieriq can (and sure, i'll play ball with you and go "is likely to") send) and concluding that "everything carrieriq can log on your device, they do upload remotely".

To dismiss collecting more information on the subject by saying that information is irrelevant is an error, imo.

Kill carrieriq, just don't start a riot with assumptions and guestimations rather than facts.
 
+Chris Sewell I for one am not saying that it's being used for nefarious purposes or that current exploits exist that will allow the keylogged information to be leaked, but at no point does a keylogger belong on a consumer device without the user's knowledge. Period. Play devil's advocate all you want but the bottom line is this will do more harm than good being in existence. Senator Al Franken has just asked for a response from Carrier IQ by Dec 14 on the scope and capabilities of the software so hopefully we will gain more insight soon, if not from this, then from further government inquiries.

http://www.theverge.com/2011/12/1/2603142/senator-al-franken-asks-carrier-iq-exactly-what-its-doing
 
+Andrew Krug to use your example

IF my aunt had testicles, she could be my uncle

My aunt has testicles, she is my uncle.

If I don't have proof that my aunt has testicles (and i'm quite fine with that, lol), I can't make that second statement. Even if she likely does have testicles, it'd be wrong of me to go around telling everyone that my Aunt does have testicles and is in fact my uncle.
 
+Manny Brum for the billionth time. I have NEVER argued that carrieriq BELONGS on the device. Never, ever, ever, ever, ever. Not once. N E V E R. I don't know how many time I have to actually pound that one in to your head.

I simply am saying that instead of assuming that carrieriq IS collecting ALL of the data that it is logging, that someone actually look in to it.
 
Instead of arguing, doesn't anyone know someone with the skillset to actually put the questions of what they actually collect to rest? I don't personally, but someone out there has to at least know someone (maybe even an aunt with testicles, doesn't matter) that can look in to this.
 
+Chris Sewell my comment about "could is irrelevant" was directed at comparing logcat logging as it relates to CIQ logging for business purposes in the previous conversation. One is being used directly for the monetary benefit of a company based on their business model. The others intent specifically "provides a mechanism for collecting and viewing system debug output." Could logcat logs be used nefarious? Sure. Pontificating on "could" without documentation of this actually occurring on devices straight from a carrier is the irrelevant part. We are not talking about trojan programs installed via third-party markets but part of the "stock carrier experience". Dismissing the hypothetical of logcat and focusing on what is actually occurring with CIQ was the intent and I do not believe an error. It is akin to a red-herring and getting off topic. Which we now have, ha ha ha.
 
+Chris Sewell did you just throw a quantum mechanics problem at me? Only instead of Schrödinger's cat it is Sewell's Aunt? Whoa... "If I don't have proof that my aunt has testicles... I can't make that second statement."
 
+Chris Sewell if you don't have proof she has testicles, then you do not have proof that she doesn't either though. Correct? Therefore she would be in both states at the same time. /threadjack
 
+Chris Sewell I don't think anyone is suggesting that carrier iq is collecting all of the data. In fact, carrier iq probably collects no data leaving it up to the carrier to collect the data. Seeing as how Carrier IQ's app is not a rootkit when it comes from the developers, just a regular app with the option of turning it off or not sending the data. It's the carriers that request it be put on the phones, and the manufacturers embed it in the phone and hide it to various extents. If you're not arguing that why does every time someone says something you respond to them with a counter argument. Could it be that nobody is saying what you think they're saying? The only irrelevant argument I see here is the one about whether or not the data is being transmitted.
 
+Manny Brum almost everyone that I've seen talk about this... nvm, i'm done arguing +Andrew Krug won the internets for the day for creating a proper Schrodingers cat reference with my aunts balls
 
+Justin Beeson I have Verizon and I don't have the software running on my phone. I've used two different methods that people have used to detect it and it was not found. Nobody else has come forward yet saying they have found it on their Verizon device. Yes, the software was developed for all four major carriers in the US at least, which is why Trevor Eckhart found strings referring to Verizon in the software. This also would explain the presence of these "verizon" documents on the carrier iq website. Nothing similar has been found anywhere on a Verizon domain website. I don't think anyone should amend anything until the software is confirmed on a Verizon phone.
 
Wow, Verizon is so busted. Unless their twitter rep was just misinformed I don't think I'll ever trust Big Red with my privacy.
 
I'm working on a story about this right now to air on KTTV here on Los Angeles. I remember when k0nane and other developers on XDA first outed this and started cooking up ROMs with it removed. Definitely something more "lay people" need to understand WHY they should care about this.
 
heh, this outta be interesting....
 
+Mike Eber you can watch live at 5pm PST at the link in my profile. I'll try to get video up though that's not something we regularly do (trying to change that).
 
I don't know why people are having trouble finding this on Verizon phones. I have a Droid X and I have the following under Applications>All:
-Contacts Sync
-Contacts Data
-HSTcmd
-Motorola Indexing Service
-Motorola Services
-Motorola Storage Monitor
-Social Messaging Service
-Suggestions Core RuleCheck
-Suggestions Poll Scheduler S....(can't see the rest)

All of these have various levels of access...Your Messages, Your personal information, Services that cost you money, Default, Network Communication, Your Accounts, Storage, Phone Calls, System Tools, Your location

Each app has access to 1 or more of those levels.

It is definitely on at least some phones from/on Verizon. I bought mine in a VZW store, and have not rooted, or loaded anything from sites other than the Market, or Amazon.

It could have been installed by Motorola, which seems to at least in part be the case, but either way it's there.
 
+Matt Zerfas because none of those are carrier IQ. All phones log some data. All apps access data for instance, an app that lets you send texts from within the app would need access to your messages especially your messaging app. It doesn't mean they're logging keystrokes. Every carrier gets some usage info within reason so they can run their network efficiently. You can't order pay per view porn and not expect the cable company to know you ordered it. Carrier IQ may be a huge security hole, but only time will tell.
 
+Manny Brum I think you are wrong. The icon looks the same as in the video, although the video is grainy so I am not 100% positive. It is a gold circle with spiked edges, with the letters CI where the top of the C connects to the top of the I. There is no "about app" available that I can find on the phone, and I cannot stop any of there services.

I am still pretty positive this is CarrierIQ software, just repackaged/renamed for the Motorla's/Verizon.
 
+Manny Brum Ok, so I might back track a bit. Not wanting to over react and not confirm I've downloaded the SDKs and checked logcat for myself. I do not see entries for CarrierIQ coming across, so you may be right. Although I don't have much experience with debugging like this, so I could be wrong about being wrong. I think from my previous post though you can understand my suspicions.
 
Thanks for sharing. When Verizon Wireless spokesperson Jeffrey Nelson said they did not use Carrier IQ software, I doubted. First, I did not see any official statement in writting in their web site. Second, they installed ton of bloat ware in smart phones, it made me suspicious.
 
+Matt Zerfas If Verizon came out and said that they didn't use it if they did it would be a stupid move. All the other of the main 4 carriers admitted to it, and it would only be a matter of time before they got outed. The CIQ software was spotted on all the other carriers within hours, so with all that information, I'm confident they're telling the truth. If they weren't it would be all over the blogs. I have Verizon, and either way I'll be getting the Samsung Galaxy Nexus. I was determined to get it before this fiasco, and I'm still planning on getting it. Carrier IQ or no, the phones run better without a lot of extraneous processes.
Add a comment...