And the HTC EVO/Carrier IQ saga continues [Updated]
I don't know about you, but I'm pretty sick of hearing about Carrier IQ every other day. But it seems that they've really dug themselves into a hole this time, and people are beginning to trust them less and less as it becomes more and more apparent that they might not be so honest and innocent as they most recently claimed.
This controversy has been going on for several months now (we first reported on it in August), and as recently as last week, security researcher and developer Trevor Eckhart was in some serious legal trouble for the claims he made against the company that creates this software in question. So Trevor has decided to fight back.
A recent article in The Register sums everything up quite nicely:
In a YouTube video posted on Monday, Trevor Eckhart showed how software from a Silicon Valley company known as Carrier IQ recorded in real time the keys he pressed into a stock EVO handset, which he had reset to factory settings just prior to the demonstration. Using a packet sniffer while his device was in airplane mode, he demonstrated how each numeric tap and every received text message is logged by the software.
Ironically, he says, the Carrier IQ software recorded the “hello world” dispatch even before it was displayed on his handset.
Eckhart then connected the device to a Wi-Fi network and pointed his browser at Google. Even though he denied the search giant's request that he share his physical location, the Carrier IQ software recorded it. The secret app then recorded the precise input of his search query – again, “hello world” – even though he typed it into a page that uses the SSL, or secure sockets layer, protocol to encrypt data sent between the device and the servers.
“We can see that Carrier IQ is querying these strings over my wireless network [with] no 3G connectivity and it is reading HTTPS,” the 25-year-old Eckhart says.
These findings are in direct opposition of Carrier IQ's most recent claims. In any case, you can watch Trevor's YouTube video above and read his complete write-up of his findings at the link below, and then make up your own mind. To be honest, though, things aren't looking too good for Carrier IQ.
Update #1: Forbes is reporting that Carrier IQ has likely violated wiretap laws in millions of cases, opening up the possibility for a class action lawsuit. (Thanks, Timmy!)
Update #2: The US Senate has launched an investigation into Carrier IQ, thanks to Senator Al Franken.
[Android Security Test] Thanks, anonymous!
