AfterDawn: Tech news

Verizon and Sprint using rootkit to collect data from Android phones

Written by Rich Fiscus (Google+) @ 16 Nov 2011 9:48 User comments (6)

Verizon and Sprint using rootkit to collect data from Android phones A security researcher has identified a rootkit present on smartphones manufactured for two of the biggest US carriers. Both Verizon and Sprint are selling phones which come preinstalled with CarrierIQ, which is intended to be used for analyzing network and connection problems.
However, as Trevor Eckhart points out, it can be used for much more than that. More importantly, its very existence is hidden from the user, making it difficult to detect and even harder to remove.

So what exactly can CarrierIQ do? According to Eckhart it can gather all kinds of data you may not wish to share with your carrier (via AndroidSecurityTest):

Carrier IQ is able to query any metric from a device. A metric can be a dropped call because of lack of service. The scope of the word metric is very broad though, including device type, such as manufacturer and model, available memory and battery life, the type of applications resident on the device, the geographical location of the device, the end user?s pressing of keys on the device, usage history of the device, including those that characterize a user?s interaction with a device.

Information is sent to the carrier at various points defined by instructions from the carrier. These instructions are called packages. Once sent from the phone, the information can be viewed through an administration portal, which also allows packages of instructions to be sent to specific phones for an immediate report.

Eckhart also provides us with a convenient diagram showing the entire process.

(Image courtesy of AndroidSecurityTest - Click to see larger version)
Carrier-IQ rootkit operational flow

CarrierIQ can be turned off on some devices, but HTC phones in particular apparently don't include this capability. Eckhart explains:

Devices are automatically entered into using Carrier IQ. Samsung android devices have an on off switch, but it is not easily accessible or made known to users that it?s even there. HTC android devices have no such off switch. Even if you purchase a phone on eBay completely off of sprint, use it on wifi only, Sprint will still be enabled to task your device with metrics because of no available off switch and Carrier IQs aggressive reporting nature across multiple protocols.

Making matters worse, Sprint has no privacy or retention policies governing their use of the data. Verizon does have a policy, and gives customers the option to disallow use of the data, but neither company gives you the choice to stop it from being collected.

Eckhart also provides some information for detecting CarrierIQ and accessing its hidden menus using his free Logging TestApp. The app requires a rooted Android device. CarrierIQ may also be found on RIM and Nokia devices, but he only provides Android-related information.

He says it can also be removed, but it will require some advanced knowledge of Android. Alternatively, there is a Pro version of his app ($1 as of this date) which can automate the removal process.

Previous Next  

6 user comments

116.11.2011 11:31

I'm getting tired of the mix-matching of verbality in hopes of setting a new trend because their parents didn't buy them the latest fashions as kids...

Metrics is a form of measurement, NOT the keys on a cell phone; like inches & the now dead cubits. So stop trying to impress us with some new shit & get on to scaring us with the new propaganda! 'Input/information to the cellular device' should/would have been a better barometer for what Eckhart is trying to warn us about.

Is this CarrieIQ originally for the good of the company & the betterment of mankind? I'm sure it is/was, just like dynamite; but just as all roads paved to hell, they originally had good intentions.

216.11.2011 14:06

post deleted

This message has been edited since its posting. Latest edit was made on 17 Nov 2011 @ 0:57

316.11.2011 15:48

alot of cell carriers are starting to SPY on the end user. i would have to call that INVASION OF PRIVACY. its none of your damn business what i do with my phone, were I am, or anything else. yet another good reason to ROOT your phone. make it more and more YOURS.

417.11.2011 9:35

Good call 1nsan3, the first thing i do to a new device is root the bugger and load a custom rom !!

527.11.2011 14:32
Unverified new user

I'm disgusted to read this. I've taken the time to read more stories on the web and have decided that if Samsung are going to let this kind of thing happen then I'm taking my business elsewhere.

I've taken my SIM card out of my phone and am going to but an iPhone. From what I can see there is no issue with them

627.11.2011 15:16

@jackson-vzw, your being ironic right ?? cus its not like apple where up until the point someone noticed recording you every movement, syncing it back using itunes to your desktop as well...

And its allll ok now as they only record it for the last 30 days..


Also where did the sudden Samsung hate come from ?? there are many android manufactures, the new article doesn't point the finger at Samsung so why have you ???

And its not just android phones, also RIM and nokia at the moment, but it looks like they are working on iPhone, Windows Mobile, BREW, Symbian versions as well.

Whos payroll are you on mr unverified new user.

Comments have been disabled for this article.

Latest user comments

News archive