Federal investigators have launched a probe in order to examine Carrier IQ’s smartphone software, which tracks a range of activity and sends certain data to wireless carriers without users’ knowledge. Carrier IQ executives met with officials from both the Federal Trade Commission and the Federal Communications Commuission on Tuesday, The Washington Post reports. “We are complying with all investigations at this time as we have nothing to hide,” said Carrier IQ representative Mira Woods. “We have been completely transparent through this process.” Read on for more.

Security researcher Trevor Eckhart recently pulled Carrier IQ back into the spotlight after the firm’s software first ruffled feathers back in September. Carrier IQ says its software “collects enough information to understand the customer experience with devices on our network and how to devise solutions to use and connection problems,” but Eckhart shed light on the scope of data collected by Carrier IQ, which may include personal data, location data and even key strokes.

Allegations that the Federal Bureau of Investigation may also be using Carrier IQ software to spy on smartphone users arose on Tuesday when the FBI denied a Freedom of Information Act request for materials related to the Carrier IQ scandal. A number of manufacturers and carriers have commented on whether or not they use Carrier IQ software, but the statements have done little to calm a concerned public or prevent a new wave of lawsuits.

Read

Carrier IQ, the vendor and carrier-installed rootkit software pulled into the spotlight last month by security researcher Trevor Eckhart, has caused quite a stir. Carriers including AT&T and Sprint use the software as a means of collecting data logs that might help them identify and address connectivity problems and other issues, but the software’s covert nature and wide range of snooping capabilities make it a concern. The good news is that detecting the software on your Android phone couldn’t be easier thanks to a new app from Bitdefender called Carrier IQ Finder. Read on for more.

Android phone users can install Carrier IQ Finder [Android Market link] from within the Market for free. Once the app is installed on your smartphone, simply tap the icon to open it and you’ll know in less than a second if your handset has the Carrier IQ software installed.

The bad news, however, is there’s precious little you can do about it at that point if you’re afraid your carrier might use the software to spy on you. The two main options — install Eckhart’s removal tool Logging TestApp Pro Key [Android Market link], or install a third-party ROM — each require you to root your device, which could lead to problems if attempted by less savvy smartphone users. With the Carrier IQ related lawsuits beginning to pour in though, carriers may soon issue software updates that remove the tool from their handsets in an effort to curtail damages.

Carrier IQ software is installed by carriers in an effort to “collect enough information to understand the customer experience with devices on our network and how to devise solutions to use and connection problems,” according to Carrier IQ’s website. The software logs a tremendous amount of sensitive data however, and it gives carriers access to all or most of it. Exactly how each carrier uses the software remains something of a mystery, but expect plenty of light to be shed on the software in the coming weeks and months as Carrier IQ falls under the microscope.

Apple, HTC, Samsung, Motorola, AT&T, Sprint, T-Mobile and Carrier IQ have been sued in a federal court by what the lawyers involved have deemed a “cell phone tracking software scandal.” Law firms Sianni & Straite LLP, Eichen Crutchlow Zaslow & McElroy LLP, and Keefe Bartels L.L.C. have jointly filed a class action complaint in a Delaware Federal Court related to the “unprecedented breach of the digital privacy rights of 150 million cell phone users.” The complaint suggests that the aforementioned carriers and vendors violated the Federal Wiretap Act, the Stored Electronic Communications Act, and the Federal Computer Fraud and Abuse Act. The suit of course refers to the companies’ use of Carrier IQ, the carrier and vendor-implemented cell phone spyware discovered recently on a number of handsets from multiple manufacturers. Read on for more.

Carrier IQ’s software is intended to be a “Mobile Service Intelligence solutions that have revolutionized the way mobile operators and device vendors gather and manage information from end users” according to the company, but cell phone users are up in arms now that the software’s capabilities have once again been widely covered across the press and on blogs. Carrier IQ software fell under the spotlight to a lesser degree back in September when the software was discovered on Sprint devices. A number of lawsuits have been filed since then, including a complaint flied last week against HTC, Samsung and Carrier IQ.

“This latest revelation of corporate America’s brazen disregard for the digital privacy rights of its customers is yet another example of the escalating erosion of liberty in this country,” David Straite, one of the lawyers leading this crusade, said in a statement. ”We are hopeful that the courts will allow ordinary customers the opportunity to remedy this outrageous breach.” His co-counsel Steve Grygiel added, ”Anyone who cares at all about their personal privacy, or the broader constitutional right to privacy, ought to care and care a great deal about this case.” The firms’ joint press release follows below.

Apple, HTC, Samsung, Motorola, AT&T, Sprint, T-Mobile and Carrier IQ Sued in Delaware Federal Court in Cell Phone Tracking Software Scandal

WILMINGTON, Del., Dec. 2, 2011 – The law firms of Sianni & Straite LLP of Wilmington, DE, Eichen Crutchlow Zaslow & McElroy LLP of Edison, NJ, and Keefe Bartels L.L.C. of Red Bank, NJ, have today filed a class action complaint in Federal Court in Wilmington, Delaware related to the unprecedented breach of the digital privacy rights of 150 million cell phone users.  The complaint asserts that three cell phone providers (T-Mobile, Sprint and AT&T) and four manufacturers of cell phones (HTC, Motorola, Apple and Samsung) violated the Federal Wiretap Act, the Stored Electronic Communications Act, and the Federal Computer Fraud and Abuse Act.

The carriers and manufacturers were caught last month willfully violating customers’ privacy rights in direct violation of federal law.  A technology blogger in Connecticut discovered that software designed and sold by California-based Carrier IQ, Inc. was secretly tracking personal and sensitive information of the cell phone users without the consent or knowledge of the users.  On Nov. 30, 2011, the United StatesSenate Committee on the Judiciary said in a letter to Carrier IQ that “these actions may violate federal privacy laws.”  It added, “this is potentially a very serious matter.”

David Straite, one of the attorneys leading the action, noted “this latest revelation of corporate America’s brazen disregard for the digital privacy rights of its customers is yet another example of the escalating erosion of liberty in this country.  We are hopeful that the courts will allow ordinary customers the opportunity to remedy this outrageous breach.”  Steve Grygiel, co-counsel for the proposed class, agreed: “anyone who cares at all about their personal privacy, or the broader constitutional right to privacy, ought to care and care a great deal about this case.”  Barry Eichen added, “today’s comment from Larry Lenhart, CEO of Carrier IQ, that his software is somehow good for consumers starkly demonstrates what is at stake.”

A copy of the Class Action Complaint in Pacilli v. Carrier IQ, Inc. can be viewed on the Firms’ websites at www.siannistraite.com, www.keefebartels.com, and www.njadvocates.com.

Plaintiffs are represented by Sianni & Straite LLP, a Delaware-based litigation firm with a branch office in New York, Keefe Bartels LLC, a New Jersey-based plaintiffs’ rights trial law firm, and Eichen Crutchlow Zaslow & McElroy LLP, a leading plaintiffs firm with three offices in New Jersey.

Last week, research published by security expert Trevor Eckhart pulled back the veil on Carrier IQ, a suite of what can seemingly be described as spyware pre-installed on a wide range of devices by both carriers and vendors. Eckhart cited a BGR story from September as an early reference to the software, which at that time was thought to be a somewhat benign set of quality-control measures. “Carrier IQ is used to understand what problems customers are having with our network or devices so we can take action to improve service quality,” a Sprint spokesperson told BGR in September. “It collects enough information to understand the customer experience with devices on our network and how to devise solutions to use and connection problems. We do not and cannot look at the contents of messages, photos, videos, etc., using this tool.” But Eckhart’s interest was piqued. Read on for more.

UPDATE: Sprint and several vendors have issued statements regarding Carrier IQ, which have been added below. 

The security researcher began to dig, and shortly after publishing his findings, he was hit with a cease and desist order from the company behind the software. Clearly, Eckhart was on to something.

“Carrier IQ (CIQ) sells rootkit software included on many US handsets sold on Sprint, Verizon and more,” Eckhart wrote in a report on his website. “Devices supported include android phones, Blackberries, Nokias, Tablet devices and more.” A rootkit is defined as software that enables access to a device unbeknown to the device’s owner. Carrier IQ defines its own solutions as “Mobile Service Intelligence solutions that have revolutionized the way mobile operators and device vendors gather and manage information from end users.”

With support from the Electronic Frontier Foundation Eckhart was able to convince Carrier IQ to retract its borderline comical cease & desist order, which had initially complained of the researcher’s use of the term “rootkit” to describe its software. Carrier IQ had also demanded that Eckhart remove the company’s manuals from his site, though these documents had previously been available on Carrier IQ’s own website.

What’s the big deal about Carrier IQ? From Eckhart’s report:

From training documents found we get an insight to the Carrier IQ Portal. Devices are displayed to the portal operator by individual phone Equipment ID and Subscriber IDs. The “portal administrator” can put devices into categories and see devices in California that have dropped calls at 5pm.

The down side to all of this is the “portal administrator” is also able to “task” a single phone with a profile containing any combinations of metric and trigger. From leaked training documents we can see that portal operators can view and task metrics by equipment ID, subscriber ID, and more. So instead of seeing dropped calls in California, they now know “Joe Anyone’s” location at any given time, what he is running on his device, keys being pressed, applications being used.

References to the software have reportedly been discovered on Android phones, BlackBerry handsets, Nokia devices and even on the most recent public release of Apple’s iOS software. While Nokia has publicly denied the allegations that Carrier IQ software can be found on its Symbian smartphones, other vendors have remained quiet on the matter. Several carriers have seemingly gone into hiding as well, though Verizon Wireless confirmed on record that none of its handsets contain Carrier IQ’s software.

Eckhart estimates that Carrier IQ’s software is currently installed on more than 141 million handsets, and that was before references were found in Apple’s iOS software.

It is likely still too early to panic, however. Despite the extensive coverage this story has garnered across tech blogs and in the media, it remains unclear exactly what Carrier IQ and its clients are doing with this data. It isn’t even clear what data carriers have access to.

We know Carrier IQ software on Android devices can log anything from usage data and location to key strokes and usage habits, but it has not been determined that this data is sent to carriers regularly or at all. Carrier IQ’s software can theoretically be used as a window through which carriers can spy on users in real-time if they so choose, but whether or not the software is used in this manner is also unclear. Going back to Sprint’s statement to BGR from September, “We do not and cannot look at the contents of messages, photos, videos, etc., using this tool.”

Things do look ominous, however. Geek.com has reportedly found ”a potentially significant volume of data being collected” by the software, and Eckhart’s own video shows an alarming amount of data being recorded by Carrier IQ, including keystrokes. Of its monitoring suite, Carrier IQ says simply, “Our software is designed to help mobile network providers diagnose critical issues that lead to problems such as dropped calls and battery drain.” The firm goes on to state that it “does not provide real-time data reporting to any customer.”

More information will undoubtedly be brought to light in the coming days and in the meantime, a video of Carrier IQ in action while being monitored by Eckhart follows below.

UPDATE: Sprint on Thursday issued a statement regarding its use of Carrier IQ software:

Carrier IQ provides information that allows Sprint, and other carriers that use it, to analyze our network performance and identify where we should be improving service. We also use the data to understand device performance so we can figure out when issues are occurring. We collect enough information to understand the customer experience with devices on our network and how to address any connection problems, but we do not and cannot look at the contents of messages, photos, videos, etc., using this tool. The information collected is not sold and we don’t provide a direct feed of this data to anyone outside of Sprint.

Sprint is well known for our serious commitment to respecting and protecting the privacy and security of each customer’s personally identifiable information and other customer data. A key element of this involves communicating with our customers about our information privacy practices. The Sprint privacy policy makes it clear we collect information that includes how a device is functioning and how it is being used. Carrier IQ is an integral part of the Sprint service. Sprint uses Carrier IQ to help maintain our network performance.

Apple supplied the following statement to AllThingsD:

We stopped supporting Carrier IQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.

HTC’s statement:

Carrier IQ is required on devices by a number of U.S carriers so if consumers or media have any questions about the practices relating to, or data collected by, Carrier IQ we’d advise them to contact their carrier.

It is important to note that HTC is not a customer or partner of Carrier IQ and does not receive data from the application, the company, or carriers that partner with Carrier IQ. HTC is investigating the option to allow consumers to opt-out of data collection by the Carrier IQ application.

RIM’s statement:

RIM is aware of a recent claim by a security researcher that an application called ‘CarrierIQ’ is installed on mobile devices from multiple vendors without the knowledge or consent of the device users,” the company said in a statement. “RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app before sales or distribution. RIM also did not develop or commission the development of the CarrierIQ application, and has no involvement in the testing, promotion, or distribution of the app. RIM will continue to investigate reports and speculation related to CarrierIQ.

Nokia’s statement:

Nokia is aware of inaccurate reports which state that software from CarrierIQ has been found on Nokia devices. CarrierIQ does not ship products for any Nokia devices, so these reports are wrong.

And finally, an excerpt from Carrier IQ’s statement issued last week:

We would like to take this opportunity to reiterate the functionality of Carrier IQ’s software, what it does not do and what it does:

• Does not record your keystrokes.
• Does not provide tracking tools.
• Does not inspect or report on the content of your communications, such as the content of emails and SMSs.
• Does not provide real-time data reporting to any customer.
• Finally, we do not sell Carrier IQ data to third parties.

Our software is designed to help mobile network providers diagnose critical issues that lead to problems such as dropped calls and battery drain.

Here’s what our software does:

• Our software makes your phone work better by identifying dropped calls and poor service.
• Our software identifies problems that impede a phone’s battery life.
• Our software makes customer service quicker, more accurate, and more efficient.
• Our software helps quickly identify trending problems to help mobile networks prevent them from becoming more widespread.

Brooklyn-based artist Kyle McDonald finds himself in hot water after secretly photographing Apple Store customers while they shopping for computers. “I thought maybe we could see ourselves doing this we would think more about our computers and how we’re using them,” McDonald told Mashable. Without the staff’s knowledge, the 25-year-old installed software on computers at two Apple Store locations in New York that used their integrated webcams to capture photos every 60 seconds. The software then automatically sent the photos to McDonald. The electronic artist published his project on his site and a dedicated Tumblr blog, and eyebrows were raised soon after. Mashable reports that McDonald was soon approached by the U.S. Secret Service, and his personal computers have been confiscated as part of the investigation into alleged computer fraud. McDonald says he did get Apple Store security guards’ permission to take photos in the stores, and he also asked permission while photographing patrons — with his handheld camera. McDonald makes no mention of gaining Apple’s permission to install software on display computers that secretly snaps photos and sends them to McDonald behind the scenes. A video of McDonald’s project can be viewed below.

Read

Touted as an espionage tool but more closely resembling spyware is a new application, Phone Creeper, written by xda-developer member chetstriker. Once installed on a Windows Mobile 5, 6.1 or 6.5 handset with .NET CF 3.5, the software tool can be used to:

• secretly and remotely read incoming / outgoing sms
• secretly and remotely delete incoming / outgoing sms
• secretly and remotely view call history
• bounce sms messages off remote phone to someone else
• create a pop-up message on phone
• send a secret fart sound
• secretly and remotely listen to person – (Initiates silent call back of person to your phone with their speaker phone enabled)
• send listening in call to somebody else’s phone
• remote wipe of installed flash card

These above remote control commands are issued via SMS messages sent from any other handset to the “infected” Windows Mobile handset. The software is currently being distributed as a cab file that one must agree to install but, in the future, a code injector could be created to insert this application silently into any cab file. Once installed, the application does not appear in the task manager, does not have a user interface and runs silently in the background. So what do you think, the ultimate spy tool for parents of teenagers, a security suite to protect your data if your phone is stolen, or the progenitor of a whole new class of mobile phone spyware?

[Via WMExperts]

Read