[LINK] Carrier IQ

[andrew clarke]

On Thu 2011-12-01 22:46:21 UTC-0800, Scott Howard (scott at doc.net.au) wrote:

> On Wed, Nov 30, 2011 at 7:13 PM, Ivan Trundle <ivan at itrundle.com> wrote:
> 
> > So where's the outrage, the indignation, the calls for retribution?
> 
> Ho hum...
> 
> http://allthingsd.com/20111201/carrier-iq-speaks-our-software-monitors-service-messages-ignores-other-data/
> 
> Sure, they would say that, but what does the video really show?  That if
> you put your phone into debug mode, Carrier IQ logs sends stuff to the
> debug log.  That's it.  It doesn't show that it's actually logging that
> information.  It certainly doesn't show that it transfers it off the phone,
> or makes it available in any way.
> 
> Move along folks. Nothing happening here.

""The interpretation of the video is inaccurate," says Dan Rosenberg,
vulnerability research practice lead for Virtual Security Research, a
Boston-based consultancy.

"The video depicts that Carrier IQ does react to events like typing a
key," Rosenberg says. "Trevor jumped to the conclusion that this means
they are recording all your keystrokes and sending them to the
carrier. That would be a major violation of privacy. But that's not
what's happening based on my analysis."

"They are not actually storing keystroke data at any point, anywhere,"
Rosenberg says. "Much less sending the data back to carriers.""

- http://www.networkworld.com/news/2011/120211-carrieriq-skeptics-253715.html

Also, "How Carrier IQ was wrongly accused of keylogging" on CNET:

http://news.cnet.com/8301-31921_3-57335715-281/how-carrier-iq-was-wrongly-accused-of-keylogging/

Regards
Andrew