Tuesday, December 20, 2011

postheadericon The Carrier IQ Saga (So Far) -- And Some Questions That Need Answers

The story so far: Trevor security researcher exposes Eckhart very disturbing reports about the "Carrier IQ" applies here. This set off a firestorm of small rapidly much greater when IQ bearer replied, trying to intimidate and threaten him into silence. It was not very good. After he refused to back down, apologized and retracted the threats.

Eckhart up by posting the second part of his research, showing some of their conclusions in the video. Considerable debate about this event occurred, for example here and here and here. Some critics of the investigation said that Eckhart is exaggerated or not rigorous enough. However, analysis and commentary suggests that the problem could be worse than what we know today. Stephen Wicker, Cornell University has studied some of the consequences, and his comments seem particularly timely given that IQ has publicly admitted carrier holding a treasure trove of data. Dan Rosenberg made a further investigation on the detailed operation of Carrier IQ, which leads to not much discussion of intelligence capabilities Carrier - there is some disagreement among researchers on this medium IQ

> against this

could

, for example: Is bearing IQ data logging software useful phone or a gold mine hacker?

Meanwhile, the scandal has grown, questions have arisen about whether federal laws were violated at least listen to a U.S. account bearer Senator, and IQ released a statement inept. Handset makers and operators have begun to move away from IQ Carrier as soon as possible, have not been denied by Verizon and Apple. T-Mobile has issued guidelines on IQ Carrier internal and external fast. Some negative aspects are more credible than others. There was some skepticism about statements Carrier IQ, taking into account the requirements of marketing and answer some questions. There is also discussion on the state claims made in the patent of Carrier IQ.

Then the lawsuits, see Hagens Berman and Sianna and the Strait and eight companies affected by the demand for some details about three of them.

attempts to find out what phones are infected with Carrier IQ is in progress. For example, the Nexus Android phones and tablet Xoom origin appear to be infected, no phones in the mobile networks in the UK, but traces of the presence in some versions of IOS, although its function is not quite clear. A preliminary application / beta detection is now available. Methods to remove what was discussed.

  • Meanhile, freedom of the response of Information Act request stated (by the FBI) ??files that support CI were used to "enforce the law," but denied Carrier IQ. And it seems that there is an awareness that this has become somewhat common practice, as Dennis Fisher astutely observed, with mobile devices, users of the product, not the buyer.
  • Here are the details, and now what the implications?
  • The debate continues as to whether IQ
  • Carrier is a rootkit and / or spyware. Some have found that
  • is a rootkit, is an evil in disguise. But it became impossible to kill, and that strikes crops - two properties most often associated with malicious software. And there is no doubt that IQ carrier actually tried to prevent publication of their results Eckhart.
  • But even if we accept, for the purpose of discussion, not a rootkit, spyware and always has an impact on the overall security system telephone: provides a good amount of pre-existing features that An attacker can exploit. In other words, get malware does not need to implement the wide range of functions and Carrier IQ is, but you only have to activate and use.

brings me to a series of questions that probably should have been the subject of public debate and the answer before this type of software is installed on about 150 million phones. I'm not talking about issues that involve the details of Carrier IQ - because I think we will get answers to investigators and court proceedings. I'm talking about more general issues that apply to all phones - in fact, all mobile devices - such as:

What kind of software debugging and performance monitoring should be included?

Who should be responsible for the installation of this software? Maintenance?

if the source code to be published so that everyone can see exactly what it does?
device owners to close / remove - or, if they asked permission to install / on? operators or manufacturers pay the cost of bandwidth for users whose devices for data transmission?
for airlines or manufacturers pay phone owners to access proprietary data on the device? Where is the line between performance measurement data that can be used to evaluate and improve services, and personal data? Is it


Find best price for : --Carrier----Eckhart----Trevor--

0 comments:

Blog Archive