Mobile
Commentary
12/1/2011
09:45 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Carrier IQ: Mobile App Crap Must Stop

The Carrier IQ situation is an insane breach of trust for enterprises. And unless phone makers copy the Apple model, where carriers can't pre-install app crap, it will happen again.

You just can't make this stuff up. If I had told you six months ago to be very careful about entrusting corporate data to mobile carriers who pre-install app crap, because they would build spyware into phones, collect secure Web browsing information, and embed this software so deeply that you have to change the ROM to get rid of it, you would have written me off as a paranoid. Yet, that appears to be the situation with CarrierIQ, a carrier utility gone wild.

Like the Master Control Program in the '80s science fiction classic, "Tron," CarrierIQ collects data for an ostensibly harmless purpose: to help carriers improve the quality of their network and improve the user experience. Then, it goes crazy and tries to kill everyone. It may not be as bad in this case, but the trouble is, though Carrier IQ claims, "we are counting and summarizing performance, not recording keystrokes or providing tracking tools," third party analysis of Carrier IQ begs to differ.

Specifically, researcher Trevor Eckhart writes on his blog that the Carrier IQ application "is receiving not only HTTP strings directly from browser, but also HTTPs strings. HTTPs data is the only thing protecting much of the 'secure' Internet." Carrier IQ, realizing how damaging this revelation was, tried to squelch Eckhart through a cease-and-desist letter (giving him two whole days to respond, and threatening damages starting at $180K), but the Electronic Frontier Foundation came to the rescue. Carrier IQ relented after the assault from the EFF, and is now "deeply sorry for any concern or trouble" that the letter may have caused Eckhart.

From an enterprise perspective, this is massive. It's the Jerry Sandusky of mobility. It is an insane breach of trust.

[ Not up to date on Carrier IQ? See Carrier IQ Withdraws Legal Threat Against Security Researcher. ]

Enterprises have long put up with "app crap" on Windows platforms, and, then, on mobile platforms. On the Windows platforms, enterprises would shrug, wipe the machines, re-image them, and move on with work as usual. On mobile, enterprises believed that the app crap was benign enough. Wrong.

We all knew that spyware existed on PCs, but the big difference is that spyware and rootkits got installed by malicious third parties, not our trusted partners who get paid for services that they provide.

All of a sudden, Steve Jobs' perspective about who should control mobile device firmware doesn't seem to be such a bad idea.

Carrier IQ has no relationship, at all, with the enterprise. They've said that "we do not sell Carrier IQ data to third parties" or "provide real-time data reporting to any customer." But once you generate the data, it's there for the taking.

This year's Data Breach Investigations Report, co-sponsored by the U.S. Secret Service, and, ironically, a mobile provider, emphatically states that organizations need to eliminate unnecessary data collection (since it can and will be stolen.) As enterprise trusted partners, it's time for carriers to eliminate the middleman. Carrier IQ had no incentive at all to limit the type of data that it collects.

Because Carrier IQ is so carrier focused, it may have even come as something of a surprise to the Carrier IQ folks that they may have violated wiretap laws.

The whole model needs to change, or this incident will be repeated. Carriers currently control the phone, and work with third parties to build management software that they need. The third parties have no skin in the game in terms of the trust relationship with the enterprise. Frankly, in this case, if Carrier IQ's reputation becomes so tarnished that they can no longer sustain a viable business, they can pull up their tent stakes, change their name, and resume operations.

Well, good for them, but BAD for the enterprise, because the enterprise now needs to start investing the type of time that used to be reserved for Windows PCs, in order to re-image spyware-vulnerable smartphones. It's not a matter of just removing the software. InformationWeek contributor Mathew Schwartz told me Wednesday morning that "some deployments of Carrier IQ by the carriers have an 'off switch' that smartphone owners can trigger," but that he's also seen reports that it simply doesn't work.

Now contrast that to the simpler Apple model, where Apple delivers a phone with fundamental firmware, absent the app crap. Both Apple and the carriers have major skin in the game to preserve the trust of the enterprise. If carriers want to have management capabilities on the iPhone, they'll have to EXPLICITLY have permission from the enterprise.

This type of permission is generally granted by enterprises to service providers, but it's under contract, with explicit rules of engagement, and with incentives. ("We'll give you xyz points off of your bill if you use this"; or "wow, look at this management software that you can use, it's really useful, we only ask that you allow us to have this explicit dataset.")

One case in point is Spiceworks a free network management service that spells out how it will use your information. This type of win-win arrangement is already present in the mobility world: Verizon has successfully rolled out its "My Business" service to enterprise customers, in a scenario where Verizon gets to avoid the expense of mailing bills, and enterprise account managers get an easy-to-use interface.

The point is, though, that it's pretty obvious that the current "provider gets to thoroughly load the phone with untrusted app crap" model isn't going to fly anymore. There must be a check and balance. And I think that Apple's model of shipping a phone without carrier meddling is a good start. Let carriers woo the enterprise to get permission to install management software. But with mobile phones being an integral and essential part of enterprise infrastructure, software-without-permission must stop.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
jfeldman
50%
50%
jfeldman,
User Rank: Strategist
12/6/2011 | 11:24:42 PM
re: Carrier IQ: Mobile App Crap Must Stop
Brenna, I talk about my relationship with Apple in my follow up post: http://www.informationweek.com.... Thanks.
jfeldman
50%
50%
jfeldman,
User Rank: Strategist
12/6/2011 | 11:21:43 PM
re: Carrier IQ: Mobile App Crap Must Stop
I'm not really talking about APPLE, per se, but the MODEL that Apple uses. As I say in my follow-up story, the "off" switch on the Apple platform was present because of the differing model: Apple has a relationship both with the carriers AND the end user, whereas Carrier IQ only has one with the carriers. Why would it put in a user "off" switch? Hope that helps you understand where I'm coming from.
jfeldman
50%
50%
jfeldman,
User Rank: Strategist
12/6/2011 | 11:18:03 PM
re: Carrier IQ: Mobile App Crap Must Stop
I talk a little bit about my relationship with Apple in my follow-up story. I think you'll be satisfied. http://bit.ly/ryUv6J
ATTcellguy
50%
50%
ATTcellguy,
User Rank: Apprentice
12/5/2011 | 6:45:49 PM
re: Carrier IQ: Mobile App Crap Must Stop
My comments about Carrier IQ, also posted on Verge and Washington Post.

I have worked in the Cellular Industry as a engineer since 1980. For the past 30 Years, ALL carriers have had access to this information (even in the old analog days)! Cell Towers pass a lot of 'tracking' information to the MSC (Mobile Switching Center) used in call delivery and hand-offs etc. This information includes mobile numbers, location (cell site/antenna face (direction)/etc.), RSSI (Receive Signal Strength Indicators), phone power settings, network call set up info (channel/time slot/authentication/cell tower, etc). This is separate than the "Billing Information" which is also collected (numbers dialed, times, etc.) It also logs 'dropped calls', failed hand offs and other network problems from the cell phone ! A carrier already has access to ALL this information (How else could you send your SMS/TXT, be routed to your WEB page or even complete your call? They DO NOT NEED "Carrier IQ" for anything especially in relation to "System Performance".

This information is stored on the MSC for a short period of time (usually a few days) and is then automatically overwritten (for storage reasons). BUT during those few days this information can be Accessed and downloaded, to provide ALL the information the Carriers say they NEED !
This information is 'buried' deep in the switch were very few engineers have the log-on authority and permission to access it, even under Court Orders (yes the government can order carriers to provide it) - BUT it's there I know, I was one of the few (for AT&T).

Carrier IQ goes way beyond this and records "Key Strokes". This root program knows what your typing BEFORE it gets encrypted (by the network) or even reaches a HTTPS/SSL 'secure' web page (like your bank).

As pure speculation in respect to AT&T, I'd almost bet, It's a case of the "Marketing Department" NOT talking with the Network Engineers or being told "No". Wanting this information, they could easily 'influence' the phone manufactures to include Carrier IQ. They are the people that do the 'buying' (ordering) of the phones to be sold buy the carrier. The VP of Marketing will ALWAYS out rank the VP of Engineering when it comes to sales and 'Gross Adds' (customers).

Sincerely,

ATTcellguy
YMOM100
50%
50%
YMOM100,
User Rank: Apprentice
12/3/2011 | 2:46:41 PM
re: Carrier IQ: Mobile App Crap Must Stop
Only recently with iOS 5 Apple no longer bundles CarrierIQ with iPhones. So it isn't as if Apple is soooooo much more upfront and honest about this.
MSUKA000
50%
50%
MSUKA000,
User Rank: Apprentice
12/2/2011 | 9:14:13 PM
re: Carrier IQ: Mobile App Crap Must Stop
I'm against pre-loading app garbage as much as the next person, Still, asking for the Steve Jobs model is no where close to the answer. It's clear Apple has allowed this stuff on their phones. Regardless of whether or not you have to opt in, Apple allowed it on their phones too. The 'Steve Jobs' model simply means Apple can outright choose for you what can and cannot go on the device. The Steve Jobs model is just shifting around control. Nothing more!

We've already seen Apple doing its own tracking for its own purposes. Feel free to google "Apple tracks your location".

Just how exactly is that any different? From the enterprise or user perspective, it's ALL privacy related information. There is no difference in relation to a carrier forcing Samsung to put CarrierIQ on their devices. No model 100% prevents garbage like this from getting on your phone.

("We all knew that spyware existed on PCs, but the big difference is that spyware and rootkits got installed by malicious third parties,").

With the risk of being rude, do you live in a vacuum? You seem to have forgotten about Sony installing a rootkit in years past That's a big swing and a miss don't you think? Google "Sony BMG rootkit". Not to mention the ongoing issues with legitimate purchases of USB flash drive preloaded with viruses.

It drives infosec people up the wall when someone says you need Apple and their level of control to be secure. It's simply not true and it's perpetuating a myth.
MSUKA000
50%
50%
MSUKA000,
User Rank: Apprentice
12/2/2011 | 9:12:57 PM
re: Carrier IQ: Mobile App Crap Must Stop
It's clear Apple has allowed this stuff on their phones. A giant oversight by you Mr. Feldman. Regardless of whether or not you have to opt in, Apple let this garbage on their phones too. The 'Steve Jobs' model simply means Apple can outright choose for you what can and cannot go on the device. The Steve Jobs model is just shifting around control. Nothing more!

We've already seen Apple doing its own tracking for its own purposes.

arstechnica.com/apple/news/201...

Just how exactly is that any different? From the enterprise or user perspective, there is no difference in relation to a carrier forcing Samsung to put CarrierIQ on their devices. No model which 100% prevents garbage like this from getting on your phone.

Mr. Feldman also seems to forget about Sony installing a rootkit in years past ("We all knew that spyware existed on PCs, but the big difference is that spyware and rootkits got installed by malicious third parties,"). That's a big swing and a miss don't you think?

en.wikipedia.org/wiki/Sony_BMG...

It drives infosec people up the wall when someone says you need the Apple way of thinking to be secure. It's simply NOT TRUE and the sooner people realize this, the better off everyone will be.
NotTellinYou
50%
50%
NotTellinYou,
User Rank: Apprentice
12/2/2011 | 1:00:22 AM
re: Carrier IQ: Mobile App Crap Must Stop
This is not correct. The only iOS 5 device that still includes this software is the iPhone 4 and will be removed in an update. In any case the software only sends the data if the user opts in.
NotTellinYou
50%
50%
NotTellinYou,
User Rank: Apprentice
12/2/2011 | 12:59:14 AM
re: Carrier IQ: Mobile App Crap Must Stop
NotTellinYou
50%
50%
NotTellinYou,
User Rank: Apprentice
12/2/2011 | 12:58:49 AM
re: Carrier IQ: Mobile App Crap Must Stop
This is not a correct representation:

http://arstechnica.com/tech-po...
Page 1 / 2   >   >>
InformationWeek Elite 100
InformationWeek Elite 100
Our data shows these innovators using digital technology in two key areas: providing better products and cutting costs. Almost half of them expect to introduce a new IT-led product this year, and 46% are using technology to make business processes more efficient.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Government Oct. 20, 2014
Energy and weather agencies are busting long-held barriers to analyzing big data. Can the feds now get other government agencies into the movement?
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
A roundup of the top stories and trends on InformationWeek.com
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.