The Apple Core

Jason D. O'Grady & David Morgenstern

Rootkit called Carrier IQ discovered phoning home with user data

By | November 29, 2011, 8:30pm PST

Summary: Locationgate is nothing compared to a rootkit that’s been discovered pre-installed on potentially millions of Android handsets.

HTC rootkit discovered pre-installed on Android handsets

Remember Locationgate? Well, that might be nothing compared to a rootkit that’s been discovered pre-installed on some Android handsets.

[The Locationgate scandal erupted in April 2011 when a hidden file called “consolidated.db” (containing a database of Wi-Fi hotspots and cell towers around your phone's location) was discovered unencrypted in iOS 4.]

Well, at least consolidated.db didn’t phone home and report your whereabouts to the mothership — which is what appears to be happening on millions of Android handsets.

In this video, 25-year-old security researcher Trevor Eckhart of Connecticut shows how two nefarious apps (HTC IQAgent and IQRD) are discovered pre-loaded and running on his HTC smartphone.

Eckhart demonstrates how the surreptitious apps log text messages, encrypted web searches — and just about everything else — and send the data to Carrier IQ’s servers.

Worse, Wired reports that the rootkit can’t be turned off without rooting the phone and replacing the operating system. “And even if you stop paying for wireless service from your carrier and decide to just use Wi-Fi, your device still reports to Carrier IQ.”

Luckily, Logging Checker (main site) is an Android app by TrevE that tests to see if your device is among the afflicted. Here’s a screenshot:

logging-checker-by-treve-at-xda

Update: I ran Loggig Checker on my Droid RAZR running on Verizon Wireless and all the tests came up negative. It appears that at least the RAZR on VZW doesn’t have it.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Jason O'Grady is a journalist and author specializing in mobile technology. He has published six books on Apple and mobile gadgets and his PowerPage blog has been publishing for over 15 years.

Disclosure

Jason D. O'Grady

Jason D. O'Grady is the creator and editor of O'Grady's PowerPage, which has been publishing mobile technology news since 1995. He maintains an advertising relationship with the following legacy advertisers on the PowerPage:

  • Amazon Associates
  • Google Adsense
  • Tekserve
  • Advertising on the PowerPage is brokered by a third-party agency (BackBeat Media) and he recuses himself from these negotiations.

Biography

Jason D. O'Grady

Jason D. O'Grady developed an affinity for Apple computers after using the original Lisa, and this affinity turned into a bona-fide obsession when he got the original 128 KB Macintosh in 1984.

He started writing one of the first Web sites about Apple (O'Grady's PowerPage) in 1995 and is considered to be one of the fathers of blogging. He has been a frequent speaker at the Macworld Expo conference and a member of the conference faculty. He also co-founded the first dedicated PowerBook User Group (PPUG) in the United States.

After winning a major legal battle with Apple in 2006, he set the precedent that independent journalists are entitled to the same protections under the First Amendment as members of the mainstream media.

O'Grady is the author of The Nexus One Pocket Guide, The Droid Pocket Guide, The Google Phone Pocket Guide, and The Garmin nuvi Pocket Guide (Peachpit Press), the author of Corporations That Changed the World: Apple Inc. (Greenwood Press), and a contributor to The Mac Bible (Peachpit Press). In addition, he has contributed to numerous Mac publications over the years, including MacWEEK, Macworld, and MacPower (Japan).

When he's not writing about Apple for ZDNet at The Apple Core, he enjoys spending time with his family in New Jersey.

36
Comments

Join the conversation!

Just In

RE: HTC rootkit discovered phoning home with user data
kc63092@... 6th Dec
@ego.sum.stig@...
nice try... come to think of it, the patent office should take a look at this thing, and let the trolls cash in !!!
I use a web-proxy with ZoneAlarm Internet Security and PeerBlock as my Wi-Fi default gateway. That would have caught the rootkit's communications pants down.

Heh.

Why don't you also investigate apple ios rootkit returning 913,000 results?

~~~~~~~~~~
Mathematicians stand on each other???s shoulders and computer scientists stand on each other???s toes.
~ Richard Hamming
Under at least one Wireless provider.

To see the extend of the damage found by Trevor.. look here:

http://www.wired.com/threatlevel/2011/11/secret-software-logging-video/

and here for the charges made.

http://gadgetsteria.com/2011/11/22/carrier-iq-suing-xda-member-who-found-their-spying-software-hiding-on-android-phones/

The extent of the privacy breach is considerable as even under a secure webiste (https:) your personal info is transmitted in plain text.

On HTC Sensatation (GSM bands) QXDM2SD which is suspiciously similar to CIQ even though its been reported to encrypt the SD Card.. seems to be tied to the SYNC Widget with similar traits as IQRD. Will need to investigate.
0 Votes
+ -
RE: HTC rootkit discovered phoning home with user data
FuzzyBunnySlippers Updated - 29th Nov
@WinTard

1. I like your Richard Hamming quote.
2. Didn't know there was an Apple IOS rootkit, I'll Bing it.
3. PeerBlock really needs to step up to running as a service, and IPv6.
4. Nice idea with the proxy (honest admiration), but what about your cell provider data?

My guess for 3, only time and devs, it'll come along. For 4, your method would undoubtedly work with WiFi only, which I'll assume you meant. I was considering others without such an understanding.
@FuzzyBunnySlippers

I followed your suggestion and used Bing's search result for apple iOS rootkit. (like you, I had never heard of an Apple iOS rootkit before.)

Well, Bing returned one search result that reported on a 2008 reported CISCO IOS rootkit proof of concept security breech.

I wonder if WinTard confused CISCO's IOS (Internetwork Operating System) acronym with Apple's use of the iOS name?
0 Votes
+ -
@WinTard I followed your suggestion and googled "apple ios rootkit" and came up with 2 different articles that talk about the HTC issue and quite a few that deal with Cisco rootkits... and not one about an Apple iOS rootkit.

Either post some proof of this alleged rootkit or simply admit you are a troll spreading FUD.
0 Votes
+ -
@Pete "athynz" Athens

I have to think that he really knows this, and thought that by using the term "IOS ROOTKIT" might make people think that there are lots of reports about an Apple iPhone rootkit.

THERE AREN'T.

In fact, searching for "IOS ROOTKIT" finds articles, of which the vast majority, were written YEARS before the iPhone's introduction.

IOS, for those who don't know, in this context refers to an operating system by CISCO that runs their networking gear.

en.wikipedia.org/wiki/Cisco_IOS
@majcm

As you probably are aware of by now, Apple issued a statement that said this "root kit" was not used in iOS 5 or on iPhone 4S models. Apple did state that prior iPhone models did have this software installed but the user could disable it's diagnostic feedback functions. (Although Apple never informed the public just how evasive this "diagnostic software" actually was.) Also, ZDNet has reported that Apple will release, shortly, an iOS update that will remove this code from earlier iPhone models.
0 Votes
+ -
How amusing
ego.sum.stig@... 29th Nov
One more reason to avoid the mobile ball and chain. I do wonder if this rootkit stuff is patented.
@ego.sum.stig@...
nice try... come to think of it, the patent office should take a look at this thing, and let the trolls cash in !!!
0 Votes
+ -
So prosecute HTC
guihombre 30th Nov
You have an app, you didn't give it permission to do that, reading their site shows they're a usage tracking app, that would be illegal, certainly under EU privacy laws (in France it could come under their criminal laws too). I bet there's plenty of laws in the US that HTC are breaking here.

If you got the phone under contract, the carrier could well be liable too.

Really if you don't nip this in the bud here and now with a decent multi-billion dollar class action, everyone of the handset makers will start doing this, and every carrier will start doing it. It needs to be stopped here and now.

Even Google's HTTPS sessions, a move by Google to protect the privacy of its users from third party snooping, they're passing the data over that link too. It's unbelievable that any handset maker would do that.

---
If corporations are people, criminal law should apply to their CEO's.
0 Votes
+ -
Not Samsung, not Sony Ericsson
guihombre Updated - 30th Nov
Well I have a few phones, I can't find it on Samsung (Galaxy) or Sony Ericsson (X10 mini) phones, but it doesn't mean that the carriers wouldn't require it in their markets.

Wired also says that Nokia has been using it. They're definitely liable under European privacy laws....

From the companies (Carrier IQ) website for their service logger:
"IQ Insight Service Analyzer delivers the next level of visibility into mobile service quality and performance. Based on Carrier IQ's leading Mobile Service Intelligence Platform, IQ Insight Service Analyzer uses data DIRECTLY FROM THE MOBILE PHONE to give a precise view of service performance as experienced by the subscriber of CLEAR INSIGHT into the DETAILED interactions between the service and device."

Appears they log interactions with the phone systems, all the GSM messages etc.

From their experience manager:
"Identify exactly how your customers interact with services and which ones they use. SEE WHICH CONTENT THEY CONSUME, even offline. Identify problems in service delivery, including the inability to connect to the service at all. This actionable intelligence enables you to focus on critical quality and customer satisfaction issues."

Wow, it's like they wrote a rootkit and then confessed in nice, easy to understand language, that even a judge can understand. "Here we confess, we snoop on everything, even offline stuff, come raid our offices".

Incredible.
@guihombre Can't be 100% sure, but it doesn't seem to be on my phone, which is an HTC provided through one of the UK's carriers. Maybe it's only installed for specific geographic markets.
@guihombre
If corporations are people, criminal law should apply and the corporation should go to jail. Since they are only persons created by law and don't have bodies to incarcerate, maybe the legal penalty should be to cease doing business for the duration of the imposed jail time. Forgetaboutit, that would only happen in a democracy.
If HTC is the problem, then why does this spyware only appear on phones tied to a carrier contract? Why can the same kit be found on on all phones tied to certain carriers? The source of the problem lies with the market and American consumers who have accepted a carrier monopoly on handsets.
0 Votes
+ -
If you read the article on the Register the researcher only used HTC to demo the problem.


"Eckhart said he chose the HTC phone purely for demonstration purposes. Blackberrys, other Android-powered handsets, and smartphones from Nokia contain the same snooping software, he claims."
0 Votes
+ -
Froze it with Titanium Backup
dougsyo@... 30th Nov
My phone is rooted, one reason is so that I can run Titanium Backup. When this first came out, I "froze" HTC IQAgent. I didn't catch that IQRD was part of this too (although the icon is the same) so I just "froze" that as well.
Not on my Verizon HTC Thunderbolt.

What carriers/phones is this confirmed to be on??? Anyone?
@wendellgee@... Yes it is. The nature of a rootkit makes it so that you can't see the software running unless you know the exact calls to make it show itself. Only way to be sure that you're not running this is to have an AOSP based ROM on a rooted device (eg. Cyanogen Mod)
0 Votes
+ -
Carrier IQ on Samsung, Motorola, etc.
illegaloperation 30th Nov
Why doesn't the article mention that Carrier IQ is also on Android devices from other manufacturers such as Samsung?
My Sprint HTC EVO 3D has the rootkit installed.
0 Votes
+ -
Hats off to the Geeks.
Rick Sos 30th Nov
If it wasn't for the Geeks finding all this spy crap somebody would know you farted before you woke up this morning.

Hmmm, Just wondering, Do our nations Governments use these phones? Couldn't this be a form of treason or maybe a form of terrorist activity?
Or do they want it there so they can mine the info at a later date in the name of security. Hahaha what a can of worms this could turn out to be.
It might as well be your government forcing this upon the wireless providers for better understanding of what the bad guys are up to. And their sisters, brothers and neighbors too.
Could be, this is already a security breach nightmare for anyone, personal to enterprise, that has used a smart phone to enter pin codes and/or passwords. I recommend not using you phone to change these pronto. Thanks Trevor you're a HERO.
0 Votes
+ -
I was thinking that there are other things clever folks might do with a rootkit laden phone. Along the lines of a time-honored method of dealing with human spies (other than "capping them one" behind the ear), namely either turn them and provide disinformation for them to send to their masters or feed them the disinfo without their knowledge to the same end. Also, wouldn't sending taunts (and dare I hope, the odd malicious payload) be a whole lot of fun? I was thinking someone could maybe code a shell around the rootkit or an entirely different process running in the rootkit that sends stuff they don't want to them instead of what they do want. . .
it's not HTC it is google android and there is reference in their terms and conditions, if you bothered to read them, about sending usage information. google are actively seeking more and more personal information to sell
@techguru@...

Do no evil, except???
0 Votes
+ -
You get what you pay for
kingkong88@... 30th Nov
It looks like this is the carrier's doing. I presume you pay less when you get the phone from the carrier. This trojan is the trade-off.

You are free to buy a phone directly from the manufacturer, but right now you don't pay a cheaper monthly rate even though you save the carrier lots of money. In a free market, you should be paying less subscriptions fees. So it's up to consumers to step up and make their voice heard.

In some jurisdictions, phones cannot be locked. In those markets, carriers compete with this same regulation.
I found it on mine, HTC EVO sprint is the provider. Now what can I do?
BTW, has anyone checked Android tablets for this crap yet?
0 Votes
+ -
Is QXDM2SD.apx the same thing?
amailmanyouknow 1st Dec
QXDM2SD.apx is on my HTC Incredible 2 - I can't force stop, can't get rid of it....it's running and it doesn't SAY that on the "Running Applications" window.... and it eats data like mad. Is this the same thing? Phone's not rooted, I am afraid I'd turn it into a brick.
0 Votes
+ -
Who is behind all this?
kingkong88@... 1st Dec
Carrier IQ is just the software developer. Who is paying for this software? Google, phone manufacturer, or the carrier?

I don't think the phone manufacturer is interested in the data. They are not in the ad marketing business.

It has to be either Google or the carriers. How can users claim back the data costs incurred by this activity?
0 Votes
+ -
I have deliberately stayed away from smartphones, tablets, etc. because of the potential security issues and because I just don't need to be online every waking moment or to pay a biggish chunk of money each month for the privilege. I can eat for two weeks on what these guys want for a month of what is for most people a luxury.

Right up until I recently received a Nook Color for my birthday and now I have to wonder if it's spying on me. (Hence my earlier posting about tablets.) At least all I do with it is read books and get weather forecasts and the occasional Google map. So, good luck to B&N or Google on getting any info from it more than they'd have "legitimately" or somehow further monetizing my reading/browsing experience. Even so, I guess I'm going to _have_ to root it now on general principles.

I've been called paranoid. But is it paranoia if you have actual evidence that "they" (whichever "they" it happens to be this week) are, in fact, out to extract something from you you don't want to give them? At least my dumbphone provider, Verizon, apparently has not gotten involved with these creeps.

Some more questions come to mind, involving another potential tort. What is the volume of the data CIQ is sending back per device per activity? And are the carriers who use it counting this volume against their customers' usage limits? It looks fairly small, compared to the data the customer is sending and receiving, but still. . .

I'm firing up the old popcorn maker-- this is going to be _so_ much fun to watch. The cellphone carrier (and Google and Carrier) bigwigs are about to get the kind of rectal examination usually reserved for Republican presidential candidates, oil company execs and Rupert Murdoch.

So much for "Don't Be Evil.".
I went to the site and know where does it show how to use it. My phone won't download it.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix