[liberationtech] Carrier IQ

[Eugen Leitl]

On Wed, Nov 30, 2011 at 01:05:03PM +0000, Katrin Verclas wrote:
> I am trying to find out more as well and it seems some of the Wired et al claims are overblown - see, for instance, this today http://blog.jgc.org/2011/11/getting-little-tired-of-security.html?m=1
> 
> Also, CarrierIQ does not seem to be logging anything that the carriers don't already log in real time (CarrierIQ does not) other than possibly battery life/device performance, according to Eric King at privacy.org. 
> 
> It's unclear why there is such a hoopla about this now and focused on CarrierIQ aong (plenty of competitors in that space). 
> 
> CarrierIQ incidentally also runs on ATM machines etc - so if you really want to dig into pw sniffing etc, that would be the place given that CarrierIQ seems to log info in a much less timely manner thn your friendly operator does (such content of sms, logs, IMSI/IMEI etc)    

Does anyone know whether the ATM logs the serial number
of the bills issued to a particular person? (I know that
the bank itself does log it).
 
> We should actually get some EVIDENCE as Graham suggest. Anyone game?

Presence of the rootkit is all the evidence you need.
Past experience has shown that everything which can be
used eventually will.