Java Development

[j_davis_metova]

Hello Everyone,

I'm reading reports this week on XDA Developers that rootkit software Carrier IQ is now running on BlackBerry devices. Has anyone confirmed this? Would this be a decision by RIM or by each carrier?

I'm asking because the data that Carrier IQ can reportedly collect may raise serious privacy concerns, especially functions like keylogging. 

Thanks

Source Article:

http://www.xda-developers.com/android/the-rootkit-of-all-evil-ciq/

[rcmaniac25]

Based on http://ota.carrieriq.com/rim/, it seems like an app is available but given that it is a 3rd party app, you can remove it like any other app. RIM has stated, and various "partners" of RIM, have stated that there is no "partners only" SDK so if you can't access certain information, neither can they.

[merlin1246]

This is allegedly a "hidden" application.

How does one removed a hidden application?

[j_davis_metova]

Hi merlin1246,

I have not yet seen any actual evidence that CarrierIQ is running on BlackBerry devices. If it is on the devices, I have no idea how to remove it. "Hidden" could mean a variety of different things and is dependent on the platform. The CarrierIQ BB app mentioned by a previous poster is just a normal 3rd party app... so if that is all we're talking about, it can be removed just like any other BB app.

However, I started the thread to see if anyone has any REAL evidence that this is running on BB devices. So let's stick with that for now.

Thanks

[simon_hain]

if you check your module list, either on the phone or with javaloader, you see all modules. a "hidden" application would be a system module, but still visible in the module list.

If carrierIQ is used depends on the provider. In Germany i would doubt that they use it, privacy laws are very strict here and violations can have serious consequences.

As you can download the app yourself from the link above you can find out something about it:
Name: IQAgent
Vendor: Carrier IQ
Description: Carrier IQ Service Quality Agent

See the jad file here:
http://ota.carrieriq.com/rim/beta/5.0.0/IQAgent.jad

if you install it from there the software is listed under applications.
In the code module list (javaloader -u dir >dir.txt) it is listed as:
IQAgent 1.0.24 1511268

I'll delete it from my device now, just wanted to check it out.

[peter_strange]

I tried installing it on a Simulator, seemed to do nothing at all but perhaps they have an 'if simulator' check.....

[j_davis_metova]

simon: thanks for looking into it more. it looks like this is just a regular old 3rd party app.

peter: ...yes, i think you're right... i did a little decompiling and found this...

if( DeviceInfo.isSimulator() ) {

     CarrierIQPrivacyIntruder.instance().quickHide();
     CarrierIQPrivacyLogger.instance().destroyTheEvidence();
     CarrierIQTrackYourLifeService.instance().iDidntDoIt();
}

 ... these guys should really improve their obfuscation.

Disclaimer: that was joke. I didn't decompile CarrierIQ. That is not real code. I made it up.

[MSohm · Accepted solution]

RIM is aware of a recent claim by a security researcher that an application called “CarrierIQ” is installed on mobile devices from multiple vendors without the knowledge or consent of device users. RIM will continue to investigate reports and speculation related to CarrierIQ.

RIM can attest that it does not pre-install the CarrierIQ application on BlackBerry smartphones and has never done so. Furthermore, RIM does not authorize its carrier partners to install the CarrierIQ application on BlackBerry smartphones before sales or distribution and has never done so. RIM also did not develop or commission the development of the CarrierIQ application, nor is RIM involved in any way in the testing, promotion, or distribution of the CarrierIQ application.

If the CarrierIQ application is present on a BlackBerry smartphone, it does not mean that the CarrierIQ application has “hacked” the BlackBerry platform. It means that either the BlackBerry smartphone user or the user’s BlackBerry Enterprise Server admin explicitly installed the application and authorized it to run. The user or the user’s BlackBerry Enterprise Server admin has full control over which third-party software he or she installs on a BlackBerry smartphone. The BlackBerry smartphone is designed to prompt the user for consent to grant permissions to a third-party application.

All users (of any device from any manufacturer) should always avoid installing and granting permissions to applications from untrusted sources. This simple precaution mitigates the risk of malware or unwanted software being installed on a user’s mobile device.

For information on BlackBerry security, visit www.blackberry.com/security.

[j_davis_metova]

Mark,

Thank you for your clarification. Glad to hear it.

[simon_hain]

Thanks a lot Mark for the official clarification.
Quite quick on RIM side, too. Are there press releases about that, too?
(and btw, your link is broken)