“Our software does not record, store or transmit the contents of SMS messages, email, photographs, audio or video,” the company said in a statement.
Carrier IQ, the beleaguered wireless metrics company assures that its software “makes your phone better” delivering information on device performance to wireless operators.
“While a few individuals have identified that there is a great deal of information available to the Carrier IQ software inside the handset, our software does not record, store or transmit the contents of SMS messages, email, photographs, audio or video,” the company said late Thursday.
The stopped keeping silent when politicians and organizations continued to question Mountain View, California, company, which provides communications analysis software used by some of the largest U.S. wireless carriers, such as AT&T, Sprint and T-Mobile. The carriers said data Carrier IQ has helped them improve their service.
In a YouTube statement, system administrator Trevor Eckhart tried to demonstrate that Carrier IQ logs users’ every keystroke. The provider denies this, but security experts agree.
“Having examined the Carrier IQ implementation it is my opinion that allegations of keystroke collection or other surveillance of mobile device user’s content are erroneous,” said Rebecca Bace of Infidel Inc. a security expert.
“It’s not true,” said Dan Rosenberg, a senior consultant at Virtual Security Research, and added that the video includes only diagnostic information and there is no proof that the data is stored or sent back to Carrier IQ.
“I’ve reverse engineered the software myself at a fairly good level of detail,” Rosenberg said. “They’re not recording keystroke information, they’re using keystroke events as part of the application.”
The difference is slight but too important. Applications needs information about buttons a user has pushed to perform some commands. For example, email app requires knowing when tap the reply button, and a phone app needs to know which numbers a user press to dial. Applications just pay attention to which buttons a user is pressing.
However, listening for pressing buttons does not mean sending by an app a record of those button presses back to the company, researchers said.
Similar to Carrier IQ applications often allow users or phone engineers to tap a series of keys so they can bring up administrative options or to display information on the phone’s performance. To show that data, apps needs to know the correct code was tapped in, identifying specific key presses, as it is shown doing in the video.
According to Rosenberg, Carrier IQ program presents “a complete absence of code” that indicates button presses were being tracked and recorded by the phone.
Companies among which AT&T, T-Mobile and Sprint revealed they collect and store information considering users’ locations, phone records and SMS. That means that the companies had made a step further and were monitoring just every action which can be performed on the phone.
Although Carrier IQ denied it collected message text and other communications, it said little more about the specific types of data it does collect, whether users can opt out of the collection or how long the company keeps collected data. [Via Los Angeles Times]