Android developer Trevor Eckhart last week discovered a widespread rootkit, called Carrier IQ, that is often installed by carriers and seems capable of logging everything you do. Here's how it works and how you can get rid of it.
What Is Carrier IQ?
Last week, 25-year old Eckhart discovered a hidden application on some mobile phones that had the ability to log anything and everything on your device -- from location to web searches to the content of your text messages. The program is called Carrier IQ, but it isn't malware being distributed by criminals; it's sold as a service to mobile phone companies for troubleshooting and tracking purposes.
It's not clear yet whether the software has been routinely installed in Australia by local carriers; the coverage to date has been very US-centric.
How To Tell If It's Running On Your Phone
Originally, Android users were the only ones able to detect and remove the program (score one for openness). However, depending on your phone, you may have to be rooted to do so. Once rooted, running the "CIQ Checks" task in this app on XDA will tell you whether it's running on your system. On HTC phones, you can also search for the app in Settings > Applications as described in the video above, but using the Logging Checker app is the most reliable way to check.
Note also that if you're running an Android Open Source Project (AOSP) based ROM -- like CyanogenMod -- you do not have Carrier IQ installed on your system. These apps are based on the original, open source version of Android, and don't include any carrier or manufacturer additions like Carrier IQ. If you're using a modded version of your manufacturer's ROM, however -- for example, a modded HTC Sense or Samsung TouchWiz ROM -- you could still have it installed. To avoid this, either flash AOSP-based ROMs, or flash ROMs with Carrier IQ specifically removed (many will say NOCIQ or something similar on their description pages).
How To Remove It From Your Device
Android: If you want to remove it from your device, you have two choices. Either flash a custom ROM that doesn't contain Carrier IQ (as described above), or use Eckhart's Logging Test App to remove it. Both solutions require rooting your phone.
To remove it with the Logging Test App, download the original app and then buy the $0.99 Pro licence from the Android Market. Then, open it up, hit the Menu button, and tap "Remove CIQ". This will completely remove it from your device.
iPhone: Turns out the iPhone can also be affected. Here's how to switch it off on the iPhone.
If you want more information on Carrier IQ, XDA Developers and a few other outlets have written a few great articles that give a bit more detail. Check out the following posts if you're curious:
- Carrier IQ Part 1 and Part 2 [Trevor Eckhart]
- The Rootkit of All Evil - CIQ [XDA Developers]
- More on Carrier IQ [XDA Developers]
- How Much of Your Phone Is Yours? [Geek.com]