EFF: Some Facts About Carrier IQ(eff.org) |
EFF: Some Facts About Carrier IQ(eff.org) |
This happens when crash reporting tools collect copies of the system logs for debugging purposes. The recipients of such transmissions are unlikely to have anticipated receiving keystrokes, text messages, URLs or location information through such channels, but that can in fact happen on some of the phones to which Carrier IQ has been ported.
What this means is that keystrokes, text message content and other very sensitive information is in fact being transmitted from some phones on which Carrier IQ is installed to third parties."
Third-party apps can request READ_LOG manifest permissions and directly monitor the log, but that is an incredibly rarely used permission that tends to raise flags.
Here's a link to a piece of software that can detect CarrierIQ on your phone: https://market.android.com/details?id=org.projectvoodoo.simp...
Similarly, the keypress logs were in hex or something as I recall. All there and usable by anyone who knew what it was, but maybe not that obvious if you didn't know what the hell that part of the log meant.
In other words, if people were just scanning the logs for other stuff, rather than reading each log carefully, they'd probably have ignored that stuff.