Security Smorgasbord, vol 3, no 1

It's been quite a while since I've done one of these.

Privacy as the Third Rail, Act the First

Welcome to the underside of the bus, CarrierIQ:

“The reports we have seen about Verizon using Carrier IQ are false,” Verizon spokeswoman Debi Lewis wrote in an email to The Register.

In his own email, Nokia spokesman Mark Durrant wrote: “Further to your piece, CarrierIQ does not ship products for any Nokia devices, so reports that they have been found on Nokia phones are wrong.”
A statement from RIM, reported by IDG News, was even more categorical.

"RIM does not pre-install the CarrierIQ app on BlackBerry smartphones or authorize its carrier partners to install the CarrierIQ app before sales or distribution," the company said in a statement. "RIM also did not develop or commission the development of the CarrierIQ application, and has no involvement in the testing, promotion, or distribution of the app.”

Everyone but Sprint is running as fast and as far from this turkey as they can.  Customers get twitchy, but Enterprise customers (big companies and the Government) get extra super crazy twitchy about this.  It's a cold dead certainty that Fortune 100 company IT Security organizations are being asked pointed questions about whether their employees are being monitored, and whether the corporation's data is safe.  It's a cold dead certainty that those IT Security organizations are asking very, very pointy questions to their cell phone providers.

The market is fixing this, and fast.

Privacy as the Third Rail, Act the Second

It's not just corporations who are asking pointed questions:

Senator and former late-night funnyman Al Franken has called on Carrier IQ to explain why its diagnostic software, buried in the bowels of 141 million smartphones, isn't a massive violation of US wiretap laws.

In a letter sent to Larry Lenhart, CEO and president of the Mountain View, California-based software maker, Franken expressed concern the software may run afoul of the Electronic Communications Privacy Act, which forbids the monitoring of communications without the users’ consent, and the Computer Fraud and Abuse Act.

So riddle me this ECPAman, if CarrierIQ has violated one or more of these statutes, would that make AT&T, Verizon, Sprint, et al unindited  co-conspirators?  Want to bet long odds that that very question hasn't been discussed in the office of the Verizon General Counsel?

Like I said, the market seems to be fixing this at warp speed, but there's a whole can of hurt waiting in this for someone.

Privacy as the Third Rail, Act the Third

The mobile phone spyware incident is becoming as filled with flavor as a jar of Vegemite:

The row has Australian carriers putting as much distance between themselves and Carrier IQ as they can, as quickly as they can. Telstra’s Craig Middleton hit the Twittersphere today: “Telstra does not use it. We only use customer data for connecting calls and billing for services”.

The carrier’s New Zealand subsidiary Telstra Clear made a similar, but shorter statement.

Wrapping up the Australian carrier scene, both Optus and Vodafone told News.com.au that Carrier IQ’s software isn’t in use in this country; Vodafone has made the same statement for New Zealand, as has Telecom New Zealand.

It seems that the CarrierIQ spyware runs on iPhones, too, although at this rate it will be a mystery how it got installed on 140 Million devices when none of the manufacturers and none of the carriers have anything to do with it ...

I keep telling them, and they keep not listening, vol XCDXII:

FBI Bigwig: Three cities got hacked through Internet-connected SCADA controllers:

Speaking at the Flemings Cyber Security conference in London, [FBI Deputy Assistant Director] Michael Welch said the hackers could theoretically have dumped sewage into a lake or shut off the power to a shopping mall.

"We just had a circumstance where we had three cities, one of them a major city within the US, where you had several hackers that had made their way into SCADA systems within the city," Welch said.

Now this could just be the Fed.Gov hyping something to get more budget.  However, it's more than plausible.  So here's the important question: which is more of a threat - hackers taking down the power grid, or the government taking more power?  But don't worry, McGruff the CyberCrime Dog is on it:

Nobody ever said that Internet Security wasn't messy ...