Database Users

HTC Sneaks Spying App into Android 2.3.4 Phones

http://hothardware.com/News/HTC-Sneaks-Spying-App-into-Android-234-Phones/
Hooray

note:
flipz also removes the CIQ from his rom (and has for a while)
http://forum.xda-developers.com/showthread.php?t=1046622
here is the CIQ www
http://www.carrieriq.com/overview/IQInsightExperienceManager/index.htm

Big brother is always watching. Even if it is a half brother from Taiwan.

CDKJudoka said:
Big brother is always watching. Even if it is a half brother from Taiwan.
Click to expand...
Click to collapse
Probably MIUI has the same thing too inlcuded, who knows!

AA27 said:
Probably MIUI has the same thing too inlcuded, who knows!
Click to expand...
Click to collapse
It may just be a special app, but I doubt it. I think the MIUI was written for the KIRFers of all the apple knockoffs.

AA27 said:
Probably MIUI has the same thing too inlcuded, who knows!
Click to expand...
Click to collapse
I wouldn't doubt if it had some sort of tracker included, but I have enough crap made in China, including most of my phone, so I'm not even trying it.
Sent from my PC36100 using Tapatalk

The simply thought of spyware and how info is collected is spooky enough to be suspicious of everything.
Sent from my PC36100 using XDA App

Another reason to not run Sense.

Carrieriq is asked for by sprint to be included in all Android phones, however, all of its features are turned off, so the only impact it has on you, the user is ~20kb of memory space less.
Sent from my PC36100 using XDA App

Probably wrong but the dropbox folder is for users that go to the market on their computers and download apps from there. You can have your phone download an app straight from your comp for those that don't know.
But aren't all there privacy issues understandable??? All the noobs that never mod their phones want a more pleasant experience....well this is what they have to give to get a better user experience...
sent from my synergized, v6 scripted beast.

Time to use a SSL VPN. or openVPN time.

Its easily disabled even if you don't use a ROM that strips it out (like Fresh Evo 4.2).
Here is how. Use titanium backup to freeze the following programs:
"HTC IQAgent 2.3.3"
"IQRD 2.3.3"
Freezing or uninstalling those 2 programs completely disables Carrior IQ. You can verify this yourself by looking at your logcat. You'll see some errors show up saying:
Unable to start service Intent {act=com.htc.android.iqagent.action.ui19 (has extras) }: not found.
This is caused by the system trying to start IQ, but failing. Uninstalling these programs should be ok, but I choose to freeze them just in case there are issues that arise from their removal.

Art2Fly said:
Carrieriq is asked for by sprint to be included in all Android phones, however, all of its features are turned off, so the only impact it has on you, the user is ~20kb of memory space less.
Sent from my PC36100 using XDA App
Click to expand...
Click to collapse
It has a huge impact on the phone and is one of the main reasons why sense roms are slower than AOSP. There have been more than a few times I've found it using up about 30% of my CPU and causing everything else to run like crap.
Sent from my PG86100 using XDA Premium App

I laugh at the "excusing" in this thread.
If Apple was doing this people would be flaming them and attack Apple/iphone as a whole.

Funny how that article says it's just now being found when we've known about it for over a year lol

What you guys don't seem to get is that they have been doing this for longer then you think! There are a few apps things running that do this in 2.1.

MultiDev said:
Its easily disabled even if you don't use a ROM that strips it out (like Fresh Evo 4.2).
Here is how. Use titanium backup to freeze the following programs:
"HTC IQAgent 2.3.3"
"IQRD 2.3.3"
Freezing or uninstalling those 2 programs completely disables Carrior IQ. You can verify this yourself by looking at your logcat. You'll see some errors show up saying:
Unable to start service Intent {act=com.htc.android.iqagent.action.ui19 (has extras) }: not found.
This is caused by the system trying to start IQ, but failing. Uninstalling these programs should be ok, but I choose to freeze them just in case there are issues that arise from their removal.
Click to expand...
Click to collapse
Thanks for this. I backed it up in case there were problems (which I don't expect) and then uninstalled it. I'll post here if I get any errors.

tnerb123 said:
What you guys don't seem to get is that they have been doing this for longer then you think! There are a few apps things running that do this in 2.1.
Click to expand...
Click to collapse
And that makes it okay?

BTW, Is there any easy way to keep the system from trying to start CIQ after having removed it?

Think one thing: Regardless of OS companies want to know your steps by any means necessary. It is a shame that instead of asking people companies have to secretly steal personal information.
Sent from my PC36100 using XDA App

Ummm does this worry anyone else?

I've been up late tonight, and just so happened to stumble across this article over at AndroidPolice. Figured it might interest some people here since it includes our phone.
http://www.androidpolice.com/2011/1...e-numbers-gps-sms-emails-addresses-much-more/
Here's the thing, though. They recommend uninstalling the offending apk immediately, which I tried.....Unfortunately that gives me repeated force closes over and over and over while the system tries to run it, to the point where I had to restore to a backup. So what do we do about this?
UPDATE: You can remove HTCloggers.apk...all you have to do is restart afterwards.

Evo4gLI said:
I've been up late tonight, and just so happened to stumble across this article over at AndroidPolice. Figured it might interest some people here since it includes our phone.
http://www.androidpolice.com/2011/1...e-numbers-gps-sms-emails-addresses-much-more/
Here's the thing, though. They recommend uninstalling the offending apk immediately, which I tried.....Unfortunately that gives me repeated force closes over and over and over while the system tries to run it, to the point where I had to restore to a backup. So what do we do about this?
Click to expand...
Click to collapse
Yes and no.
Yes because so many users run Sense.
No because I run AOSP.
Frankly, I wonder how many other serious flaws there are.
I can name several apps that want their hands on permissions they have no business in [Facebook for one]

Its like 1984 for sure. There's an article in the new section here at xda that talks about some of the other vulnerabilities as well.
Sent from my PC36100 using xda premium

Thanks for sharing. Another reason why we root our phones
Sent from my PC36100 using XDA Premium App

Many devs remove these programs and such to remove ciq. I can't find the thread right now, but it reads just about everything. It's so deeply imbedded into the framework.
It reads every button you press on your keyboard.
Every text you send and receive.
Every app you use and download.
The pages you browse on using the internet browser.
It even goes as far to read any spot on your screen that you touch.
This is spyware to the extreme. Sprint and HTC will say its not "spyware" and say its used only for marketing to determine how phones are being used to further develop for the current trends in smartphones. It's very possible they could steal personal info with this. Is it currently happening? Uhh...probably not, but there will still be a lot of paranoia about it.
Sent from my PC36100 using XDA App

Sounds like a really good reason to stay with AOSP to me...

very True Haha
Sent from my GT-I5800 using XDA App

Some of us haven't forgotten the XCP rootkit that was on some Sony BMG titles in 2005... hope HTC doesnt suffer a similar demise like Sony eventually has of late.

This has been removed from MikG.

This is exactly why I'm AOSP. (that and sub-100MB ROM files)

I read the article too- (I have an Androidpolice/Android Central) feed in my Pulse reader....
I already knew CIQ and such were slimy embedded spyware...but the Treve app- spotted stuff I hadnt deleted already... Sprint sent me a "letter" about bandwidth usage and We-KNOW-what-Your-Doing" ----
I'm not amused by HTC/Sprint's collusion... leaving our bottoms out there in the cold for anyone to do whatever with.....
I bet even money my phones been cloned... sometimes I can't use it for calls .. recently -and I'd not had a single missed call or problem in a year.
I'm not a happy camper.. worried about my credit card #'s and really really am annoyed by HTC sliming us this way...
to the tune- that it'll be an icey cold day in hell before I'd consider buying another HTC phone for anyone in my family- (my family has 3 Evo 4g)...
We are not amused.....

HipKat said:
Sounds like a really good reason to stay with AOSP to me...
Click to expand...
Click to collapse
AMEN

it appears to me that this file has already been removed from MikFroyo. At least, I can't find it...

BTW, you can just remove it using TIbackup, but you'll have to restart to get rid of the repeated force closes. Simple fix, and I've done the same for CarrierIQ as well.

It was removed from sprint lovers rom as well... I couldnt find it at least

I removed HtcLoggers.apk from mine and after rebooting (force close loop) it seems to be working fine. However, is there an old log file still on the phone that can be read by some Spyware app that needs to be removed or does all this data need to come from the logger app itself? If there still is a log, I'm sure it has enough info to still steal my ESN and other stuff.

Wow! Glad I run custom ROMS

possibly the end of nexus geting updates directly from google

http://www.droid-life.com/2011/11/1...ak-in-two-bloatware-apps-on-the-galaxy-nexus/

silver03wrx said:
http://www.droid-life.com/2011/11/1...ak-in-two-bloatware-apps-on-the-galaxy-nexus/
Click to expand...
Click to collapse
Not necessarily. Those apps might not be integrated into the rom.

poit said:
Not necessarily. Those apps might not be integrated into the rom.
Click to expand...
Click to collapse
They are. The pics are in the galaxy nexus general forums. This killed my dream of getting a Nexus phone...... Will the international version work on Sprint???
Sent from my 1.6 ghz 3.2 rockin A500

Qwallace70129 said:
They are. The pics are in the galaxy nexus general forums. This killed my dream of getting a Nexus phone...... Will the international version work on Sprint???
Sent from my 1.6 ghz 3.2 rockin A500
Click to expand...
Click to collapse
I think what he meant is that those apps aren't put there until after the rom is installed, meaning Verizon put them there.
You make your statement with such certainty, yet provide nothing to back it up - why are you so sure?
Sent from my SPH-D700 using XDA App

The pics show it...... ICS has a built in uninstaller/disable feature...... There is no option to uninstall or delete.... Only disable... Meaning its cooked into the rom(if I've learned correctly) which also means all updates have to go through Verizon. No bueno for a Nexus phone....
Sent from my 1.6 ghz 3.2 rockin A500

Qwallace70129 said:
The pics show it...... ICS has a built in uninstaller/disable feature...... There is no option to uninstall or delete.... Only disable... Meaning its cooked into the rom(if I've learned correctly) which also means all updates have to go through Verizon. No bueno for a Nexus phone....
Sent from my 1.6 ghz 3.2 rockin A500
Click to expand...
Click to collapse
As long as Google pushed the update with a data backup, it shouldn't be an issue, correct? Google would update everything except carrier apps. Carrier could update them like the way Sprint updated Sprint Navigation to Telenav or some other delivery method.

Qwallace70129 said:
The pics show it...... ICS has a built in uninstaller/disable feature...... There is no option to uninstall or delete.... Only disable... Meaning its cooked into the rom(if I've learned correctly) which also means all updates have to go through Verizon. No bueno for a Nexus phone....
Sent from my 1.6 ghz 3.2 rockin A500
Click to expand...
Click to collapse
I think that only means that the app is installed into the system app directory, instead of the user app dir. I suppose I will have to adb push an apk into my system app folder to confirm, but I'm fairly certain that the lack of an uninstall button is because android never gives that option for system apps...
Sent from my SPH-D700 using XDA App

styles420 said:
I think that only means that the app is installed into the system app directory, instead of the user app dir. I suppose I will have to adb push an apk into my system app folder to confirm, but I'm fairly certain that the lack of an uninstall button is because android never gives that option for system apps...
Sent from my SPH-D700 using XDA App
Click to expand...
Click to collapse
Please say it would be that easy.... But then again it defeats the purpose of me buying a nexus if I have to get rid of bloatware.
Sent from my SPH-D700 using xda premium

Supposed to be a developer platform....what developer is going to want VZ Backup assistant...lol.
Verizon: You are dumb.
Oh well, I still believe it will be google updated.

Guys, in ICS there is a feature in which you can hide the apps.
Also i dont think this really matters. The two apps included are something verizon users may want. Looking at your status with the company and backing up information with the carrier hardly seem like bloat apps to me. Also, this is only the case for verizon and not other carriers like sprint, which can uninstall bloatware apps. I still believe google will be pushing out their own updates.
Sent from my Galaxy Tab 10.1

I'm a little curious why this would discourage anyone here from owning this phone. Are any of you guys buying it with the intention of running stock?

Even if people plan on using cooked roms they still want google to push the updates because that means they would come quicker and therefore the developers would have new versions to create new roms off of.
See. I am learnimg.
Sent from my Epic on Legandary ROM or my Galaxy Tab rooted (feels naked without a ROM)

|| Acer || said:
Guys, in ICS there is a feature in which you can hide the apps.
Also i dont think this really matters. The two apps included are something verizon users may want. Looking at your status with the company and backing up information with the carrier hardly seem like bloat apps to me. Also, this is only the case for verizon and not other carriers like sprint, which can uninstall bloatware apps. I still believe google will be pushing out their own updates.
Sent from my Galaxy Tab 10.1
Click to expand...
Click to collapse
Verizon users that want them could just install them though! that's the complete opposite of them being installed and people who don't want them being unable to uninstall them...

faceless said:
Verizon users that want them could just install them though! that's the complete opposite of them being installed and people who don't want them being unable to uninstall them...
Click to expand...
Click to collapse
The Verizon customers that don't want them are almost certainly going to know at least enough to be able to remove them, but many of the users that would want them would also fall into that special category of users that know just the bare minimum to be able to use the phone - average users, the ones even XDA noobs can run circles around. They make up the majority of Verizon's customer base, so the big V will cater to them. (They're also a lot more likely to pay for things that can be had for free, because they're a lot less likely to know that those things can be free... it's a two-fold win for any service provider)
Sent from my SPH-D700 using XDA App

Simply put, google can still update the phone.

I don't understand how the OP jumped to the conclusion he did. How does two "bloatware" apps point to "the end of nexus geting [sic] updates directly from google"?
Nonsensical, I tell you!

AmericanJedi001 said:
I don't understand how the OP jumped to the conclusion he did. How does two "bloatware" apps point to "the end of nexus geting [sic] updates directly from google"?
Nonsensical, I tell you!
Click to expand...
Click to collapse
I think this is the logic:
When a phone gets major customization from a carrier such as Sense or Touchwiz, it complicates the updates and delays updates due to additional testing and debugging needed on these customized ROMS. People are assuming that is the reason why US carriers get updates so much later than the much more plain European versions. So, the OP assumes that adding two Verizon apps is somehow as complex a modification as adding Touchwiz, therefor it will delay the release of jellybean, or whatever the next version will be called.
Seems pretty silly to me.

poit said:
I think this is the logic:
When a phone gets major customization from a carrier such as Sense or Touchwiz, it complicates the updates and delays updates due to additional testing and debugging needed on these customized ROMS. People are assuming that is the reason why US carriers get updates so much later than the much more plain European versions. So, the OP assumes that adding two Verizon apps is somehow as complex a modification as adding Touchwiz, therefor it will delay the release of jellybean, or whatever the next version will be called.
Seems pretty silly to me.
Click to expand...
Click to collapse
What I was trying to say all along. Thank you.
Sent from my SPH-D700 using XDA App

Carrier IQ

All right the company Carrier IQ is suddenly popping up in news stories everywhere. I assume I am safe from this garbage if I am using Cyanogenmod but how do I make sure my Wife's shift is clean of this if she's using Stock rooted 2.2? She will not let me change roms or even upgrade her to 2.3 so I would like to know what I need to delete to make sure Carrier IQ is not installed on her Shift or at least not sending any info back to it's mother ship.
If you haven't heard Carrier IQ is installed on millions of phones of different manufacturer's and is supported by many carriers including HTC and Sprint. It collects data and sends it back to Sprint or who knows who. Apparently it can log everything and it ignores any permissions or security you have set up or something like that. It is installed "invisibly" and you do not have the option to opt in or out. I assume Titanium or some other program can see the pieces I would need to delete but I don't know what they are.
Here's where I read about it and it does list an app that may be able to take care of it but I would rather know how to do it manually:
http://www.engadget.com/2011/12/01/carrier-iq-what-it-is-what-it-isnt-and-what-you-need-to/#comments
Thanks

Evo_Shift said:
All right the company Carrier IQ is suddenly popping up in news stories everywhere. I assume I am safe from this garbage if I am using Cyanogenmod but how do I make sure my Wife's shift is clean of this if she's using Stock rooted 2.2? She will not let me change roms or even upgrade her to 2.3 so I would like to know what I need to delete to make sure Carrier IQ is not installed on her Shift or at least not sending any info back to it's mother ship.
If you haven't heard Carrier IQ is installed on millions of phones of different manufacturer's and is supported by many carriers including HTC and Sprint. It collects data and sends it back to Sprint or who knows who. Apparently it can log everything and it ignores any permissions or security you have set up or something like that. It is installed "invisibly" and you do not have the option to opt in or out. I assume Titanium or some other program can see the pieces I would need to delete but I don't know what they are.
Here's where I read about it and it does list an app that may be able to take care of it but I would rather know how to do it manually:
http://www.engadget.com/2011/12/01/carrier-iq-what-it-is-what-it-isnt-and-what-you-need-to/#comments
Thanks
Click to expand...
Click to collapse
Run supreme sense

VICODAN said:
Run supreme sense
Click to expand...
Click to collapse
I know! I told my wife it is better...she still says no

You can use Treve's app http://forum.xda-developers.com/showpost.php?p=17612559
https://market.android.com/details?id=com.treve.loggingkey

Evo_Shift said:
I know! I told my wife it is better...she still says no
Click to expand...
Click to collapse
Show her that video and tell her you want a divorce if she doesn't agree.
lol jk about the divorce part but seriously I just watched that video and im so glad im not on stock sense.

Flash MikShifted G v1.76 or Supreme Sense, then hand her back the phone. If she doesn't like them better than stock there is something wrong

i think people over think things too much about these little threats

+1 OP, I'm in exactly the same boat!
Unfortunately it seems at this point, no way to remove CIQ without root

guyandhisdog said:
+1 OP, I'm in exactly the same boat!
Unfortunately it seems at this point, no way to remove CIQ without root
Click to expand...
Click to collapse
I think he already mentioned that yes she does have root on stock if you read the OP. So yes titanium backup should be able to remove it no problem. Use the app carrier IQ detector to find out how much of it needs to be removed.

CIQ is built into the kernel too. He needs to swap kernels as well as remove the apps.
Sent from my PG06100 using XDA App

Ron Overdrive said:
CIQ is built into the kernel too. He needs to swap kernels as well as remove the apps.
Sent from my PG06100 using XDA App
Click to expand...
Click to collapse
I looked at the kernel. All there is in the kernel is bug fixes to allow CIQ to run properly. If you remove the system apps there is nothing for the bug fixes in the kernel to use.
Sent from my PG06100 using xda premium

has anyone used the advanced version of treve's app on a shift successfully?
or removed the the ciq stuff manually with success? if so is there anything that needs to stay on the device so it doesn't brick.
i'm using a stock rooted rom and kind of want to stick with it.

SmithMicro replaces CIQ?

SmithMicro replaces CIQ?
Sent from my PC36100 using XDA App

Why is the sky blue?
(See, we both provided no content worthy of discussion and just asked a seemingly random question...)

KaptainRandom said:
SmithMicro replaces CIQ?
Sent from my PC36100 using XDA App
Click to expand...
Click to collapse
In simple words, no.
I'll link you to a thread with discussion about the SmithMicro Application, enjoy!
http://forum.xda-developers.com/showthread.php?t=1444332

Smith micro is used to control gapps and their updates not spy on u
Edit: I believe it controls other firmware as well unlike ciq if removed at all it causes firmware errors

-EViL-KoNCEPTz- said:
Smith micro is used to control gapps and their updates not spy on u
Edit: I believe it controls other firmware as well unlike ciq if removed at all it causes firmware errors
Click to expand...
Click to collapse
I pulled that apk apart right after the ota to determine what it was and if it was safe to remove for my own senseless rom. I believe you are correct in the features of what it is there for. I did notice some xmls, and smali that referred to logging, and writing "user logs" to sd. At first Ithought it was a ciq replacement, so I pulled it when I cooked that first rom. I did not experience any ill effects. Although tbh I only ran the rom for about a day, missed Tommy's extended quick settings. There was also a welcomed lack of any ciq, in lib or bin, very good sign.
Anyways, I'm still in the debug process with my rom, but I will report back after I have more uptime w/o Smith.
Sent from my PC36100 using xda premium

I know removing it affects certain apps and doesn't affect others you may or may not bump into an issue depending on what you're running I found out about it when I was stripping a rom and saw the service running and it piqued my curiosity this was on synergy when I discovered ciq and began the battle with removing it and HTCloggers that was a fun experience I soft bricked my phone about 100x trying to get rid of that crap, this was before treve had released any info on it so I was going at it blindly
Edit: I forgot to add the service SmithMicroDM is a download manager for firmware updates I believe it controls OTAs prls and profile updates as well as a few other apps
We are legion, for we are many.

-EViL-KoNCEPTz- said:
I know removing it affects certain apps and doesn't affect others you may or may not bump into an issue depending on what you're running I found out about it when I was stripping a rom and saw the service running and it piqued my curiosity this was on synergy when I discovered ciq and began the battle with removing it and HTCloggers that was a fun experience I soft bricked my phone about 100x trying to get rid of that crap, this was before treve had released any info on it so I was going at it blindly
Edit: I forgot to add the service SmithMicroDM is a download manager for firmware updates I believe it controls OTAs prls and profile updates as well as a few other apps
We are legion, for we are many.
Click to expand...
Click to collapse
If it controls OTAs I'm definitely leaving it out. Lol
It could be that I removed any apps it was joined to. I was down to 115MB zipped last time I cooked. I will say this, 4.67 makes for one hellaciously fast stripped down rom. Couple edits to init.rc in the boot.img, and it feels like an aosp rom.
Sent from my PC36100 using xda premium

You will know when it causes an error it will say something like process com.smithmirco.xxx force closed the xxx being replaced with a specific process such as DM or service and then the app will crash I had issues with things locking up and requiring a battery pull HTCLoggers.apk was the worst as soon as I tried to freeze or delete it in tibu the damn thing would FC every 1/10th of a second making it impossible to restore with out flashing a backup or reflashing the rom over itself to replace the logger I finally found it embedded in several system files like frameworks-res.apk and systemui.apk which required removal from the code itself I never could get it removed without some sort of error before TrevE released his removal info, I was about ready to pull my hair out after about 60 hrs of deleting code and having to restore backup after backup when I couldn't boot or it would boot and immediately go ape**** force closing or locking up I ended up giving up and switching to a rom without ciq the first few I tried had serious wakelock issues from improper removal then the classic came out and it was ciq and wakelock free. I was able to tell how invasive ciq and htcloggers was when I found it I dumped a few logs and found IQ hits popping up attached to almost everything data or input related it was in SMS, keyboard, call history, dialer etc pretty scary especially since I had no idea what exactly it was logging or what it was doing with those logs, TrevE was lightyears ahead of me in tracking down that info, however I would personally classify ciq and loggers as malware/spyware glad sprint listened and got rid of it unlike big red who just flat out lied and said they didn't use it, which they didn't they used the same idea different name and figured no one would notice *rolls eyes*
We are legion, for we are many.