Carrier IQ Found in iOS 5, Likely Harmless – Apple Responds

Recent discussions have surged online regarding the presence of Carrier IQ on Android smartphones, which is reportedly recording user inputs such as keystrokes. TUAW has verified that Carrier IQ is also present on iOS 5, although it seems to serve a harmless purpose.

Discovered by iOS expert chpwn, Carrier IQ has been part of Apple’s firmware since iOS 3.x. This was confirmed by TUAW through an examination of iOS 5, particularly the /usr/bin/awd_ic3 file, following insights from a MacRumors forum post.

The firmware includes references to Carrier IQ, such as the URL found in the binary.

Here is a list of matching strings found in the analysis:

http://collector.sky.carrieriq.com:7001/collector/c?cm_sl=5

Our review of the binary calls revealed data collection related to network diagnostics like local cell tower locations, signal strength, and your phone number, but no evidence of keystroke logging. It also includes remote diagnostic triggers such as CTServerConnectionEnableRemoteDiagnostics.

Interestingly, the service might require manual activation. A property list in the “mobile” user library suggests that diagnostic logging needs to be explicitly enabled:

iPhone # plutil com.apple.iqagent.plist
{
DiagnosticsAllowed = 0;
}

Moreover, the binary appears to be outdated.

The primary reference to the /var/wireless/Library/Logs/IQAgent/ folder has been replaced by /var/wireless/Library/Logs/awd in actual usage.

At this stage, Apple’s implementation of Carrier IQ does not seem to pose a threat to privacy or function as a rootkit. This initial assessment aligns with the explanation provided by Jason Gertzen of Sprint, who described it as a tool for “helping maintain network performance” when questioned about Carrier IQ on Android. The cautious implementation on iOS supports this claim.

To keep updated on this topic, follow chpwn’s blog for ongoing investigations.

Update: The Verge reports that Google Nexus devices and the original Xoom tablet do not include Carrier IQ, suggesting that its presence on other devices might be due to decisions by OEMs and carriers.

Regarding Apple devices, John Gruber notes that users can opt-out of Carrier IQ by navigating to Settings > General > About > Diagnostics & Usage and disabling the “Send Automatically” option.

Update 2: Apple has stated that they discontinued support for Carrier IQ with iOS 5 and plan to remove it entirely in a future update.

Cory

Thomas is a dedicated writer for TUAW, bringing insightful news and updates about Apple products to readers. With a deep understanding of the Apple ecosystem, Thomas covers everything from the latest iPhone and iPad releases to MacBook innovations and Apple Watch features. His clear and engaging writing style helps readers stay informed about the tech world. Thomas’s expertise and enthusiasm for Apple products make him a valuable contributor to the TUAW team.