Two articles have appeared based on this researcher's work. Geek.com has Security researcher responds to CarrierIQ with video proof and Wired has Researcher’s Video Shows Secret Software on Millions of Phones Logging Everything.
Now, I'll admit that I find it worrying that my smartphone might be logging information about what I'm doing and sending it to some third party, and both articles make a very scary claim:
Wired: From there, the data — including the content of text messages — is sent to Carrier IQ’s servers, in secret.That would be worrying if true, but if you watch the 'security researcher's' video you'll find that nowhere does he make the claim that content that the application sees is leaving the device. And from the video he doesn't appear to try. At no point does he enter a debugger and look inside the CarrierIQ application, and at no point does he run a network sniffer and look at what data is being transmitted to CarrierIQ.
Geek.com: This video has demonstrated a truly significant volume of information is being recorded. Passwords over HTTPS, the contents of your text messages, and plenty more are recorded and sent to the customers of CarrierIQ.
And I don't understand why. It would be a huge story if millions of smartphones worldwide were secretly sending the content of text messages to a US-based company. But that's not the story here because the 'security researcher' does not appear to have tried to find out.
And here's where I have a problem with 'security researchers'. The story here is a little too sensational and the researcher really needs to dig deep to get to the truth. We've seen this before with sensational claims that Samsung was installing keyloggers on all their laptops made by a 'security researcher'. It turned out to be rubbish.
I'd really like to see some real research into when the CarrierIQ application is doing with the information it is seeing, otherwise these claims about all my keystrokes being sent to some third-party company are just claims without any substance to back them up.
To quote Carl Sagan: "Extraordinary claims require extraordinary evidence". Let's see the evidence.