You don't need access to the full code of the OS, just enough to write kernel drivers. Once your code is running at ring0, you can rootkit away. I wonder how similar iPhone kernel development is compared to Mac OSX?
I think Apple actually customizes the firmware packages for each carrier since they maintain separate versions for ATT/Verizon for each iPhone model...
I don't even have an iPhone nowadays, I'm just curious. :)
That doesn't seem to be the case when I've looked into the firmware updates. The reason they have different iPhones for ATT and Verizon is they are using completely different radio systems. The firmware updates aren't carrier specific or else the online jailbreaking guides (many include ipsw checksum) wouldn't work in different countries.
Since what CarrierIQ is doing is considered illegal in many countries I'm fairly sure Apple wouldn't want to open themselves up to that type of liability.
I think Apple actually customizes the firmware packages for each carrier since they maintain separate versions for ATT/Verizon for each iPhone model...
I don't even have an iPhone nowadays, I'm just curious. :)