Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
2

I have project involving a M2M device. The device is not capable of HTTPS but may be required to send and receive information that we would rather not be leaked out.

The device will communicate directly with a webserver, what are the possibilities of a hacker identifying the the origin of the data and intercepting any transmitted information. If it is relatively simple would a private APN be more secure.

share|improve this question
3  
Put the M2M device behind a VPN gateway. – Yohann Nov 17 '12 at 10:49
1  
It's no more/less secure and than the open net. That is no security at all. And running your own APN is not simple, as it has to be on the GSM carriers' home network. – ewanm89 Nov 17 '12 at 11:16
4  
Why can't the device manage SSL? – ewanm89 Nov 17 '12 at 11:40
1  
Even running a private APN won't give you much additional security, since the connection is still not encrypted. – Manuel Faux Nov 17 '12 at 11:59

1 Answer

up vote 1 down vote

GPRS does not provide strong protection of the data. There is some cryptography applied on the wireless link between the mobile device and base station, but this cryptography has significant problems (see research on GSM and more research). Also, once the data reaches the core network, the data is transmitted in the clear, unencrypted, for the rest of the way.

Consequently, I recommend that you set up a VPN and tunnel all your traffic over the VPN. IPSec is a good tool here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.