Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I have few question on security of Google Cloud Messaging Service (GCM)

  1. Is it possible to spoof messages that GCM server sends to android clients?
  2. Does server pushes data in encrypted format?
  3. Data that is pushed to android client by GCM server has any link with google account merged with android device?
  4. What actually the raw data pushed by GCM server consists of like ( registration id, push data .. etc) and more??
share|improve this question
A quick note: It may not be a good idea to refer to Google Cloud Messaging as the abbreviation "GCM" on here, since GCM usually refers to Galois/Counter Mode, which is a mode of operation for block ciphers. – Polynomial Feb 18 at 11:46
Google don't seem to publish this information in their documentation, and Google Cloud Messaging is not part of the Android Open Source Project so we can't tell by looking at the source. I think it would take some experimentation (i.e. packet captures) to determine this. – Michael Feb 18 at 20:34

1 Answer

up vote 1 down vote

Partial answer to 1 and 2:

There are two servers involved in Google Cloud Messaging, the third party / app developer's server and Google's server. Data sent from the 3rd party server to the Google server is sent over HTTPS with the 3rd party's unique API key in the POST header, so done correctly this should provide authentication of the 3rd party server, integrity and replay protection, i.e. it should not be spoofable. This relies on both the third party and Google securely implementing their services.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.