Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is Android Market/Google Checkout transaction. How do I know if it protect my data?

share|improve this question
4  
Hi @Fitri, can you explain your question a bit better? A little context, some details, etc would help a lot. –  AviD Aug 7 '11 at 20:54
    
Are you asking about the Air interface traffic between a mobile phone and a Base Station? Or are you asking about the security from mobile phone to the transaction processing server? –  this.josh Aug 8 '11 at 5:01
add comment

2 Answers

up vote 4 down vote accepted

The security of a the air interface on a 3G connection is significantly different to that on a 2G connection. The main advances in 3G over 2G is the higher data rate and the security features. But much of the security depends on the Mobile Operator issuing the customer with a USIM rather than a 2G SIM.

If you have a USIM in a 3G phone connected to a 3G network, then the phone will perform the Authentication and Key Agreement (AKA) protocol that verifies the network as well as the SIM.

When using a 2G network or using a 3G network with a 2G SIM then the authentication falls back to the old 2G process, this verifies the SIM but does not verify the network. This means that these connections are vulnerable to a False Basestation Attack, where an attacker can pretend to be the network to the phone and thus intercept all the data traffic.

When using a 2G network, then the data will most often be encrypted using the GEA1 or GEA2 algorithms, this is similar to the A5/1 and A5/2 algorithms that has been compromised. But at the moment tools to compromise GEA1 have not been made public, whereas tools to compromise A5/1 are available. There is the newer A5/3 and GEA3 algorithms using KASUMI for encryption instead, but note that these still uses KASUMI with 64-bit keys (3G variants uses 128-bit keys which are much stronger).

The GSM air interface was designed to offer equivalent security to a wired connection, and the connection will be carried over wired networks. The security of the data being carried should be treated with the same level of protection as for a wired connection. This means use of https (TLS) should be used for any sensitive data.

There are some extra considerations though.

  • The limited screen space available on mobiles devices may be an issue in displaying security icons to the user.
  • The portable nature of a mobile device increases the risk of loss of the device and this loss of data locally stored.
share|improve this answer
    
OK so Karston Nohl has just reveled that he is able to crack the 2G GPRS encryption GEA1 h-online.com/security/news/item/… –  Stuart Aug 10 '11 at 17:22
2  
I would be reluctant to place too much trust in the security of 3G networks against interception. As each generation of digital cellphone was introduced, the carriers have said it was designed to provide equivalent security to a wired collection, and we've repeatedly found flaws in each generation which contradict those claims. The carriers just don't have a history of getting this right. Now, I don't know; maybe with 3G they finally got it right for the first time. That'd be great. But history suggests some caution and skepticism would not be out of order. –  D.W. Aug 10 '11 at 22:53
    
For better informativeness, please highlight the fact that it's most probably safe anyway due to the SSL/HTTPS –  Fitri Aug 14 '11 at 16:44
add comment

If I am correct, normally you use an SSL connection when doing money transfers. SSL encrypts the data before you send it over the network. In this way, even if your connection is being eavesdropped upon, they will not be able to see anything.

It does a lot more than only encrypting, also authentication and message integrity is provided.

To learn more : http://en.wikipedia.org/wiki/Transport_Layer_Security

My point is that with this layer you shouldn't be worrying about your connection.

share|improve this answer
1  
If this got downvoted I atleast want to know why... –  Lucas Kauffman Aug 8 '11 at 8:56
2  
I don't see why you got downvoted, because you're making the right point: application layer encryption protects transactions such as Android Market, and therefore the relative strength of the underlying protocol encryption is not necessary to the question. If for no other reason, the encryption on the (cell network / wireless network / carrier pigeons) isn't end-to-end for the transaction that goes out to the Internet. Relative security of 3G/whatever is still fascinating, but the original question was, does it protect my CC? The answer is no regardless of crypto strength. –  gowenfawr Aug 8 '11 at 12:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.