I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at Three UK).
I wrote a simple UDP server in C++. The tracking device opens a socket connection to the UDP server and then sends GPS data through the socket every 5 seconds. This seems to work very well. The overhead is very small and in general seems reliable.
The tracking device has a 16 character string hardcoded into the microprocessor code. In order to reduce overhead, we pass values to the server as a comma separated string and in this string we include the hardcoded device ID. Each time the UDP server receives a request, it checks the ID against a database of valid IDs. If successful, the request is accepted and the GPS data is saved against that device. I have written brute force protection functions to ensure outsiders can't try and send spoof GPS data for a device.
I'm no expert on network security, but I know of terms like "packet sniffing". The data is being sent over an unencrypted connection in plain text, so I need to ensure there is no way that this data can be read. The tracking devices will be installed under the dashboard in vehicles so there's no way to find out a device code physically without reading serial data (i.e. plugging it in).
My worry, and where I'm clueless, is whether it's possible for a hacker to somehow detect incoming traffic to my UDP server and see the device ID and then use it to send spoof data? Am I worrying about something that is non-existent or do I need to ensure that the connection is encrypted (I assume TLS over TCP connection) at the cost of extra overhead?