A client of my company is currently using a solution where they've invented a UDP protocol that communicated with no TLS over regular 3G in small embedded devices.
Their cellular provider, KORE, ensures us that 100% of that 3G data is untouchable by the open web and lives within their VPN, unless we would like that device to touch the open web. They have also assured us that the connections between their cellular providers and their datacenter are 100% secured with private fiber runs and IPSec tunnels. I will assume this is true and secure.
We're trying to rule out the possibility of attack on their devices through the wireless protocol. We're concerned about attackers being able to read data coming across the airwaves as well as modify packets to attempt and control a device. I understand that data over 3G uses the KASUMI cipher, which has been compromised, but practical applications of that are not known to be in the wild. Is this still true? If we can trust the connection between the tower and the datacenter, can we trust the connection between the tower and the device?
If this is still true, theoretically there might still be a way to compromise that radio connection. How complex would an exploit like that have to look? Would it be able to run on a femtocell using modified firmware, or might it require more complex hardware?