I have few question on security of Google Cloud Messaging Service (GCM)

  1. Is it possible to spoof messages that GCM server sends to android clients?
  2. Does server pushes data in encrypted format?
  3. Data that is pushed to android client by GCM server has any link with google account merged with android device?
  4. What actually the raw data pushed by GCM server consists of like ( registration id, push data .. etc) and more??
  • A quick note: It may not be a good idea to refer to Google Cloud Messaging as the abbreviation "GCM" on here, since GCM usually refers to Galois/Counter Mode, which is a mode of operation for block ciphers. – Polynomial Feb 18 '13 at 11:46
  • Google don't seem to publish this information in their documentation, and Google Cloud Messaging is not part of the Android Open Source Project so we can't tell by looking at the source. I think it would take some experimentation (i.e. packet captures) to determine this. – Michael Feb 18 '13 at 20:34

Partial answer to 1 and 2:

There are two servers involved in Google Cloud Messaging, the third party / app developer's server and Google's server. Data sent from the 3rd party server to the Google server is sent over HTTPS with the 3rd party's unique API key in the POST header, so done correctly this should provide authentication of the 3rd party server, integrity and replay protection, i.e. it should not be spoofable. This relies on both the third party and Google securely implementing their services.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.