Security implications of shared credentials on private APN

Question

It is common for public APNs to use shared credentials - nearly all mobile networks in the UK use the same credentials across all phones (see here for an example).

In M2M applications such as intruder alarm signalling, remote plant monitoring and smart metering, it is common for private APNs to be used instead of the network wide APNs used by phones. I am not sure what the motivation is behind the use of a private APN over a public APN (this previous question doesn't provide much insight)

The use of private vs public APNs is frequently pitched in marketing material as being more secure. Most of these same systems have no additional security (e.g. using a VPN, HTTPS or otherwise) and rely of the security of the GSM/GPRS communication channel.

In addition to this, for the systems I have been reverse engineering, I have found that they all use the same APN credentials across all devices. For example, all the usernames are 'triplecomgprs' and all the passwords are 'Q87363546'.

What are the security implications of all devices using the same credentials for the APN?

Answer 1

The only significant difference that I can find is using the APN itself as a level of authentication, vs using additional information such as your device's hardware IDs.

In practice, it's easier to have a single image, with a single config file pre-setting the APN you want to use, then use your hardware ID (MAC, IMEI, etc.) for authentication and determining what you're allowed to access (and log it accordingly). This also makes support easier, since a single help entry (like the one you linked) will provide the answer for all users, without thought; requiring they know / look up their own information, find where to put it in, and manually enter it, is far more complex, and often results in more support requests.

So using private APNs would result in increased security (or rather, increase the potential maximum security), but using public significantly reduces support burden and improves ease-of-use by less-technical users.