3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is Android Market/Google Checkout transaction. How do I know if it protect my data?
2
-
4Hi @Fitri, can you explain your question a bit better? A little context, some details, etc would help a lot.– AviD ♦Aug 7, 2011 at 20:54
-
Are you asking about the Air interface traffic between a mobile phone and a Base Station? Or are you asking about the security from mobile phone to the transaction processing server?– this.joshAug 8, 2011 at 5:01
Add a comment
|
2 Answers
The security of a the air interface on a 3G connection is significantly different to that on a 2G connection. The main advances in 3G over 2G is the higher data rate and the security features. But much of the security depends on the Mobile Operator issuing the customer with a USIM rather than a 2G SIM.
If you have a USIM in a 3G phone connected to a 3G network, then the phone will perform the Authentication and Key Agreement (AKA) protocol that verifies the network as well as the SIM.
When using a 2G network or using a 3G network with a 2G SIM then the authentication falls back to the old 2G process, this verifies the SIM but does not verify the network. This means that these connections are vulnerable to a False Basestation Attack, where an attacker can pretend to be the network to the phone and thus intercept all the data traffic.
When using a 2G network, then the data will most often be encrypted using the GEA1 or GEA2 algorithms, this is similar to the A5/1 and A5/2 algorithms that has been compromised. But at the moment tools to compromise GEA1 have not been made public, whereas tools to compromise A5/1 are available. There is the newer A5/3 and GEA3 algorithms using KASUMI for encryption instead, but note that these still uses KASUMI with 64-bit keys (3G variants uses 128-bit keys which are much stronger).
The GSM air interface was designed to offer equivalent security to a wired connection, and the connection will be carried over wired networks. The security of the data being carried should be treated with the same level of protection as for a wired connection. This means use of https (TLS) should be used for any sensitive data.
There are some extra considerations though.
- The limited screen space available on mobiles devices may be an issue in displaying security icons to the user.
- The portable nature of a mobile device increases the risk of loss of the device and this loss of data locally stored.
-
OK so Karston Nohl has just reveled that he is able to crack the 2G GPRS encryption GEA1 h-online.com/security/news/item/…– StuartAug 10, 2011 at 17:22
-
2I would be reluctant to place too much trust in the security of 3G networks against interception. As each generation of digital cellphone was introduced, the carriers have said it was designed to provide equivalent security to a wired collection, and we've repeatedly found flaws in each generation which contradict those claims. The carriers just don't have a history of getting this right. Now, I don't know; maybe with 3G they finally got it right for the first time. That'd be great. But history suggests some caution and skepticism would not be out of order.– D.W.Aug 10, 2011 at 22:53
-
For better informativeness, please highlight the fact that it's most probably safe anyway due to the SSL/HTTPS– FitriAug 14, 2011 at 16:44
If I am correct, normally you use an SSL connection when doing money transfers. SSL encrypts the data before you send it over the network. In this way, even if your connection is being eavesdropped upon, they will not be able to see anything.
It does a lot more than only encrypting, also authentication and message integrity is provided.
To learn more : http://en.wikipedia.org/wiki/Transport_Layer_Security
My point is that with this layer you shouldn't be worrying about your connection.
answered Aug 7, 2011 at 22:52
-
1
-
2I don't see why you got downvoted, because you're making the right point: application layer encryption protects transactions such as Android Market, and therefore the relative strength of the underlying protocol encryption is not necessary to the question. If for no other reason, the encryption on the (cell network / wireless network / carrier pigeons) isn't end-to-end for the transaction that goes out to the Internet. Relative security of 3G/whatever is still fascinating, but the original question was, does it protect my CC? The answer is no regardless of crypto strength. Aug 8, 2011 at 12:40