[aprssig] Secutiry for the aprs protocol and software

[Curt, WE7U]

On Tue, 25 Aug 2009, William Gery wrote:

> I understand that any system on the Internet can be compromised. That
> brings this question to mind.
>
> If an Internet APRS server is compromised, could the APRS data stream be
> used to compromised other systems receiving APRS data from the affected
> system.

I believe the answer is no, but it depends on your definition of
"compromised".

If by compromised you mean that somebody has gained control of the
system, then I believe this would be nearly impossible with an APRS
data stream.

If you mean can the remote server inject data that would mess up
your local display of APRS data, then of course the answer is yes.
However, the APRS protocol already allows anyone to move anyone
else's station and/or objects/items anyway.  There's no additional
capability to be gained by taking over a remote server to do so.

One thing that could be accomplished would be disruption of a small
portion of the APRS internet stream.  People would connect to other
servers to route around the problem once they realized there was a
problem.

-- 
Curt, WE7U.                         <http://www.eskimo.com/~archer>
    APRS:  Where it's at!                    <http://www.xastir.org>
   Lotto:  A tax on people who are bad at math. - unknown
Windows:  Microsoft's tax on computer illiterates. - WE7U.
The world DOES revolve around me:  I picked the coordinate system!"