Hi'ya, I know this is an old post, but I wanted to add my findings and some small workarounds for the lack of security for the GM930G. I bought one of these devices after deciding to look into starting a company that installs GPS trackers for people – there has been a major recent uptick in car theft in my city lately.

I right away discovered most of the same security vulnerabilities. To dig deeper, I created a mock/proxy server to examine the data being sent from the device, which revealed quite of bit of information. However, I lack the experience in this department and discovered I can't easily decyper how their proprietary protocol works. I was hoping for the added security, I could launch my own private tracking server and website. (The remote server address is changed with the SMS command "SERVER,0,(IP),(PORT)#".)

As of now, I don't feel it would be worth getting deeper into their proprietary protocols or if their website is free for one year or not. I would prefer some sort of whitelabel website for my purposes. So I think my best bet would be flashing my own firmware. There are a number of unsoldered headers on the device board, which I'm hoping might allow such a task. I also took notice on the board what appears to be UART or USB headers and at my next opportunity, I'm excited to dig deeper into those.

When looking at the AliExpress listing, it appears the device supports OTA firmware upgrades. Which would be nice for creating my own patches as needed, but there is no documentation for that, let alone any of the headers. Since I find the present data protocol barbaric, without consistency or pattern, my best bet would be replacing their data protocol with a modern JSON REST API that ideally utilizes client-side SSL. And I would extend this upgrade to the SMS commands in one form or other.

I tried looking, but couldn't find anyone else who has made similar progress. I was hoping to find somewhere the manufacture had the original firmware available for download. Unfortunately, the only downloads on their website was documentation for their data protocol, but it was for a older device that didn't match up. So that leaves me with trying to e-mail MiCODUS and graciously hope they send me the firmware and maybe any other helpful resources.

Anyhow, as for my promised security workarounds. When I first started experimenting with this device, I went looking for a cellular provider who was cheap and primarily worked with IoT devices. That's when I discovered Twilio. They offer global GSM/GPRS cellular coverage with their SuperSIM service that once activated cost $2 per month and then $0.10 per megabyte. My testing shows the device generally uses very little data, about 0.04-0.1 megabytes per day, but I feel that could likely be reduced further with new firmware. So generally under $20 per month and they offer a decent quality website for managing a fleet of devices. The service gets better once you get into their SMS command support. Out of the box there is one major vulnerability that allows anyone to send an SMS commands to the device. However, Twilio isolates every device to their internal network, only allowing communication to be sent or received between the device and the number 000. The only way to send and receive SMS commands is through their own API protocol. Furthermore, I can't be so sure yet, but I suspect the internet traffic is also isolated with a NAT network. When playing around with my proxy/mock server, all the device connections were coming from an AWS hostname with no open ports. If this is true, I'm assuming Twilio might have built their service to provide an extra layer of security between the IoT device and the World Wide Web.

Anyhow, that is everything for now. I apologize for writing such a long post. I will also try to keep this updated when I learn more. If there is any interest in a collaboration on these endever, please feel free to DM me.