The Electronic Frontier Foundation (EFF) has launched an open-source tool named Rayhunter, designed to help users detect Stingray attacks. These attacks involve the use of cell-site simulators, also known as IMSI catchers, which mimic legitimate cell towers to intercept sensitive data and communications.
Understanding Stingray Attacks
Stingray devices trick mobile phones into connecting by pretending to be legitimate cell towers. Once connected, these devices can capture sensitive information, accurately track user locations, and potentially intercept calls and messages.
How Rayhunter Works
Rayhunter detects these threats by capturing and analyzing control traffic between a mobile hotspot and the cell tower. It does not monitor user activity, maintaining privacy. The EFF states:
“Rayhunter works by intercepting, storing, and analyzing the control traffic (but not user traffic, such as web requests) between the mobile hotspot Rayhunter runs on and the cell tower to which it’s connected.”
Key Features of Rayhunter
- Real-Time Analysis: Rayhunter analyzes traffic in real-time, looking for suspicious events that could indicate a Stingray attack.
- User Alerts: When suspicious traffic is detected, the Orbic hotspot’s screen changes from green/blue to red, alerting users.
- Data Logging: Users can download PCAP logs from the device for further analysis or forensic investigations.
Hardware and Accessibility
Rayhunter is designed to run on the affordable Orbic RC400L mobile hotspot, available for around $20. This choice is due to the device’s portability and widespread availability. The software may also work on other Linux/Qualcomm devices.
Rayhunter running on an Orbic RC400L
Source: EFF
Important Disclaimer
While the EFF notes that the use of Rayhunter is likely legal in the United States, users are encouraged to consult legal advice regarding its use in other jurisdictions. EFF has included a legal disclaimer to clarify this point.
For more instructions on how to install and use Rayhunter, check out EFF’s GitHub repository.
Helpful Reads:
