📗 Gettings PCAPs from Stingrays for $20 with Rayhunter
summary
A $20 Android Orbit hotspot running Qualcomm DIAG becomes Rayhunter, a Rust tool that dumps QMDL/pcap frames and applies heuristics (2G downgrade, null cipher offers, missing neighbor cells, identity/IMSI requests) to flag cell‑site simulators. It detects a commercial catcher in lab tests, parses RC/NAS messages, and generates downloadable captures. Field collection: 160 uploads, 23 highly suspicious, ~30 ambiguous, ~31 confirmed false positives; notable detections in Chicago, Toronto and Los Angeles. Device and PCAPs let analysts re‑scan with improved signatures.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:33What are Stingrays
- 8:134G Stingray vulnerabilities
- 13:55Introducing Ray Hunter
- 24:29Ray Hunter's heuristics
- 30:03Testing Ray Hunter in lab
- 33:13Field results and suspicious cases
- 38:30Future of Ray Hunter
- 42:44Conclusion and advice
related talks
08mHacking 4G and how to get arrested in 10 minutes
01h 06mLTE & IMSI Catcher Myths
40mUncovering Covert Channels in Your IoT Networks
32mThe Evil of Spy Camera
26mTracking the World's Dumbest Cyber Mercenaries
54mExposing device features on 4G & 5G networks
18mNFCGate: Opening the Door for NFC Security Research with a Smartphone-Based Toolkit
50mQARK: Android App Exploit and SCA Tool