Rayhunter Recording PCAPs from Stingrays With a 20 Ho

The talk looks at cell site simulators, also called stingrays or IMSI catchers, and why they are hard to detect on modern networks. The speakers trace how their interest began with protesters in North Dakota in 2016, then explain that earlier detection tools either relied on limited Android APIs or only watched 2G, which newer networks no longer use. Their first prototype, built on software-defined radios, was costly and produced misleading alerts because it depended on incomplete tower databases.

The second part introduces Rayhunter, an open project that runs on an inexpensive mobile hotspot with a Qualcomm baseband. It reads the modem's diagnostic stream, saves raw captures, and converts the radio messages into pcap files that Wireshark can dissect. Heuristics then scan the RRC and NAS layers for signs of downgrade attacks, null ciphers, and an identity request that the phone answers before the tower drops it, which the team calls the wallet inspector attack. Field tests at the border and around the DNC mostly found nothing, but a reanalysis of DNC data showed one pattern matching that attack, which the team says is strong evidence rather than proof.

The takeaway for practitioners is that cellular protocol logs can reveal surveillance, but the heuristics remain immature, NAS parsing is still missing, and false positives and negatives persist. The team asks for help with testing, interface design, and new detection rules, with the aim of putting the tool in the hands of journalists and activists.