Gettings PCAPs from Stingrays for $20 with Rayhunter

Getting PCAPs from Stingrays for $20 with Rayhunter

Speakers: Cooper Quintin, Senior Staff Technologist, Electronic Frontier Foundation; Will Greenberg, Senior Staff Technologist, Electronic Frontier Foundation

Conference: BSides SF

YouTube: https://www.youtube.com/watch?v=fldrffGvSo8

Overview

In an era of increasing digital surveillance, the talk "Getting PCAPs from Stingrays for $20 with Rayhunter" by Cooper Quintin and Will Greenberg from the Electronic Frontier Foundation (EFF) presented a groundbreaking, low-cost solution for detecting cell site simulators, commonly known as Stingrays or IMSI catchers. These devices are covert tools used by law enforcement, intelligence agencies, and even criminals to intercept mobile phone communications by impersonating legitimate cell towers. The EFF's work in this domain is driven by significant civil liberties concerns, particularly regarding dragnet surveillance and potential Fourth Amendment violations.

The presentation detailed the evolution of the EFF's efforts, from early, unsuccessful attempts to detect these sophisticated devices to the development of Ray Hunter, an accessible, open-source tool built on a modified $20 mobile hotspot. Ray Hunter aims to empower journalists, activists, and everyday citizens to identify the presence of cell site simulators by analyzing 4G packet traces. The speakers not only delved into the technical intricacies of how modern 4G IMSI catchers operate by exploiting vulnerabilities in cellular protocols but also showcased Ray Hunter's successful detection capabilities in both laboratory and real-world scenarios, offering a crucial step forward in counter-surveillance.

This talk is particularly significant because it democratizes the ability to detect advanced surveillance technology. Historically, detecting IMSI catchers required expensive, specialized equipment and deep technical expertise, making it inaccessible to most. Ray Hunter's low-cost hardware and user-friendly design address this barrier, providing a tangible tool for accountability and transparency. By enabling widespread data collection on cell site simulator usage, the EFF hopes to gain a clearer picture of their deployment, the specific attack methods employed, and ultimately, to inform more accurate threat models for individuals concerned about their privacy and security in the digital world.

Background

▶ Watch: Introduction to talk and speakers (0:00)

The EFF's interest in cell site simulators, or Stingrays, was initially sparked by reports of their potential use during the Dakota Access Pipeline protests in Mandanda, North Dakota, around 2016. Protesters, using various mobile applications, observed suspicious network activity, raising concerns about law enforcement employing these devices for dragnet surveillance. Cooper Quintin’s initial on-the-ground investigation, however, proved challenging. Existing detection apps provided ambiguous information, old 2G-only Nokia phones couldn't find 2G service in the area for packet capture, and Software Defined Radios (SDRs) yielded complex waterfall diagrams that were difficult to interpret. This experience highlighted the significant gap in reliable, accessible detection methods for modern cell site simulators.

From this initial setback, the EFF established three core goals:

1. Determine the frequency of cell site simulator use: While direct data is scarce, public records, journalistic reporting, and documents obtained by organizations like the ACLU reveal widespread deployment. Foreign spies, US intelligence agencies, and even cyber mercenaries (like NSO Group, which reportedly used an IMSI catcher to deliver Pegasus malware by downgrading connections to inject redirects to plain text HTTP sites) are known users. US agencies like ICE and DHS used their devices nearly 5,000 times between 2012 and 2019. Local law enforcement, such as Fontana, California, recorded 300 uses between 2022 and 2023 for its three devices, often loaning them to neighboring agencies, while San Bernardino used theirs 231 times in 2017. The 2020 Carpenter v. US Supreme Court decision, requiring warrants for historical cell site location information, seemed to curb some IMSI catcher use, but inconsistencies (e.g., Fontana's continued high usage) suggest varying interpretations or compliance. Beyond law enforcement, cell site simulators are also used for criminal activities, as evidenced by a case in Paris where a woman was caught using one for SMS phishing scams, downgrading connections to 2G to send fake French health ministry texts.

1. Understand modern 4G cell site simulator attacks: Extensive research existed for older 2G Stingrays, which exploited the lack of mutual authentication—phones authenticated to the tower, but the tower didn't authenticate to the phone. However, 4G introduced mutual authentication, where both the network and the phone authenticate each other using shared key material. Despite this improvement, EFF's research, summarized in the paper "Got to Catch Them All," identified critical vulnerabilities. Many crucial setup messages in the Radio Resource Control (RRC) and Non-Access Stratum (NAS) layers are sent, received, and trusted before or without full authentication. This "weak spot" allows for various 4G attacks, including downgrade attacks to less secure protocols like 2G. The speakers noted that 5G, while newer, does not fully resolve these issues, with companies like Group 2000 already selling solutions (e.g., Lima 5G Cellpro) that allow law enforcement to disable 5G in an area, forcing devices onto vulnerable 4G, 3G, or 2G networks. Native 5G IMSI catchers are also emerging, pointing to future research needs.

1. Develop reliable detection for modern 4G cell site simulators: The EFF's first attempt was Crocodile Hunter, a Linux-based project requiring a $1,000 Ettus B200 SDR, a Linux laptop, C compilation skills, and multiple antennas. While theoretically sound for fox hunting suspicious towers, it was impractical for journalists and laypeople due to its high cost, complex setup, and difficult-to-interpret results (e.g., 50 "suspicious" towers during Dreamforce in San Francisco, clearly indicating a high false positive rate). This led back to the drawing board, seeking a more accessible and reliable solution.

Key Findings

▶ Watch: EFF's initial interest: Dakota Access Pipeline protest (2:10)

The core contribution of this talk is the introduction of Ray Hunter, a significant evolution from the EFF's earlier, more complex detection efforts. Ray Hunter addresses the critical need for an affordable, user-friendly, and reliable tool to detect modern 4G cell site simulators.

The project began when Matthew Garrett tipped off the EFF to the Orbit, a cheap mobile hotspot running Android and a Qualcomm baseband chip, which was easily rootable. This device became the hardware foundation for Ray Hunter, transforming an expensive and complex setup into a $20 solution. Key findings regarding Ray Hunter include:

• Accessibility and Usability: Ray Hunter is designed for ease of use. Installation involves downloading a release zip from GitHub and running a script, a stark contrast to Crocodile Hunter's demanding requirements. It exposes a simple web UI (accessible via Wi-Fi network and gateway address) that clearly indicates recording status, detected warnings, and historical recordings, making it interpretable even for non-telecom experts.
• Robust Software Architecture: Written in Rust for memory efficiency on the constrained Orbit device, Ray Hunter processes raw radio data frames into structured RRC and NAS messages, which are then analyzed by various heuristics for anomalies.
• Comprehensive Data Capture: Ray Hunter records full 4G packet traces in two crucial formats: QMDL (Qualcomm's native packet trace format) and pcap (standard packet capture format, with a GSM tap header for Wireshark analysis). This allows for both immediate in-device analysis and retrospective analysis with updated heuristics, even if the recording was made with an older Ray Hunter version.
• Clear Goals for Deployment: The EFF's immediate goals for Ray Hunter include widespread distribution to gather data on potential cell site simulator use during protests in the US and globally. This data aims to clarify the "fear, uncertainty, and doubt" surrounding these devices, provide insights into actual exploits, and help activists and journalists develop more accurate threat models.
• Validation through Lab and Field Testing: A critical finding was Ray Hunter's successful detection of a commercial IMSI catcher (used by law enforcement) in a controlled lab setting. This provided concrete evidence that the tool's heuristics could identify real-world surveillance devices.
• Real-World Detections and Insights: From approximately 160 field reports, 23 were deemed "highly suspicious"—meaning the EFF could not disprove them as IMSI catchers. Specific examples include:
• Downtown Chicago: Dozens of warnings about a tower repeatedly requesting identity and disconnecting, mirroring lab-tested commercial IMSI catcher behavior.
• Toronto, Canada: A tower exhibiting a full spectrum of suspicious activities: tracking area update, IMSI request, null cipher suggestion, and a 2G downgrade – triggering almost every heuristic.
• Los Angeles: A nighttime null cipher request followed by an IMEI request, deemed highly suspicious due to the rare and contextually inappropriate use of null ciphers outside of 911 calls.
• Absence of Detections at Protests: Notably, despite widespread distribution at "No Kings" protests and during ICE operations in Minneapolis, no recordings triggered any Ray Hunter heuristics. While this is positive, the EFF remains cautious, emphasizing the need for continued monitoring.

These findings collectively demonstrate Ray Hunter's potential to significantly advance the understanding and detection of sophisticated mobile surveillance, making it a powerful tool for civil liberties advocacy.

Technical Deep Dive

▶ Watch: Frequency of cell site simulator use by law enforcement (4:20)

Ray Hunter's technical prowess lies in its ability to extract and analyze raw radio signals from a readily available, inexpensive device. The chosen hardware, the Orbit mobile hotspot, is crucial because it runs Android and, more importantly, features a Qualcomm baseband chip. Qualcomm chips are known to expose a proprietary, yet reverse-engineered, diagnostic protocol creatively named Diag. This protocol is the linchpin of Ray Hunter, allowing it to obtain raw radio data frames directly from the chip.

The data flow within Ray Hunter is meticulously engineered:

1. Diag Logging: The process begins by interacting with /dev/diag, a file exposed by the Qualcomm baseband to the Linux kernel. Ray Hunter enables diagnostic logging by writing specific octals and an encoded request to /dev/diag, instructing the baseband to log particular message types, primarily RRC (Radio Resource Control) and NAS (Non-Access Stratum) messages.
2. Raw Frame Capture: Ray Hunter continuously reads from /dev/diag in a loop to capture these raw radio data frames.
3. QMDL and PCAP Output:

• The raw frames are immediately written to a QMDL file. QMDL (Qualcomm Mobile Diagnostic Logging) is Qualcomm's native format for packet traces. This raw data is invaluable because it preserves the verbatim output from the chip, allowing for future analysis with updated heuristics, even if the original recording was made with an older version of Ray Hunter.
• Concurrently, the unparsed binary buffers are also dumped into a pcap file. To make these cellular traces compatible with standard network analysis tools like Wireshark, Ray Hunter prefixes them with a GSM tap header. This enables the use of existing open-source tools, such as the Wireshark dissector developed by the Open-Source Mobile Consortium (OsmoCom), for detailed inspection of 3G, 4G, and even 5G traffic.

1. Parsing and Analysis: The captured data is then parsed into Rust data structures, which are subsequently fed into Ray Hunter's array of heuristics (analyzers). The parsing of these complex cellular protocols is a significant technical challenge:

• RRC Messages: These messages, defined by the 3GPP consortium, follow the ASN.1 (Abstract Syntax Notation One) specification – the same syntax used for X.509 certificates. Ray Hunter leverages a Rust parser generator that takes the official 3GPP ASN.1 spec and automatically generates over 50,000 lines of Rust code to parse RRC messages efficiently.
• NAS Messages: NAS messages are specified in a less friendly format called CSN (Concrete Syntax Notation). For these, the EFF developed Pyrate-RS, a Rust module that acts as a wrapper for the existing open-source Python library Pyrate. Pyrate is a standard for open-source telecom parsing; Pyrate-RS loads the Python parsing class, traverses its metadata, and outputs Rust code for NAS message parsing.

Ray Hunter's heuristics, implemented as a Rust Analyzer trait, are designed to identify suspicious network behaviors with a strong emphasis on minimizing false positives. The four primary categories of heuristics are:

1. 2G Downgrade: This heuristic monitors RRC packets for two key indicators:

• A direct redirect to a 2G network.
• A 4G tower advertising 2G towers with a higher priority than 4G towers. This should virtually never occur in legitimate networks, especially in regions like the US where 2G networks have been decommissioned. Such a scenario is a strong indicator of an IMSI catcher attempting to force a device onto a less secure protocol for interception or injection.

1. Null Cipher Use: The cellular network can suggest various ciphers for encrypting communication between the phone and the tower (though not end-to-end). One option is a null cipher, which effectively means no encryption (XORing with all zeros). While legitimate for 911 calls from phones without valid SIMs or key material, its use in any other context is highly suspicious, as it facilitates content interception or injection.
2. Missing Neighbor Cells: This heuristic looks for instances where a cell tower fails to specify its neighboring cells in broadcast messages. The observation is that IMSI catcher developers are often "lazy" and omit this detail, which is typically present in legitimate cell tower configurations. While a weak indicator on its own (some legitimate towers might genuinely be isolated), it becomes more significant when combined with other suspicious findings.
3. Identity Request for IMSI/IMEI: This heuristic flags instances where the network requests the phone's IMSI (International Mobile Subscriber Identity), which uniquely identifies the SIM card, or IMEI (International Mobile Equipment Identity), which uniquely identifies the device itself, without a subsequent authentication follow-up, especially if followed by an unceremonious detachment from the network. While this can legitimately occur during roaming, its presence on a home network without proper authentication is a "smoking gun" for IMSI catchers, which primarily function by harvesting these identifiers. The EFF has refined this heuristic to reduce false positives by focusing on unauthenticated detachments on the home network, as opposed to simply flagging any IMSI transmission (a common, less useful approach in other detection apps).

The meticulous design and implementation of these technical components, from raw data acquisition to sophisticated protocol parsing and anomaly detection heuristics, underscore Ray Hunter's capability as a powerful, yet accessible, counter-surveillance tool.

Demo / Proof of Concept

▶ Watch: Impact of Carpenter v. US Supreme Court decision (6:05)

The efficacy of Ray Hunter was rigorously demonstrated through both laboratory testing and real-world field deployments, providing compelling proof of concept for its detection capabilities.

Laboratory Testing with a Commercial IMSI Catcher:

A crucial validation came from a collaboration with Cape, a mobile phone security company, which provided access to a commercial IMSI catcher (the type used by law enforcement) via a university partner. The Ray Hunter device was deployed in proximity to this commercial unit, and its logs confirmed successful detection.

The observed behavior of the commercial IMSI catcher was as follows:

1. Location Area Impersonation: The IMSI catcher pretended to be from a different geographical area, causing the target phone to register a new Location Area Code (LAC).
2. Tracking Area Update Request: The phone, believing it was in a new area, initiated a Tracking Area Update (TAU) request.
3. Identity Request: The fake tower responded by sending an Identity Request, asking for the phone's IMSI.
4. IMSI Submission: The phone, perceiving the request as legitimate within the TAU process, transmitted its IMSI.
5. Unceremonious Detachment: Immediately after receiving the IMSI, the IMSI catcher kicked the phone off the network with a message indicating "update area illegal user equipment," sending it back to its original legitimate tower.

Ray Hunter detected this sequence, generating four alerts: three for the tower not having any neighbor cells (indicating a poorly configured or lazy IMSI catcher) and one for the device being disconnected after an identity request without any follow-up authentication. This lab test unequivocally proved Ray Hunter's ability to identify the tell-tale signs of a commercial IMSI catcher.

Field Results and Real-World Detections:

The EFF has collected approximately 160 field reports from Ray Hunter users across the US and other countries. Among these, 23 reports were classified as "highly suspicious," meaning the EFF could not disprove them as genuine IMSI catcher activity. Several notable examples illustrate Ray Hunter's real-world impact:

• Downtown Chicago (May of last year): A user running errands received dozens of warnings over about an hour, indicating a tower repeatedly requesting their identity and then disconnecting. This behavior precisely matched the commercial IMSI catcher's actions observed in the lab, leading the EFF to conclude with high confidence that it was a real IMSI catcher, especially given that Chicago PD is known to own such devices and has been suspected of "liberal" use.
• Toronto, Canada: This recording presented an even more comprehensive set of suspicious activities. Ray Hunter detected a tower performing a tracking area update, requesting the device's IMSI, then suggesting the use of a null cipher for plain-text communication, and finally proposing a 2G downgrade. This sequence triggered almost every heuristic in Ray Hunter, making it a very strong indicator of an IMSI catcher, likely operated by Canadian authorities (the "Mounties" are known to possess them).
• Los Angeles (around ICE operations): A user at home at night received a null cipher request followed by an IMEI request (for the equipment ID). This was particularly concerning as null ciphers should only be used for 911 calls, and never for IMEI requests. This detection, the first instance of a null cipher being used in the US by Ray Hunter, was deemed highly suspicious, especially given the presence of ICE and other law enforcement agencies known to operate IMSI catchers in the area.

Lack of Detection at Protests:

Interestingly, despite widespread distribution of Ray Hunter devices during "No Kings" protests and ICE operations in Minneapolis, no recordings from these events triggered any suspicious alerts. While this is a positive finding, suggesting that IMSI catchers might not have been used for dragnet surveillance at these specific protests, the EFF remains cautious, emphasizing the need for continued monitoring. This highlights that Ray Hunter is not just about finding threats but also about clarifying the actual threat landscape, reducing "fear, uncertainty, and doubt." The ability to collect and re-analyze QMDL files means that even "negative" results contribute to a growing dataset that can be re-evaluated as heuristics improve.

Defensive Implications

▶ Watch: Example of criminal use of cell site simulators (7:00)

The development and deployment of Ray Hunter carry significant defensive implications for individuals, civil liberties advocates, and the broader security community.

For Individuals and Activists:

• Empowered Detection: Ray Hunter provides an unprecedented opportunity for individuals to detect sophisticated surveillance tools without requiring extensive technical expertise or prohibitive costs. For just $20 (the cost of the Orbit hotspot), anyone can acquire a device capable of logging and analyzing cellular traffic for IMSI catcher activity.
• Informed Threat Models: By using Ray Hunter, activists, journalists, and everyday citizens can gain a more accurate understanding of their local surveillance landscape. Knowing if and how often IMSI catchers are being used in their vicinity allows them to develop more realistic threat models and adjust their operational security practices accordingly.
• Direct Action: Cooper Quintin's son's advice, "Dad, why don't you just tell those hackers to turn off their phones?", while simplistic, underscores a fundamental defensive measure: a phone that is off cannot be tracked by an IMSI catcher. For critical situations, this remains the most secure option.
• Data Contribution: Users are encouraged to share their Ray Hunter recordings (especially the QMDL files) with the EFF. This crowdsourced data is vital for improving heuristics, identifying new attack methods, and building a comprehensive picture of IMSI catcher deployment globally. Even negative results are valuable for baseline analysis.

For Civil Liberties and Law Enforcement Accountability:

• Transparency and Accountability: The widespread use of Ray Hunter can shed light on the clandestine deployment of IMSI catchers by law enforcement. By providing concrete evidence of their use, it aids in challenging their legality, particularly in contexts where warrants may be lacking or overly broad, as per the Carpenter v. US decision.
• Legal Scrutiny: The data collected by Ray Hunter can inform legal challenges and policy debates, pushing for stricter regulations and transparency regarding the acquisition and use of surveillance technology. The EFF is particularly concerned about "very broad warrants" that might enable dragnet surveillance, even if a warrant is obtained.
• Deterrence: The mere existence and public awareness of tools like Ray Hunter could act as a deterrent, making it riskier for agencies to deploy IMSI catchers without proper justification or in violation of civil liberties.

For the Security Community and Future Development:

• Open-Source Collaboration: Ray Hunter is an open-source project, inviting security researchers, developers, and telecom experts to contribute. This collaborative model is crucial for:
• Improving Heuristics: Refining existing detection signatures and developing new ones for emerging attack vectors, including 5G IMSI catchers.
• Porting to New Devices: Adapting Ray Hunter to work on other affordable, rootable Qualcomm-based devices, particularly for international support where the Orbit may not be available.
• User Experience Enhancements: Developing a more user-friendly GUI installer, improving the web UI, creating device-specific screen UIs, and building companion mobile apps to simplify usage, integrate GPS coordinates for fox hunting, and enable automatic data uploads.
• Threat Intelligence: The collected packet traces provide invaluable raw data for understanding the actual exploits and techniques used by commercial and state-sponsored IMSI catchers, contributing to a broader understanding of mobile network security vulnerabilities.
• Educational Tool: Ray Hunter serves as an excellent educational tool, demystifying complex cellular network protocols and the mechanics of mobile surveillance for a wider audience.

In essence, Ray Hunter equips the public with a powerful, accessible means to monitor their cellular environment, fostering transparency, accountability, and ultimately, better protection of civil liberties against pervasive mobile surveillance.

Key Takeaways

• Accessible Surveillance Detection: Ray Hunter transforms expensive and complex cell site simulator detection into an affordable, user-friendly tool, leveraging a $20 rootable mobile hotspot to empower individuals, activists, and journalists.
• Exploiting 4G Vulnerabilities: Modern IMSI catchers exploit unauthenticated setup messages in 4G's RRC and NAS layers, enabling attacks like 2G downgrades, null cipher suggestions, and unauthenticated identity requests for IMSI/IMEI harvesting.
• Validated Efficacy: Ray Hunter has successfully detected commercial IMSI catchers in lab settings and identified highly suspicious activity in real-world field reports, mimicking known law enforcement surveillance patterns.
• Data-Driven Threat Intelligence: The project collects raw QMDL and pcap data, enabling continuous improvement of detection heuristics and a clearer, evidence-based understanding of IMSI catcher deployment and attack techniques globally.
• Empowering Civil Liberties: By democratizing detection, Ray Hunter aims to increase transparency, hold law enforcement accountable for surveillance practices, and help individuals develop more accurate personal threat models against mobile surveillance.
• Community-Driven Development: The EFF encourages open-source contributions for UI/UX improvements, new device ports, 5G support, and enhanced data collection features, recognizing that collective effort is key to evolving counter-surveillance capabilities.

About the Speaker(s)

Cooper Quintin is a Senior Staff Technologist at the Electronic Frontier Foundation (EFF), a non-profit organization dedicated to defending civil liberties in the digital world. With 12 years of experience at the EFF, Cooper has contributed to a diverse range of projects, including the privacy-enhancing browser extension Privacy Badger, research into state-sponsored malware campaigns, street-level surveillance, and mobile security – the focus of this talk. He also works with the EFF's Threat Lab project. His work often involves investigating technologies with significant civil liberties implications, such as Stingrays.

Will Greenberg is also a Senior Staff Technologist at the Electronic Frontier Foundation. His primary work at the EFF includes contributions to Certbot, a free, open-source tool for automatically enabling HTTPS on websites, as well as roles within the Threat Lab and SLS (Street Level Surveillance) teams. Will specializes in reverse engineering projects and has been a key developer for Ray Hunter, focusing on its technical implementation and robustness.