EFF’s Ray Hunter Helps Detect Stingray Surveillance

Summary

EFF technologist Cooper explains Ray Hunter, an open-source tool that flags cellular-network behavior associated with IMSI catchers. The project reports no evidence of their use at protests so far and describes a Philippines detection coinciding with an SMS phishing msg

Key points

• Cooper describes IMSI catchers as fake cell towers that can lure phones, identify nearby devices, and track a target. If encryption is downgraded or disabled, they may enable interception; criminals may also use them for SMS phishing.
• EFF’s open-source Ray Hunter runs on supported mobile-hotspot hardware and monitors modem-to-tower connections for 2G downgrades, suspicious IMSI requests, and null-cipher use.
• Ray Hunter records network traffic and signatures in PCAP files. The project has received submissions from about 200 people, and Cooper says false positives helped refine its detection signatures.
• Cooper says submissions have shown no evidence of IMSI-catcher use at protests so far. The team thinks current use may include SWAT teams checking whether someone is home before raids.
• Cooper describes a confirmed Philippines detection coinciding with a fake “National Health Care” SMS phishing message.
• Cooper raises concerns about mobile forensic extraction tools such as Cellebrite and GrayKey, and cites an uncertain estimate of around 40,000 phone searches by Customs and Border Patrol in one quarter.
• For people attending protests, Cooper generally recommends turning off their phones. He says Ray Hunter uses a separate device because a phone-based app would require rooting the phone.

People

Tools

Countries

Industries