295
Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying (www.eff.org)
submitted 1 week ago by badwetter@kbin.melroy.org to c/privacy@lemmy.ml
25 comments fedilink hide all child comments

Rayhunter is a new open source tool we’ve created that runs off an affordable mobile hotspot that we hope empowers everyone, regardless of technical skill, to help search out cell-site simulators (CSS) around the world.

top 25 comments
sorted by: hot top controversial new old
[-] SnotFlickerman@lemmy.blahaj.zone 36 points 1 week ago* (last edited 1 week ago)

From the Github (emphasis mine):

Rayhunter has been built and tested for the Orbic RC400L mobile hotspot. It may work on other orbics and other linux/qualcom devices, but this is the only one we have tested on.

Still very cool, but very, very limited options for using it.

On the plus side, it at least seems like a relatively inexpensive option, only $19 on Amazon.

To be clear, I'm only linking to it on Amazon because it is sold out from the manufacturer itself. Due to being sold out, I assume, Orbic doesn't even list a price for it.

Another important note from the Github (emphasis not mine):

THIS CODE IS A PROOF OF CONCEPT AND SHOULD NOT BE RELIED UPON IN HIGH RISK SITUATIONS!

[-] ssroxnak@lemmy.world 15 points 1 week ago

I've seen them cheaper on ebay

[-] SnotFlickerman@lemmy.blahaj.zone 4 points 1 week ago

The real issue, whether on Amazon or ebay, is that only a handful on ebay are listed as "unlocked" to be used on cellular networks other than Verizon.

[-] MaddestMax@lemmy.world 7 points 1 week ago

Fwiw: I’ve been using a Verizon locked one without ever activating the sim. It works just fine as a Rayhunter. It just doesn’t work as a hotspot.

[-] SnotFlickerman@lemmy.blahaj.zone 4 points 1 week ago

Dope, thanks for the heads up

[-] TheTurner@lemm.ee 2 points 1 week ago

Good to know. I need to flash the one I purchased a few weeks ago. Just got busy and forgot.

[-] MaddestMax@lemmy.world 1 points 6 days ago

I feel ya. It’s crazy easy. I was surprised. Then, just wardrive. 😊

[-] Aphelion@lemm.ee 10 points 1 week ago

They're $11 on eBay.

[-] marauding_gibberish142@lemmy.dbzer0.com 17 points 1 week ago

Can this be made into an android app to hook into android's APIs for their modem? I think that would make it a lot more portable

[-] SnotFlickerman@lemmy.blahaj.zone 9 points 1 week ago

Maybe? The Orbic is fully Linux whereas Android is a locked down heavily modified version Linux with a lot of differences in the codebase.

Androids only work as a WiFi hotspot. I could be wrong but I am not aware of any with cellular hotspot capability. You would need it running as a cellular hotspot for it to detect the stingrays.

[-] marauding_gibberish142@lemmy.dbzer0.com 6 points 1 week ago

Ah, I missed that crucial part, apologies. I'm not very well versed with cellular standards: I would assume that Qualcomm is not very OpenSource friendly. Is there any other manufacturer they could use?

[-] Aux@feddit.uk 4 points 1 week ago

There are no heavy Linux modifications in Android.

[-] ReversalHatchery@beehaw.org 2 points 1 week ago

what do you mean by cellular hotspot? working as a CSS itself?

[-] pietervdvn@lemmy.ml 12 points 1 week ago

Will this work in Europe?

[-] SnotFlickerman@lemmy.blahaj.zone 7 points 1 week ago* (last edited 1 week ago)

https://www.justanswer.com/computer-networking/h3j0m-orbic-mifi-trying-active.html

This thread seems to imply that it could work in Europe for US Verizon customers, but I can't find much else about whether or not it directly supports European cellular radio bands.

[-] jagged_circle@feddit.nl 8 points 1 week ago

Are we saying CSS instead of IMSI catchers now? Why?

[-] miracleorange@beehaw.org 2 points 1 week ago

Looks like they aren't using "IMSI catcher" because it only covers one of the uses of those devices.

[-] jagged_circle@feddit.nl 1 points 1 week ago

Can you elaborate?

[-] miracleorange@beehaw.org 1 points 1 week ago

It says in the article.

Law enforcement use CSS to pinpoint the location of phones often with greater accuracy than other techniques such as cell site location information (CSLI) and without needing to involve the phone company at all. CSS can also log International Mobile Subscriber Identifiers (IMSI numbers) unique to each SIM card, or hardware serial numbers (IMEIs) of all of the mobile devices within a given area. Some CSS may have advanced features allowing law enforcement to intercept communications in some circumstances.

[-] jagged_circle@feddit.nl 1 points 1 week ago

All of that should be doable with IMSI catchers, no? Except it would certainly allow intercepting communications.

[-] Tiger@sh.itjust.works 8 points 1 week ago

That pretty awesome, will try to get it.

[-] rekabis@programming.dev 4 points 1 week ago

run an install script for either Mac or Linux (we do not support Windows as an installation platform at this time.)

I always find it deeply ironic that valuable tools that are meant to protect people are released in forms that exclude an overwhelming proportion of the people who could use it.

It was the same issue with Ladybird browser up until a month or so ago - they were projecting Windows support only some time in 2027 to 2029. Like, how the hell are you supposed to achieve a critical mass of eyeballs when the vast majority of people who would love to test the product just don’t have the platform to run it on? It’s ideological shortsightedness at its kindest characterization. And I wouldn’t be kind.

Plus, DotNet is almost trivially cross-platform these days and almost ridiculously easy to develop with… for something like an install script you really don’t have an excuse to not hit all three platforms anymore.

[-] sik0fewl@lemmy.ca 14 points 1 week ago

Make sure to lodge a complaint with Microsoft about how their OS is incompatible with almost everything else.

[-] HiddenLayer555@lemmy.ml 5 points 1 week ago* (last edited 1 week ago)

I agree with everything you said except for this:

Plus, DotNet is almost trivially cross-platform these days and almost ridiculously easy to develop with… for something like an install script you really don’t have an excuse to not hit all three platforms anymore.

But so is Java. Or Kotlin. Or Rust. Or Python. Hell, even JavaScript is acceptable for a simple GUI program that's meant to be run once to install the real program.

And those are open source and don't have Microsoft telemetry in the build tools AND IN THE RUNTIME!!! So you now have to taint your Linux or Mac system by installing the JVM we have at home.

this post was submitted on 26 Mar 2025
295 points (100.0% liked)

Privacy

36501 readers
414 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz