EFForg / rayhunter

Rust tool to detect cell site simulators on an orbic mobile hotspot
GNU General Public License v3.0
19 stars 2 forks source link

IMSI provided + null cipher analyzer #50

Closed wgreenberg closed 1 month ago

wgreenberg commented 1 month ago

Added analyzers for whenever the UE provides an IMSI at all, or when a null cipher was set. Also, because I was having trouble finding which messages contained the IMSI datatype, I wrote a little python script that'll parse and search for datatypes in our ASN.1 files, and print any hits as a "path". For example:

» python asn1grep.py IMSI                                  
searching for IMSI
PCCH-Message [message [message.c1 [c1 [c1.paging [paging [pagingRecordList[0] [ [ue-Identity [ue-Identity.imsi [IMSI]]]]]]]]]]