Open Source Cellular Test Beds for the EFF Rayhunter
Details building open-source 2G, 4G, and 5G cellular base station testbeds with SDRs to evaluate and benchmark EFF's Rayhunter IMSI catcher detector.
Summary
Benchmarking Cell-Site Simulator Detectors
The Electronic Frontier Foundation’s open-source Rayhunter project turns commercial mobile hotspots into monitors that detect malicious cellular base stations and Stingray interception.
Building Open-Source Cellular Testbeds
Ron Broberg details how researchers deploy open-source software cellular stacks—including OpenAirInterface (OAI) 5G, srsRAN 4G, OpenBTS, and YateBTS—on software-defined radio hardware.
Simulating Rogue Base Station Attacks
Emulating malicious cell-site behaviors (such as forced 2G cipher downgrades, IMSI harvesting, and silent SMS pinging) enables rigorous validation of Rayhunter's detection algorithms.
Advancing Cellular Privacy and Defense
Open testbeds provide an accessible foundation for security researchers to develop and verify new counter-surveillance capabilities against illicit cellular monitoring.
Related talks
Main Stage·40 min
Cooper Quintin · Yomna Nasser
Shows how modifying an inexpensive consumer 4G LTE mobile hotspot allows researchers to capture raw network packets and detect IMSI catcher surveillance.
Main Stage·46 min
Cooper Quintin
EFF researcher Cooper Quintin introduces Crocodile Hunter, an open-source tool using low-cost SDRs to detect 4G LTE IMSI catchers (Hailstorm) in real time.
Main Stage·30 min
Cooper Quintin
Cooper Quintin answers questions on Crocodile Hunter, 4G IMSI catcher detection mechanics, and cellular surveillance tracking.