EFForg / EFForg/rayhunter

Wifi based heuristics

Open
#1,000 3 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
5.8k
Forks
490
Avg merge
3d 10h
Merged PRs (30d)
23

Description

### Prerequisites

- [x] I have read [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md)

### What problem does this feature solve or what does it enhance?

Now that we have a wifi client mode, we could start to scan in wifi mode and add at least one wifi based heuristic, looking for the OUI of known IMSI catcher manufacturers such as KeyW, Jacobs, Octastic, and Harris corp. This is based on the theory that many of these have separate interfaces which may operate over wifi and have a wifi component which would be detected. This wouldn't be a useful heuristic on its own but could be excellent corroborating evidence when other heuristics are triggered.

### Proposed Solution

We can the wifi access points continuously and look for OUIs which mach a list of of known bad actors (above) then we generate an alert in the same rayhunter user interface, this might be able to be done in the rayhunter code or it's possible it should be a separate daemon, I'm open to suggestions on this.

### Alternatives Considered

OUI Spy is a tool that can already do this, reccomend that people use the OUI spy in conjunction with rayhunter for this functionality.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.