EFForg / EFForg/rayhunter

LPP heuristic

Open
#1,072 6 comments 0 reactions 0 assignees View on GitHub
enhancement good first issue heuristic
Dominant language
Rust
Stars
5.8k
Forks
490
Avg merge
3d 10h
Merged PRs (30d)
23

Description

### Prerequisites

- [x] I have read [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md)

### What problem does this feature solve or what does it enhance?

User `jamyla` [posted on the community mattermost](https://opensource.eff.org/eff-open-source/pl/pbz6gsshyj8ej84x78oimgzgph) about an IMSI catcher that uses [LPP](https://fumics.in/posts/2026-02-01-phone-gps-carrier-tracking) to track UE location. Reporting LPP messages has been previously suggested in #534, but as far as I know nobody's tried it out. This seems like an interesting heuristic to add, even if only in an informational (as opposed to a warning) capacity.

### Proposed Solution

Implement an informational heuristic that tracks LTE LPP messages, both the request and the response.

### Alternatives Considered

_No response_

Contributor guide

Open the contributing guide

Research direction

Review issue #534 and the repository's existing heuristic entry points to understand how LTE messages are inspected and informational findings are reported. Trace how LPP requests and responses are represented, then verify that both directions produce the intended informational result without escalating it to a warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.