EFForg / EFForg/rayhunter

Rayhunter does not consider RRCConnecitonRelease a disconnect message in 0.12.0

Closed
#1,149 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
5.8k
Forks
490
Avg merge
3d 10h
Merged PRs (30d)
23

Description

### Prerequisites

- [x] I have read [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md)

### Bug Report Details

Rayhunter no longer considers RRCconnectionRelease a disconnect message in 0.12.0, this causes false positives when an IMSI is requested followed by an RRCConnectionRelease. This is because I commented out the relevant lines https://github.com/EFForg/rayhunter/commit/552e9799e307a53f34af21e714d2a5f2cdd88cc6#diff-abdde50129192bbc1af481ebed65a004c992e30342195fc8f8ad3bad3188cfe3R14-R261 When I was working on #1014. I commented this out because it was causing a double alert in some cases and I didn't have the time to give it a proper fix but this was the wrong decision in retrospect. Since @bmw fixed up that pull request and merged it the double alert no longer happens but also now the RRCConnectionRelease messages don't alert. I'm making a pull request to uncomment this code. I've tested it and this fixes the issue and doesn't introduce any new false negatives or false positives.

Contributor guide

Open the contributing guide

Research direction

Inspect commit 552e9799e307a53f34af21e714d2a5f2cdd88cc6 and its referenced diff to locate the commented RRCConnectionRelease handling. Restore the intended behavior, then verify that an IMSI request followed by RRCConnectionRelease produces the correct disconnect alert without double alerts or new false positives.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
networking, security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.