Rayhunter does not consider RRCConnecitonRelease a disconnect message in 0.12.0
- Dominant language
- Rust
- Stars
- 5.8k
- Forks
- 490
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 23
Description
### Prerequisites
- [x] I have read [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md)
### Bug Report Details
Rayhunter no longer considers RRCconnectionRelease a disconnect message in 0.12.0, this causes false positives when an IMSI is requested followed by an RRCConnectionRelease. This is because I commented out the relevant lines https://github.com/EFForg/rayhunter/commit/552e9799e307a53f34af21e714d2a5f2cdd88cc6#diff-abdde50129192bbc1af481ebed65a004c992e30342195fc8f8ad3bad3188cfe3R14-R261 When I was working on #1014. I commented this out because it was causing a double alert in some cases and I didn't have the time to give it a proper fix but this was the wrong decision in retrospect. Since @bmw fixed up that pull request and merged it the double alert no longer happens but also now the RRCConnectionRelease messages don't alert. I'm making a pull request to uncomment this code. I've tested it and this fixes the issue and doesn't introduce any new false negatives or false positives.
Contributor guide
Research direction
Inspect commit 552e9799e307a53f34af21e714d2a5f2cdd88cc6 and its referenced diff to locate the commented RRCConnectionRelease handling. Restore the intended behavior, then verify that an IMSI request followed by RRCConnectionRelease produces the correct disconnect alert without double alerts or new false positives.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100