EFForg / EFForg/rayhunter

IMSI Requested with out attach - False positive.

Open
#557 7 comments 1 reaction 0 assignees View on GitHub
bug heuristic
Dominant language
Rust
Stars
5.8k
Forks
490
Avg merge
3d 10h
Merged PRs (30d)
23

Description

### Bug Report Details

The IMSI requested without attach part of the IMSI requested heuristic has triggered a false positive (I discovered this live during an analysis at defcon.) It happens sometimes when you first turn the device on because rayhunter starts after the UE already sent an attach request, this can be fixed by ignoring this heuristic for the first 8 packets. The second was a logic bug that sometimes Identity request happens after authentication (which is weird actually now that I Think about it, need to look into why this would happen.) This only happens in the turks and caicos PCAP. I need to fix the false positive.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.