IMSI Requested with out attach - False positive.
Open
bug
heuristic
- Dominant language
- Rust
- Stars
- 5.8k
- Forks
- 490
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 23
Description
### Bug Report Details
The IMSI requested without attach part of the IMSI requested heuristic has triggered a false positive (I discovered this live during an analysis at defcon.) It happens sometimes when you first turn the device on because rayhunter starts after the UE already sent an attach request, this can be fixed by ignoring this heuristic for the first 8 packets. The second was a logic bug that sometimes Identity request happens after authentication (which is weird actually now that I Think about it, need to look into why this would happen.) This only happens in the turks and caicos PCAP. I need to fix the false positive.
Contributor guide
Assessment
This issue has not been assessed yet.