EFForg / EFForg/rayhunter

rayhunter-check not give the warning even if SIB7 appear

Open
#719 9 comments 1 reaction 1 assignee Claimed by @cooperq View on GitHub
enhancement help wanted
Dominant language
Rust
Stars
5.8k
Forks
490
Avg merge
3d 10h
Merged PRs (30d)
23

Description

i Collect my PCAP with SIB7 shown in frame 839, im using SCAT

Kindly see the snapshot below
Image

I run the rayhunter-check:
./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap

**but the output just like below:**
INFO [rayhunter_check] Analyzers:
INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message
INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell.
INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities.
INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0)
INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command
INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs
INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap
INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped

**show-skipped**
curious with 1230 messages that skipped, i run again with --show-skipped
./rayhunter-check -d -p ~/Desktop/raycheckpath/scat3_fixed.pcap --show-skipped
INFO [rayhunter_check] Analyzers:
INFO [rayhunter_check] - Identity (IMSI or IMEI) requested in suspicious manner (v3): Tests whether the ME sends an Identity Request NAS message without either an associated attach request or auth accept message
INFO [rayhunter_check] - Connection Release/Redirected Carrier 2G Downgrade (v1): Tests if a cell releases our connection and redirects us to a 2G cell.
INFO [rayhunter_check] - LTE SIB 6/7 Downgrade (v1): Tests for LTE cells broadcasting a SIB type 6 and 7 which include 2G/3G frequencies with higher priorities.
INFO [rayhunter_check] - Null Cipher (v1): Tests whether the cell suggests using a null cipher (EEA0)
INFO [rayhunter_check] - NAS Null Cipher Requested (v1): Tests whether the MME requests to use a null cipher in the NAS security mode command
INFO [rayhunter_check] - Incomplete SIB (v2): Tests whether a SIB1 message contains a full chain of followup sibs
INFO [rayhunter_check] **** Beginning analysis of scat3_fixed.pcap
INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: messages skipped:
INFO [rayhunter_check] - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)"
INFO [rayhunter_check] /Users/ahmadrifky/Desktop/raycheckpath/scat3_fixed.pcap: 1230 messages analyzed, 0 warnings, 1230 messages skipped
(base) ahmadrifky@ahmads-mbp-2 rayhunter-check-macos-intel %

instead got new error - 1230: "failed to read GsmtapHeader: InvalidTypeSubtypeCombo(127, 255)"

looking forward for your resolution

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.