Mirror/rayhunter
1
0
Fork 0
mirror of https://github.com/EFForg/rayhunter.git synced 2026-06-12 15:53:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

Update heuristics.md

Browse Source
This commit is contained in:
Matej Kovacic
2025-08-01 21:13:21 +00:00
committed by Cooper Quintin
parent c6aa53acd2
commit 30bb18016e
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/heuristics.md
+3 -1
View File
@@ -50,4 +50,6 @@ It could also indicate an IMSI catcher which is connected to the mobile network
### Incomplete SIB
This analyser tests whether the SIB1 message contains a complete SIB chain (SIB3, SIB5, etc.). A legitimate SIB1 message should contain timing information for at least 2 additional SIBs (SIB3, 4, and 5 being the most common) but a fake base station will often not bother to send additional SIBs beyond 1 and 2. On its own this might just be a misconfigured base station (though we have only seen it in the wild under suspicious circumstances) but combined with other heuristics such as **IMSI Requested** detection it should be considered as a strong indicator of malicious activity.
This analyser tests whether the SIB1 message contains a complete SIB chain (SIB3, SIB5, etc.). A legitimate SIB1 message should contain timing information for at least 2 additional SIBs (SIB3, 4, and 5 being the most common) but a fake base station will often not bother to send additional SIBs beyond 1 and 2 (i. e. some IMSI catchers send just SIB1 and *one additional* SIB).
On its own this might just be a misconfigured base station (though we have only seen it in the wild under suspicious circumstances) but combined with other heuristics such as **IMSI Requested** detection it should be considered as a strong indicator of malicious activity.