diff --git a/dist/config.toml.in b/dist/config.toml.in index a897404..4c421be 100644 --- a/dist/config.toml.in +++ b/dist/config.toml.in @@ -35,3 +35,4 @@ lte_sib6_and_7_downgrade = true null_cipher = true nas_null_cipher = true incomplete_sib = true +test_analyzer = false \ No newline at end of file diff --git a/doc/heuristics.md b/doc/heuristics.md index ce98943..e97d0eb 100644 --- a/doc/heuristics.md +++ b/doc/heuristics.md @@ -53,3 +53,7 @@ It could also indicate an IMSI catcher which is connected to the mobile network This analyser tests whether the SIB1 message contains a complete SIB chain (SIB3, SIB5, etc.). A legitimate SIB1 message should contain timing information for at least 2 additional SIBs (SIB3, 4, and 5 being the most common) but a fake base station will often not bother to send additional SIBs beyond 1 and 2 (i. e. some IMSI catchers send just SIB1 and *one additional* SIB). On its own this might just be a misconfigured base station (though we have only seen it in the wild under suspicious circumstances) but combined with other heuristics such as **IMSI Requested** detection it should be considered as a strong indicator of malicious activity. + +### Test Analyzer + +This analyzer is great for testing if your Rayhunter installation works. It will alert every time a new tower is seen (specifically every time a tower broadcasts a SIB1 message.) It is designed to be very noisey so we do not reccomend leaving it on but if this alerts it means your Rayhunter device is working! \ No newline at end of file diff --git a/lib/src/analysis/analyzer.rs b/lib/src/analysis/analyzer.rs index a76f16e..31725c5 100644 --- a/lib/src/analysis/analyzer.rs +++ b/lib/src/analysis/analyzer.rs @@ -178,7 +178,7 @@ impl Harness { harness.add_analyzer(Box::new(IncompleteSibAnalyzer::new())) } - if analyzer_config.incomplete_sib { + if analyzer_config.test_analyzer { harness.add_analyzer(Box::new(TestAnalyzer::new())) }