Commit Graph

138 Commits

Author SHA1 Message Date
Will Greenberg
30323b8329 Keep old 2G downgrade analyzer 2025-01-28 11:02:19 -08:00
Will Greenberg
28b0f409db fix attribution 2025-01-28 11:02:19 -08:00
Will Greenberg
12640cc878 Rewrite our 2G downgrade analyzer 2025-01-28 11:02:19 -08:00
Will Greenberg
26eda5904f Better wording on IMSI requested warning 2025-01-28 11:02:19 -08:00
Will Greenberg
6bd36921d8 consider early IMSI request medium sev 2025-01-08 15:23:59 -08:00
Will Greenberg
c83ae30be8 fix language 2025-01-08 15:23:59 -08:00
Will Greenberg
fa612241a5 lib: add IMSI requested heuristic 2025-01-08 15:23:59 -08:00
Will Greenberg
10592bbd9d lib: add inbound/outbound field to NAS 2025-01-06 16:24:11 -08:00
Will Greenberg
327eaddcd7 rayhunter-check: pcapify qmdl 2025-01-06 16:24:11 -08:00
Cooper Quintin
f4a6c834d2 remove false positive IMSI heuristic until we get a NAS parser 2024-12-09 10:53:58 -08:00
Cooper Quintin
ee75326912 Fix macos install (#67)
* update shell path and some docs

* download ADB if not present

* big O not little o

* bugfix

* bugfix

* silence errors for macos developers

* Update dist/install-common.sh

Co-authored-by: Will Greenberg <willg@eff.org>

---------

Co-authored-by: Will Greenberg <willg@eff.org>
2024-10-22 12:21:27 -07:00
Will Greenberg
6c237e884c lib: rm duplicate TestAnalyzer 2024-10-10 12:41:25 -07:00
Will Greenberg
16f705f29c Add the test analyzer entirely via daemon flags
Also consolidate the duplicate AnalysisWriter implementation
2024-10-08 14:58:46 -07:00
Cooper Quintin
ca4f49b15f Framebuffer update (#60)
* first pass at changing the UI color based on state

* adding flag to qmdl metadata for when hueristic is triggered

* update style for web page to match UI and have color alert on heuristic trigger

* add test analyzer

* rename example_analyzer to test_analyzer

* refactor ui update to not depend on server

* refactor to pass around color instead of display state for framebuffer channel

* add debug feature flag for test analyzer

* remove warning status from qmdl manifest

* dont keep has warning around
2024-10-03 10:41:59 -07:00
Will Greenberg
861aaedd47 rayhunter-check improvements 2024-08-19 16:49:01 -07:00
Will Greenberg
d6fb54afb3 lib: rm unused imports 2024-08-05 09:57:09 -07:00
Will Greenberg
09fdb9d6e1 lib: add analyzer for a null cipher being set 2024-07-18 16:02:12 -07:00
Will Greenberg
b5262cd1b9 lib: use ImsiProvidedAnalyzer by default 2024-07-10 20:28:33 -07:00
Will Greenberg
8f7ac607a7 lib: add analyzer for detecting IMSIs being sent 2024-07-10 20:24:52 -07:00
Cooper Quintin
f261940a26 Merge branch 'main' into documentation 2024-06-06 13:06:49 -07:00
Will Greenberg
bfc688ad21 daemon: switch to writing heuristics output to ND-JSON
ND-JSON (newline-delimited JSON) is just a file with a list of JSON
objects separated by newlines. This way, as the analyzer harness
processes new packets, it can simply append JSON-serialized results
to a file without parsing the entire thing first.

Also simplifies the analysis stuff to all operate in the diag thread.
2024-05-09 14:46:41 -07:00
Will Greenberg
4a5bede4ee lib: fix overzealous regex 2024-05-08 15:00:24 -07:00
Will Greenberg
3c932f0ce9 daemon: run analysis in realtime
Currently we just show the results of analysis as a <pre> tagged
JSON blob, but eventually we can make some actual UI
2024-05-08 14:58:14 -07:00
Will Greenberg
531c10cf29 Add rayhunter-check, a utility for running QMDL heuristics 2024-03-11 18:21:52 -07:00
Cooper Quintin
63e9c53dd4 server listen publicly 2024-02-29 15:19:25 -08:00
Cooper Quintin
924b7c9302 Merge branch 'main' into documentation 2024-02-29 12:06:30 -08:00
Will Greenberg
fa5f72dd52 lib: ignore WriteZero for flush as well 2024-02-29 09:53:56 -08:00
Cooper Quintin
6be208698b merge 2024-02-28 16:05:46 -08:00
Will Greenberg
36c09e1dbc diag_device: rm unused initialization tracker 2024-02-23 10:54:51 -08:00
Will Greenberg
0b6c06c7e6 appease clippy 2024-02-22 19:29:52 -08:00
Will Greenberg
775cbcda1e Transition to async I/O for most things
Mixing async and sync I/O leads to a multitude of complications, and
generally speaking it's much more convenient to stick to one paradigm
or the other. Since axum (and many other HTTP servers) use async,
and since async is a convenient model for performing operations like
"handle an MPSC message or file read, whichever happens first", let's
commit to an async interface.
2024-02-22 19:28:58 -08:00
Will Greenberg
abd3b98cff diag_device: remove unnecessarily public function 2024-02-22 19:10:31 -08:00
Will Greenberg
d4ee48827c lint fixes 2024-02-13 17:03:06 -08:00
Will Greenberg
5d7caba1a6 Minimal version of the LTE downgrade analyzer
This also renames the lte_parser crate to telcom_parser, since it'll
handle any 2G or 3G parsing going forward.
2024-02-13 17:03:06 -08:00
Will Greenberg
d570ad3cb1 lib: add Analyzer trait
This trait will be implemented by all of our heuristics, giving
us a uniform interface for collecting events and displaying them
to the user.
2024-02-13 17:03:06 -08:00
Will Greenberg
7e4511fdde lib: add lte-parser crate support
This'll let us convert a Gsmtap message into a fully parsed LTE
message.
2024-02-13 17:03:06 -08:00
Will Greenberg
ed9d2b41d7 Renamed library crate to rayhunter, binary to rayhunter-daemon
The produced binary is still called rayhunter though!
2024-01-30 10:18:38 -08:00
Will Greenberg
87f18c0c8b Rename directories (again) 2024-01-30 09:58:05 -08:00