Re:EFF: Rayhunter
by derac on Thursday March 06, 2025 @02:55PM
(#43284451)
I can see why they'd write it for a specific cheap device. Is this stuff possible with a typical phone modem, though; or does it rely on some special features? Forgive my ignorance. :)
[ Parent
| on HN ]
Possible, yes, it's just looking at various 3GPP network messages and parsing out a few common anomalies. Accessible, not all the time.
This project uses QMDL (Qualcomm debug logging) on a device with an accessible modem debug port and debug logging enabled. Most older Qualcomm devices have this form of debug logging available by default, but on newer devices, the debug interface is usually more locked down, requiring some degree of shenanigans to access.
Take a look at SnoopSnitch (similar project for Qualcomm Android phones), QCSuper and MobileInsight (tools capable of capturing signaling data from QC and Mediatek phones), and SCAT (capable of capturing signaling data from some Samsung basebands).
Other vendors usually have similar debug modes for their modems, but they often aren't reverse engineered or as easy to access as the Qualcomm ones.
Amazing reply, thank you!
In the blog post[0], they mention it being possible with rooted Androids - so likely possible, just requires more access to what the modem's doing than the OS normally provides.
[0]: https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-ope...