DEF CON 33 - RF Village - Open Source Cellular Test Beds for the EFF Rayhunter - Ron Broberg
Source: YouTube · DEFCONConference · published Oct 22, 2025 · 26:28
Ray Hunter is an EFF open-source project designed to detect stingray devices (cell site simulators) by flagging IMSI requests that occur when these surveillance tools attempt to hijack cellular connections 3:24-4:09.
Key Takeaways:
• Stingrays simulate legitimate cell towers to hijack cellular connections, typically without alerting users, though Google has implemented alerts in newer Android versions 1:33-2:34
• Setting up a test environment requires specific SDR hardware (like USRP or BladeRF) and software components including an EPC (core network) and ENB/GNB (radio interface) 8:06-8:36, 10:47-11:39
• Ray Hunter detects IMSI catchers by analyzing attach requests and can be tested at home using a simulated cellular network 21:56-22:06
• Network downgrade attacks can force devices from 4G/5G to less secure 2G connections, which don't require server authentication 21:31-21:48
By understanding how cellular network attacks work and how to detect them, users can better protect their privacy and security against unauthorized surveillance 24:42-24:56.
Sources:
- 1:33-2:34 Explanation of stingray devices and cellular hijacking
- 3:24-4:09(https://www.youtube.com/watch?v=R
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[Music] the Ray Hunter test bed. Unfortunately, this is mostly working notes, but we'll get we'll uh we'll discuss it and work through it and uh I can answer questions. That'll be great. I'm Ron Broberg. I spent decades at Loheed Martin. Uh you can tell that I had a bit of a culture clash over time. Uh but it wasn't this. Uh and uh I moved over to Darkworth Solutions almost four years ago now. Love it. And part of that whole transition began right here in this village. Uh working that RFCTF. Uh seeing the that intersection between RF and cyber which scared the hell out of every RF engineer I talked to at Lockhee just empowered me to do more. And uh these days I mostly work with drones. Uh, too far. No, I guess not. Okay. So, to understand the ray hunter, you have to understand a little bit…