Recording PCAPs from Stingrays With a $20 Hotspot

Recording PCAPs from Stingrays With a $20 Hotspot

Speakers: Cooper Quintin, oopsbagel

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=meC2JqNAbCA

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Cooper%20Quintin%20-Recording%20PCAPs%20from%20Stingrays%20With%20a%20%2420%20Hotspot.pdf

Overview

Cell-site simulators — commonly known as Stingrays, IMSI catchers, or IMEI grabbers — are surveillance devices used by law enforcement agencies worldwide to track and intercept mobile devices. Despite their decades-long deployment, generating actual network packet captures (PCAPs) from stingray interactions has remained an expensive, technically difficult endeavor requiring specialized hardware. At DEF CON 33, Cooper Quintin (Electronic Frontier Foundation) and oopsbagel presented a groundbreaking technique: using a commodity $20 mobile hotspot to capture packet-level evidence of stingray operations in the field, making cellular surveillance documentation accessible to researchers, journalists, and civil libertarians at near-zero cost.

The project, developed with additional contributions from Will Greenberg at EFF, represents a significant capability jump for counter-surveillance work — transforming stingray detection from a theoretical or expensive pursuit into something any activist, journalist, or security researcher can carry in their pocket.

Background

▶ Watch: Introduction: What stingrays (IMSI catchers) are and how they work (1:31)

Stingrays operate by impersonating legitimate cell towers, forcing nearby mobile devices to connect to them. Once a device is connected, the simulator can collect the device's IMSI (the SIM card identifier) and IMEI (the hardware identifier), enabling law enforcement to identify and track individuals without their knowledge or a warrant in many jurisdictions. More advanced configurations can intercept voice calls and SMS messages. These devices have been used by federal agencies (FBI, DEA, DHS), state and local police departments, and — according to investigative reporting — foreign intelligence services operating on US soil.

Civil liberties organizations like the EFF have documented stingray use for years. The core problem for accountability has always been evidence: stingrays operate silently, and victims typically have no way to prove a stingray was used against them. Existing detection tools — applications like AIMSICD, SnoopSnitch, and EFF's own work — can detect anomalous cell tower behavior, but they produce behavioral heuristics, not the kind of packet-level forensic evidence that could support litigation or policy advocacy.

Prior to this research, capturing raw LTE or 5G NR packets from stingray interactions required software-defined radio setups costing hundreds to thousands of dollars, substantial RF engineering expertise, and physical proximity to both the stingray and the target device simultaneously. This barrier kept rigorous forensic documentation out of reach for most civil society actors.

Key Findings

▶ Watch: The $20 hotspot: hardware used for the attack (7:29)

• A $20 portable Wi-Fi hotspot running open-source firmware can record PCAPs of the cellular traffic associated with stingray interactions. Specifically, the research targets the Qualcomm-based hotspot chipset's diagnostic interface (DIAG protocol), which exposes raw cellular modem data including protocol messages at the LTE/NR air interface layer.

• The DIAG interface is present on a wide range of consumer devices. The same diagnostic protocol used by Qualcomm chipsets in hotspots is also present in many Android smartphones, meaning the technique can potentially be extended to standard consumer handsets.

• The captured PCAPs contain the actual LTE RRC (Radio Resource Control) and NAS (Non-Access Stratum) messages exchanged during a stingray interaction. This includes the Attach Request, Identity Request, and TMSI/IMSI response messages that characterize a forced IMSI disclosure event — precisely the forensic evidence needed to demonstrate that a stingray was used against a specific device.

• The technique enables passive, device-side capture. Rather than requiring a third-party radio monitoring setup, the target device itself (or a companion hotspot) records the interaction, creating evidence that is tightly coupled to the victim's own device identifier.

• Rust was chosen for the device-side implementation to enable safe, reliable operation on constrained embedded hardware, and oopsbagel discussed the process of porting the firmware to enable this capability.

Technical Deep Dive

▶ Watch: LTE protocol weaknesses exploited in this technique (9:30)

The core of the technique exploits the Qualcomm DIAG protocol, a proprietary diagnostic interface built into virtually all Qualcomm modem chipsets. The DIAG interface exposes internal modem state, logging buffers, and control commands through a serial (USB or UART) interface. While Qualcomm does not publicly document DIAG in detail, it has been extensively reverse-engineered by the mobile security research community (prior work by researchers at academic institutions and companies like Comsecuris has mapped many of the relevant command codes).

The target device chosen for this research is an inexpensive (~$20) portable Wi-Fi hotspot built on a Qualcomm chipset with available open-source firmware support. The research team ported a Rust-based DIAG logging daemon to run on this device, allowing it to:

1. Open the DIAG interface on the device's modem.
2. Subscribe to the relevant LTE/NR log item codes corresponding to RRC and NAS message logging.
3. Capture these messages in real time, parsing the binary DIAG log packets.
4. Format them into standard PCAP format (using a custom link-layer type for LTE air interface messages).
5. Write the PCAPs to local storage or stream them over Wi-Fi to a companion device.

The NAS layer messages are especially valuable for stingray detection. When a stingray forces a device to identify itself, it sends an Identity Request message (NAS EMM procedure 0x55 in LTE). The device responds with its IMSI or IMEI in an Identity Response. These messages are normally not visible to the user at all — they are exchanged silently between the modem firmware and the network. Capturing them at the DIAG layer makes this interaction visible and attributable.

The RRC layer provides complementary evidence: measurement reports, cell selection/reselection events, and the specific parameters of the serving cell (frequency, PCI, TAC) can be captured. A stingray typically uses an unusual combination of these parameters — for example, broadcasting a strong signal on a frequency that doesn't match the expected coverage of any legitimate carrier tower in the area.

oopsbagel's portion of the talk focused on the Rust implementation and device porting challenges: working with embedded Rust on a resource-constrained device, interfacing with the DIAG character device, managing binary protocol parsing without a heap allocator, and contributing the porting work back to the open-source community for others to build on.

The complete toolchain is designed for field use by non-experts: the hotspot runs autonomously, captures data continuously when powered on, and stores PCAPs that can be reviewed later by a forensic analyst. No specialized RF hardware, no software-defined radio, no laptop needed — just a device that fits in a shirt pocket.

Demo / Proof of Concept

▶ Watch: Capturing PCAPs from stingray-intercepted traffic (15:27)

The talk includes a live demonstration of PCAP capture from the modified hotspot, showing the raw LTE NAS messages including an Identity Request/Response sequence. The speakers demonstrate parsing the captured PCAP with Wireshark (using the appropriate dissector plugins for LTE NAS) to extract human-readable protocol fields, including the type of identity being requested and the response from the device.

A simulated stingray interaction (using a controlled LTE test environment to avoid interference with live networks) was used to trigger and record a forced IMSI disclosure event, with the complete exchange visible in the captured PCAP. The demonstration validates that the $20 device captures the same forensically relevant data that would be produced by a real stingray encounter.

The team also demonstrated the PCAP analysis workflow that a non-expert could follow to interpret the captured data and produce a clear human-readable report of what happened — a critical step for the data to be usable in legal proceedings or investigative journalism.

Defensive Implications

▶ Watch: Lab setup and equipment walkthrough (27:29)

This research is fundamentally pro-defensive: it provides civil society actors with low-cost tools to document government surveillance. However, the broader technical implications are worth noting.

For individuals at risk of surveillance:

• Carrying a $20 hotspot running this firmware provides continuous passive monitoring of cellular surveillance events.
• The data is automatically logged and timestamped, enabling correlation with known locations and times.
• PCAP evidence of forced IMSI disclosure events is far more compelling in legal proceedings than behavioral anomaly reports from detection apps.

For law enforcement and policy:

• Widespread deployment of this capability by civil society actors will increase accountability for stingray use, particularly warrantless deployments.
• Law enforcement agencies using stingrays should anticipate that forensically documented evidence of their use may increasingly appear in court challenges and press investigations.

For telecommunications security:

• The ease of IMSI disclosure via stingrays remains a fundamental vulnerability in LTE (4G). While 5G's SUPI/SUCI mechanism encrypts the subscriber identifier before transmission, legacy LTE downgrade attacks remain viable in most markets.
• Device manufacturers and carriers should consider exposing anomaly detection APIs to users or trusted security applications, rather than forcing researchers to reverse-engineer DIAG interfaces.

For the Qualcomm ecosystem:

• The DIAG interface provides extraordinary visibility into modem internals and represents a significant attack surface. This research uses it constructively, but the same interface is an avenue for modem exploitation research.

Key Takeaways

1. A $20 Qualcomm-based hotspot with open-source firmware can produce forensic-quality PCAPs of LTE air interface traffic, including stingray IMSI disclosure events.
2. The Qualcomm DIAG protocol, while proprietary, has been sufficiently reverse-engineered to enable precise capture of NAS and RRC layer messages relevant to cellular surveillance detection.
3. This capability democratizes stingray documentation — making forensic counter-surveillance accessible to journalists, activists, lawyers, and anyone concerned about cell-site simulator use.
4. The implementation in Rust provides a safe, maintainable, embedded-friendly codebase that the community can port to additional Qualcomm-based devices.
5. LTE's fundamental susceptibility to IMSI disclosure via IMSI catchers remains unaddressed in deployed infrastructure; 5G's SUPI encryption offers a partial fix but legacy downgrade attacks persist.

About the Speaker(s)

▶ Watch: Privacy implications and policy considerations (42:29)

Cooper Quintin (aka Cyber Tiger) is a Senior Staff Technologist at the Electronic Frontier Foundation, where he has worked for over 10 years. His portfolio includes Privacy Badger, state-sponsored malware research, the Street Level Surveillance project, Threat Lab, and mobile security. He is a prominent voice in the digital civil liberties community on surveillance technology.

oopsbagel is a security researcher and embedded systems developer known for prior work on malicious UEFI (presented at previous DEF CON conferences). At DEF CON 33, oopsbagel contributed the Rust device porting work that made the hotspot PCAP capture project possible, and presented the technical implementation details of interfacing with the DIAG protocol from embedded Rust code.

Will Greenberg (EFF, unable to attend) was a co-creator of the research and contributed substantially to the technical development of the project.