Literally just airplane mode. It's ended up being a rather excellent privacy toggle that operating systems have to implement well.
GrapheneOS has "2G Network Protection" which prevents your phone from connecting to 2G networks and it also can notify you if your cellular identifiers were accessed.
https://www.cape.co seemed suspicious to me but apparently they actually do manage to make decent security improvements on the cellular stack. They also donate 100k/year to GrapheneOS [1] which is cool.
>GrapheneOS has "2G Network Protection" which prevents your phone from connecting to 2G networks
This isn't just a GrapheneOS feature so you don't need a new ROM for it. Upstream Android provides this feature. Being enrolled in Google Advanced Protection program even forces it on. It is also available in iOS via Lockdown Mode. Just a great feature and I'm glad its broadly available.
>GrapheneOS has "2G Network Protection" which prevents your phone from connecting to 2G networks and it also can notify you if your cellular identifiers were accessed.
You should realistically be changing to it to "5G or LTE only", even better "5G only". The latter should provide complete protection from IMSI/IMEI sniffing by rogue base stations.
Yow, $70 a month is rather harsh. Honestly I'd rather just stick to Signal and avoid traditional calling/SMS and use HTTPS for everything over mobile data instead.
Almost everyone needs a solution that allows them to send and receive communication, including using the Internet, at arbitrary places and times.
> (Cape)
Cape is cofounded by Palantir alums; national security agencies are their main market. That doesn't condemn them - and it may speak to technical chops and requirements - though people should be informed so they can make their own decisions.
> They also donate 100k/year to GrapheneOS
Their valuation, as of this past March, is $900M [0]. GrapheneOS is mostly silent about donors and any arrangments with them, afaict.
The EFF has the Rayhunter project at https://github.com/EFForg/rayhunter - it is basically an IMSI catcher catcher. You install it on a pocket router and it detects typical signatures that IMSI catchers use, for example telling your mobile to downgrade from LTE to 2G making it easy for them to tell your device to join THEIR network and read the IMSI / IMEI for your device and possibly route your traffic through their network.
The device with Rayhunter installed will notify you when these signatures are being detected and you get a pcap file that you can dissect using Wireshark.
There are other tools that you can install on Android devices but Rayhunter certainly is a good start if you want to detect the use of IMSI catchers.
One caveat: IMSI-catching is a cat-and-mouse game, so no promises can be made that the Rayhunter heuristics catch all attacks.
Rayhunter is a great tool, but unfortunately, it is only a passive monitor for cellular state changes and not an active defense.
Modern Stingrays / IMSI catchers support all standards up to 5G. They easily exploit 4G networks and 5G Non-Standalone (NSA) deployments.
The only effective active defenses include (a) using a device locked strictly to 5G Standalone (SA) mode with SUCI (Subscription Concealed Identifier) enabled, preventing fallback to 4G/3G/2G where identity spoofing is trivial, (b) keeping the device in airplane mode most of the time, only going online briefly from unpredictable, shifting locations, and (c) using custom cellular baseband firmware that can reject anomalies (like a tower suddenly appearing too close or lacking neighbor cell lists), though this requires custom building your own solution as ready-made consumer solutions are hard to find.
The last one can be achieved with Rayhunter, of course, but it would require some patching to Rayhunter and always carrying a mobile phone connected to the Rayhunter-supported Wi-Fi hotspot device.
Finally, intelligence mercenaries (and therefore LE agencies that contract them) use warrantless network-side exploits like SS7/Diameter attacks to remotely query the core telecom routing system and harvest the location of the tower target's phone is currently using¹ ². This doesn't even require sending legal DD requests to telcos to get target's cell tower.
You can build an IMSI-catcher-catcher out of an Orbic RC400L cellular hotspot and the Rayhunter software published by the EFF.
https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-ope...
https://efforg.github.io/rayhunter/orbic.html
does it need a sim card in, and does it need to be activated?
Literally just airplane mode. It's ended up being a rather excellent privacy toggle that operating systems have to implement well.
GrapheneOS has "2G Network Protection" which prevents your phone from connecting to 2G networks and it also can notify you if your cellular identifiers were accessed.
https://www.cape.co seemed suspicious to me but apparently they actually do manage to make decent security improvements on the cellular stack. They also donate 100k/year to GrapheneOS [1] which is cool.
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
>GrapheneOS has "2G Network Protection" which prevents your phone from connecting to 2G networks
This isn't just a GrapheneOS feature so you don't need a new ROM for it. Upstream Android provides this feature. Being enrolled in Google Advanced Protection program even forces it on. It is also available in iOS via Lockdown Mode. Just a great feature and I'm glad its broadly available.
>GrapheneOS has "2G Network Protection" which prevents your phone from connecting to 2G networks and it also can notify you if your cellular identifiers were accessed.
You should realistically be changing to it to "5G or LTE only", even better "5G only". The latter should provide complete protection from IMSI/IMEI sniffing by rogue base stations.
Yow, $70 a month is rather harsh. Honestly I'd rather just stick to Signal and avoid traditional calling/SMS and use HTTPS for everything over mobile data instead.
> Literally just airplane mode.
Almost everyone needs a solution that allows them to send and receive communication, including using the Internet, at arbitrary places and times.
> (Cape)
Cape is cofounded by Palantir alums; national security agencies are their main market. That doesn't condemn them - and it may speak to technical chops and requirements - though people should be informed so they can make their own decisions.
> They also donate 100k/year to GrapheneOS
Their valuation, as of this past March, is $900M [0]. GrapheneOS is mostly silent about donors and any arrangments with them, afaict.
[0] https://www.forbes.com/sites/thomasbrewster/2026/03/19/ex-pa...
Valuation has nothing to do with cash.
I appreciate this even handed take! Thanks
Where can you find a 2G Network that you need help in not connecting?
Lockdown Mode on iOS also disables 2G
Yes there absolutely are!
The EFF has the Rayhunter project at https://github.com/EFForg/rayhunter - it is basically an IMSI catcher catcher. You install it on a pocket router and it detects typical signatures that IMSI catchers use, for example telling your mobile to downgrade from LTE to 2G making it easy for them to tell your device to join THEIR network and read the IMSI / IMEI for your device and possibly route your traffic through their network.
The device with Rayhunter installed will notify you when these signatures are being detected and you get a pcap file that you can dissect using Wireshark.
There are other tools that you can install on Android devices but Rayhunter certainly is a good start if you want to detect the use of IMSI catchers.
One caveat: IMSI-catching is a cat-and-mouse game, so no promises can be made that the Rayhunter heuristics catch all attacks.
Rayhunter is a great tool, but unfortunately, it is only a passive monitor for cellular state changes and not an active defense.
Modern Stingrays / IMSI catchers support all standards up to 5G. They easily exploit 4G networks and 5G Non-Standalone (NSA) deployments. The only effective active defenses include (a) using a device locked strictly to 5G Standalone (SA) mode with SUCI (Subscription Concealed Identifier) enabled, preventing fallback to 4G/3G/2G where identity spoofing is trivial, (b) keeping the device in airplane mode most of the time, only going online briefly from unpredictable, shifting locations, and (c) using custom cellular baseband firmware that can reject anomalies (like a tower suddenly appearing too close or lacking neighbor cell lists), though this requires custom building your own solution as ready-made consumer solutions are hard to find. The last one can be achieved with Rayhunter, of course, but it would require some patching to Rayhunter and always carrying a mobile phone connected to the Rayhunter-supported Wi-Fi hotspot device.
Finally, intelligence mercenaries (and therefore LE agencies that contract them) use warrantless network-side exploits like SS7/Diameter attacks to remotely query the core telecom routing system and harvest the location of the tower target's phone is currently using¹ ². This doesn't even require sending legal DD requests to telcos to get target's cell tower.
[1] https://www.researchgate.net/publication/370809133_Attacks_t...
[2] https://www.lighthousereports.com/methodology/surveillance-s...
Burner phone? No phone?
faraday pouch.