Comment by oger
5 hours ago
Yes there absolutely are!
The EFF has the Rayhunter project at https://github.com/EFForg/rayhunter - it is basically an IMSI catcher catcher. You install it on a pocket router and it detects typical signatures that IMSI catchers use, for example telling your mobile to downgrade from LTE to 2G making it easy for them to tell your device to join THEIR network and read the IMSI / IMEI for your device and possibly route your traffic through their network.
The device with Rayhunter installed will notify you when these signatures are being detected and you get a pcap file that you can dissect using Wireshark.
There are other tools that you can install on Android devices but Rayhunter certainly is a good start if you want to detect the use of IMSI catchers.
One caveat: IMSI-catching is a cat-and-mouse game, so no promises can be made that the Rayhunter heuristics catch all attacks.
Rayhunter is a great tool, but unfortunately, it is only a passive monitor for cellular state changes and not an active defense.
Modern Stingrays / IMSI catchers support all standards up to 5G. They easily exploit 4G networks and 5G Non-Standalone (NSA) deployments. The only effective active defenses include (a) using a device locked strictly to 5G Standalone (SA) mode with SUCI (Subscription Concealed Identifier) enabled, preventing fallback to 4G/3G/2G where identity spoofing is trivial, (b) keeping the device in airplane mode most of the time, only going online briefly from unpredictable, shifting locations, and (c) using custom cellular baseband firmware that can reject anomalies (like a tower suddenly appearing too close or lacking neighbor cell lists), though this requires custom building your own solution as ready-made consumer solutions are hard to find. The last one can be achieved with Rayhunter, of course, but it would require some patching to Rayhunter and always carrying a mobile phone connected to the Rayhunter-supported Wi-Fi hotspot device.
Finally, intelligence mercenaries (and therefore LE agencies that contract them) use warrantless network-side exploits like SS7/Diameter attacks to remotely query the core telecom routing system and harvest the location of the tower target's phone is currently using¹ ². This doesn't even require sending legal DD requests to telcos to get target's cell tower.
[1] https://www.researchgate.net/publication/370809133_Attacks_t...
[2] https://www.lighthousereports.com/methodology/surveillance-s...