This project uses QMDL (Qualcomm debug logging) on a device with an accessible modem debug port and debug logging enabled. Most older Qualcomm devices have this form of debug logging available by default, but on newer devices, the debug interface is usually more locked down, requiring some degree of shenanigans to access.
Take a look at SnoopSnitch (similar project for Qualcomm Android phones), QCSuper and MobileInsight (tools capable of capturing signaling data from QC and Mediatek phones), and SCAT (capable of capturing signaling data from some Samsung basebands).
Other vendors usually have similar debug modes for their modems, but they often aren't reverse engineered or as easy to access as the Qualcomm ones.
The EFF also writes in the topic from time to time. See: https://www.eff.org/deeplinks/2024/06/next-generation-cell-s...
https://www.rtl-sdr.com/kiwisdr-tdoa-direction-finding-now-f...
Dial *3001#12345#*
(e)SIM password can provide an additional layer of control over when the phone contacts a cellular tower.
Unlocked RC400L's are going for ~$19.99
Gunna look into getting one and making one of these to play with.
I'm wondering if using an imsi catcher is still effective? Most of the time I'm using calling over wifi (VoLTE) or I'm in a car (where an imsi catcher isn't really practical).
It’s not necessarily intended to intercept, although I believe there were some that downgraded G3 to G2 to be able to potentially do that.
I don’t know whether downgrade attacks are still viable (or needed).
As far as I understand, outside of active interception the only use for these things is warrantless dragnet surveillance of location. (And active interception is increasingly not possible due to better security practices.)
IIRC even with airplane mode the stingray can capture phone info, IMEI, GPS location, etc.
No. Airplane mode turns off the cellular radio's emissions, that's the whole point. A cellular base station emulator isn't going to do anything in that situation.