Sting

Sting is a free and open-source surveillance technology implementation and analysis tool. It captures and analyzes IMSI numbers from GSM cellular networks, enabling security researchers, privacy advocates, and citizens to understand, detect, and defend against cellular interception systems used for mass surveillance.

Overview

Sting demonstrates how IMSI-catcher and Stingray-style cellular surveillance systems operate at a technical level. By understanding how these technologies work, individuals and organizations can develop effective countermeasures and surveillance resistance strategies.

The tool provides three interfaces:

• Command-line interface for fast packet capture and analysis
• REST API for programmatic access and integration
• Desktop GUI for visual analysis and data exploration

All interfaces share a unified SQLite database backend, allowing flexible data collection, analysis, and export.

Why This Matters

Cellular interception systems are deployed globally by:

• Government law enforcement agencies
• Intelligence services (NSA, GCHQ, BND, etc.)
• Corporate security contractors
• Authoritarian regimes for political surveillance
• Organized crime groups

These systems operate largely in secret, with minimal public oversight or transparency. Most people are unaware their phones can be intercepted, located, and monitored without any knowledge or consent.

Sting provides technical transparency about how these systems work with practical knowledge for surveillance detection.

Capabilities

Passive cellular monitoring:

• Capture and decode GSM paging messages
• Extract IMSI numbers (subscriber identities)
• Correlate IMSI with TMSI (temporary identities)
• Identify MCC/MNC (carrier and country information)
• Monitor signal strength and network parameters
• Track cell tower location and frequency

Data analysis:

• Real-time and historical observation queries
• Filtering by country, operator, IMSI, signal strength
• Statistical analysis of cellular activity patterns
• Bulk data export (CSV, JSON)
• Pagination support for large datasets

Installation

System Requirements

Linux operating system (Debian 10+, Ubuntu 20.04+, Kali 2025+) Python 3.8+ (avoid 3.9 due to ctypes compatibility issues) SDR hardware (RTL-SDR recommended for cost-effectiveness; HackRF, BladeRF, OsmocomBB also supported) gr-gsm software for GSM signal decoding

Dependencies

sudo apt update
sudo apt install python3-pip python3-numpy python3-scipy python3-scapy gr-gsm wireshark

Optional: HackRF support

sudo apt install automake autoconf libhackrf-dev
git clone https://github.com/scateu/kalibrate-hackrf
cd kalibrate-hackrf && ./bootstrap && ./configure && make && sudo make install

Setup

git clone https://github.com/ObservanceSurveillance/Sting.git
cd Sting
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Usage

Desktop GUI

Launch GUI with real database:

python3 gui/main.py

Launch GUI with test data (development mode):

python3 gui/gui-dev.py

Features:

• View all observations in sortable table
• Filter by IMSI, country, operator
• Pagination (10-500 records per page)
• Real-time statistics dashboard
• Export observations to CSV
• Search interface

Command-Line Interface

Listen on UDP port 4729 (receives GSMTAP packets from gr-gsm):

python3 cli/catcher.py

Sniff network interface directly (requires root):

sudo python3 cli/catcher.py --sniff --iface lo

Track specific IMSI pattern:

python3 cli/catcher.py --imsi 208 --db france.db

Specify database location:

python3 cli/catcher.py --db observations.db

Suppress console output (database only):

python3 cli/catcher.py --quiet

REST API

Start FastAPI server:

python3 backend/app.py

Query observations with pagination:

curl "http://localhost:8000/observations?limit=50&offset=0"

Filter by country:

curl "http://localhost:8000/observations?country=France&limit=100"

Filter by operator:

curl "http://localhost:8000/observations?operator=Orange&limit=50"

Filter by IMSI:

curl "http://localhost:8000/observations?imsi=208"

Get statistics:

curl "http://localhost:8000/stats"

Create observation:

curl -X POST "http://localhost:8000/observations" \
  -H "Content-Type: application/json" \
  -d '{"imsi":"208 20 1234567890","country":"France","operator":"Orange"}'

Update observation:

curl -X PUT "http://localhost:8000/observations/1" \
  -H "Content-Type: application/json" \
  -d '{"country":"France"}'

Delete observation:

curl -X DELETE "http://localhost:8000/observations/1"

Export all data:

curl "http://localhost:8000/export?format=csv" -o data.csv
curl "http://localhost:8000/export?format=json" > data.json

Interactive API documentation: http://localhost:8000/docs (Swagger UI)

Containers

Docker

docker build -t sting:latest .
docker run --rm -p 4729:4729/udp sting:latest
docker run --rm -p 8000:8000 sting:latest python3 backend/app.py

Podman

podman build -t sting:latest -f Containerfile .
podman run --rm -p 4729:4729/udp sting:latest
podman run --rm -p 8000:8000 sting:latest python3 backend/app.py

Integration with gr-gsm

Sting receives GSMTAP-formatted packets from gr-gsm signal processing software.

Terminal 1: Start gr-gsm signal decoding

grgsm_livemon -f 925.4M

Terminal 2: Start IMSI capture

python3 cli/catcher.py --db observations.db

Terminal 3: Launch analysis GUI

python3 gui/main.py

Terminal 4: Start REST API for integration

python3 backend/app.py

Surveillance Detection Guide

See DEFENSE.md for comprehensive guide on:

• Detecting IMSI catchers and Stingrays
• Identifying fake cellular base stations
• Monitoring GSM network anomalies
• Understanding surveillance indicators
• Privacy protection strategies
• Technical countermeasures
• Legal implications by jurisdiction

Database Schema

Observations table stores:

• id: Unique observation identifier
• timestamp: Date/time observation was recorded
• imsi: IMSI number in formatted string (MCC MNC Subscriber)
• tmsi1: First TMSI value in hex format
• tmsi2: Second TMSI value in hex format
• country: Country identified via MCC lookup
• brand: Operator brand name
• operator: Full operator name
• mcc: Mobile Country Code
• mnc: Mobile Network Code
• lac: Location Area Code (cell area identifier)
• cell_id: Cell ID (unique tower identifier)
• arfcn: Absolute Radio Frequency Channel Number
• signal_dbm: Signal strength in dBm
• snr_db: Signal-to-noise ratio in dB

Indexed columns: imsi, timestamp, country (for fast queries)

Modular Architecture

Sting components are designed as reusable Python libraries:

from lib.tracker import IMSITracker
from lib.database import IMSIDatabase

tracker = IMSITracker(db_path="observations.db")
tracker.set_current_cell("208", "20", "412", "24989")
tracker.process_imsi_data(imsi1=b'\x62\xf2\x10...')

stats = tracker.get_stats()
print(f"Total IMSI captured: {stats['total_imsi_captured']}")

db = IMSIDatabase("observations.db")
rows, total = db.get_observations(limit=100, country="France")
db.export_csv("export.csv")

Integrate into custom tools:

from lib.database import IMSIDatabase

db = IMSIDatabase()
observations = db.get_observations(limit=1000)
anomalies = detect_fake_towers(observations)
alert_user(anomalies)

Resources

Gr-GSM: https://osmocom.org/projects/gr-gsm/wiki/Installation

GSM Frequencies: http://www.worldtimezone.com/gsm.html

MCC/MNC Database: https://en.wikipedia.org/wiki/Mobile_Network_Code

IMSI Structure: https://en.wikipedia.org/wiki/International_mobile_subscriber_identity

RTL-SDR: https://osmocom.org/projects/sdr/wiki/rtl-sdr

Electronic Frontier Foundation: https://eff.org

ACLU Surveillance Resources: https://aclu.org

Disclaimer

This project is provided for educational and research purposes. Users assume all responsibility for legal compliance and ethical use. The authors assume no liability for misuse or illegal activities.