Real-Time IMSI Catcher Detection for Android
Detect security loopholes in cell tower communications in real-time that may or may not indicate a fake tower.
REMOVED
Cymatune is a privacy-focused Android application that identifies potential security anomalies in cellular networks that could indicate IMSI catchers or surveillance equipment, operating in real-time. It uses geographic anomaly detection, signal analysis, trust scoring, and logcat monitoring to flag suspicious behavior.
- ✅ Real-Time Alerts - Instant notifications when threats are detected
- ✅ 42 Detection Methods - Comprehensive multi-layered analysis
- ✅ Plain SQLite Storage - Unencrypted on-device database (no SQLCipher)
- ✅ Privacy-First - No analytics, no tracking, no data sharing
- ✅ Dialer + Contacts - Full calling functionality retained
REMOVED
Geographic & Location Analysis
- Geographic anomaly detection (towers appearing in impossible locations)
- Location jump detection (sudden impossible movement)
- Distance-based trust scoring
Signal Analysis
- Signal strength pattern analysis (RSRP, RSRQ, SINR)
- Timing Advance anomaly detection
- CQI/MCS mismatch detection
- Signal fluctuation profiling
Tower Behavior
- LAC/CID pattern analysis
- Protocol downgrade detection (5G→4G→3G→2G)
- Encryption strength monitoring (EEA0, 5G-NULL)
- Cipher suite validation (SUPI, AKA, AKA')
- Handshake anomaly detection
- Silent SMS (Class 0) detection
System Monitoring
- Real-time logcat threat detection
- Sensor abuse detection (camera/mic without indicator)
- Privacy leak detection
- RIL event analysis
- Network type monitoring (LTE, NSA, SA)
Trust & Reputation
- Dynamic trust scoring (0-100)
- Observation count tracking
- Historical behavior profiling
- Multi-SIM support
- Real-Time Dashboard - Current tower info, trust score, detection rate
- Instant Notifications - Minimal status bar notifications for threats
- Dialer with tabs - Dial, Recents, Contacts (fully functional)
- Tower Details - Tap any tower to see full technical details
- Settings - Notification preferences, about, version info
REMOVED
Cymatune operates in real-time with alerts:
- Continuous Monitoring — The app runs a foreground service that scans cell towers every 30 seconds
- Multi-Method Analysis — Each detection method contributes to a trust score (0-100)
- Real-Time Alerting — When multiple methods flag suspicious behavior, an instant notification is shown
- Broadcast Updates — UI fragments receive live updates via broadcasts
- Local Pattern Learning — Tower observations are stored securely on-device in a standard SQLite database. This allows the app to learn your normal environment over time for improved detection accuracy.
Data Sovereignty: Tower observations are kept indefinitely for trust score calculation and local environment learning, giving users full control to manually clear data whenever desired via system settings.
REMOVED
Cymatune utilizes a multi-layered detection engine with 42 distinct methods categorized across five analysis layers.
- Geographic Anomaly — Detects towers reporting coordinates far from their previous known location.
- Sudden LAC Change — Identifies suspicious Location Area Code transitions while the user is stationary.
- Location Jump Detection — Flags sudden, physically impossible movements between tower connections.
- Distance-based Trust Scoring — Scores tower reliability based on its reported proximity to known infrastructure.
- Small Cell Validation — Cross-references high-signal/low-range towers against small cell CID patterns.
- GPS Jitter Validation — Distinguishes between legitimate movement and GPS spoofing using accelerometer data.
- Realistic Speed Capping — Rejects tower handovers occurring at unrealistic terrestrial speeds (>200 km/h).
- Spatial Refinement — Increases detection precision as more observations are collected from varying angles.
- Ultra-Low Signal Detection — Flags towers maintaining connections below standard sensitivity thresholds (<-110 dBm).
- Excessive Signal Power — Detects unusually strong signals (> -45 dBm) that exceed typical macro cell power.
- FSPL Physics Validation — Compares actual signal strength against Free Space Path Loss predictions.
- Signal Variance Analysis — Analyzes signal standard deviation to distinguish moving towers from stationary ones.
- Environment-Aware Estimation — Adjusts distance predictions based on urban, suburban, or rural signal profiles.
- Signal Outlier Detection — Identifies erratic signal patterns that deviate from standard cellular propagation.
- Path Loss Anomaly — Detects mismatches between signal quality (RSRQ/SINR) and raw strength (RSRP).
- Carrier Aggregation Consistency — Validates multi-carrier configurations for anomalies in secondary cells.
- Bandwidth Mismatch — Flags inconsistencies between reported channel bandwidth and actual throughput.
- SINR/RSSI Correlation — Analyzes the relationship between signal-to-noise ratio and received strength.
- Suspicious Timing Advance — Monitors TA fluctuations that suggest a tower is adjusting its virtual distance.
- Neighbor Masking — Flags towers reporting zero neighbors despite having an extremely strong signal.
- Neighbor Count Instability — Detects significant, sudden drops in available neighboring cell counts.
- Connection Stalling — Identifies "blackhole" towers that accept connections but do not route data.
- Failure Loop Detection — Flags towers that trap devices in a cycle of repeated registration failures.
- Silent Connection Drop — Detects stealthy disconnects triggered by network-level commands.
- "Follower" Detection — Identifies towers that maintain constant signal strength while the user is moving (Moving Tower Attack).
- Data Interception Warning — Flags strong signals that provide no internet connectivity (potential MitM).
- Protocol Downgrade (5G→2G) — Detects forced fallback to weaker, less secure legacy protocols.
- NULL Cipher Detection — Flags the use of unencrypted communication (EEA0, 5G-NULL).
- Cipher Suite Validation — Validates the strength of active encryption algorithms (AKA, AKA').
- Handshake Parameter Anomaly — Identifies missing or malformed parameters during network registration.
- LAC/CID Pattern Analysis — Detects non-standard numbering sequences used by rogue equipment.
- PCI/EARFCN Consistency — Cross-references Physical Cell ID with frequency channels for spoofing.
- RIL Event Analysis — Monitors the Radio Interface Layer for low-level system warnings.
- Handover Trigger Analysis — Evaluates the legitimacy of tower-initiated handover requests.
- Real-Time Logcat Analysis — Parses system logs for hidden threat indicators (requires READ_LOGS).
- Silent SMS (Class 0) Detection — Detects stealthy "ping" messages used for device tracking.
- Identity Request (IMSI) Detection — Flags unsolicited requests for device identity parameters.
- Sensor Abuse Monitoring — Detects unauthorized attempts to access camera or microphone.
- Privacy Leak Detection — Monitors for system-level resource access during suspicious connections.
- Boot-Time Activity Audit — Inspects background service persistence for malicious behavior.
- Service State Machine Validation — Ensures core detection services have not been tampered with.
- Multi-SIM Cross-Validation — Compares network data across multiple SIM slots for inconsistencies.
REMOVED
- Cell tower info — CID, LAC, MCC, MNC, signal metrics (for detection)
- Location — To validate tower positions (stored locally)
- SMS (optional) — Reads headers only to detect silent SMS
- ❌ No cloud sync or external servers
- ❌ No analytics, crash reporting, or tracking
- ❌ No data sharing with third parties
- ❌ No external tower databases
- ❌ No historical alert logs (alerts are ephemeral)
- ❌ No export/save functionality
Data Storage: All data remains on your device in standard SQLite format (User-Controlled Plaintext Storage). No encryption is used, ensuring full transparency and user sovereignty over their security data.
REMOVED
Cymatune is proprietary, source-available software owned by M/s TERALIDARIUM WORKS and licensed under the Cymatune Source-Available License (CSAL) v1.0 (LicenseRef-Cymatune-CSAL-1.0).
- Permitted: Personal individual security use (self-compiled on your own device) and non-commercial academic/security research.
- Strictly Prohibited Without a Commercial License: Any commercial use, internal business/enterprise/newsroom/government deployment (including manual IT sideloading), competing apps/SDKs, app store redistribution (even free of charge), algorithmic porting/extraction of the 42 detection methods, or AI/ML model training.
- Permanent Protection: Unlike time-delayed licenses (such as FSL/BSL), CSAL v1.0 restrictions are permanent and never convert to open source.
- Trademarks & Contributions: See TRADEMARKS.md for brand/package-ID restrictions and CONTRIBUTING.md for our Contributor License Agreement (CLA).
- Commercial & Enterprise Inquiries: Contact
legal@lidarium.com
- AndroidX (Apache 2.0)
- Material Components (Apache 2.0)
- Kotlin Coroutines (Apache 2.0)
- Room (Apache 2.0)
All detection algorithms, heuristics, scoring architecture, and implementations are original proprietary work with no GPL contamination.
REMOVED
Cymatune is a detection tool for research and personal security.
Limitations:
- Cannot guarantee 100% detection of all IMSI catchers
- May produce false positives/negatives
- Cannot block or prevent surveillance
- Effectiveness varies by device, network, and attack sophistication
Not Tested Against:
- Real-world IMSI catchers in controlled environments
- All evasion techniques
- Every cellular configuration
Use Responsibly: For personal security only. Do not use for illegal surveillance or unauthorized monitoring.
REMOVED
- Issues: GitHub Issues
- Repository: https://github.com/lidarium/Cymatune
REMOVED
Made for privacy and security research