SIGINT MONITORING STATION // SITE 7-ALPHA ● REC
CAM-01 // CELL TOWER 0x1A3F
IMEI TRACKING
35674108372408
CARRIER: REGISTERED
STATUS: LOCATED
● TRACKING
CAM-02 // WIFI PROBE CAPTURE
BSSID GEOLOCATION
94:83:C4:A1:B2:C3
WIGLE DB: MATCH
LAT: 48.8566 LON: 2.3522
● LOGGING
CAM-03 // UPSTREAM AP
MAC CORRELATION
94:83:C4:XX:XX:XX
SESSIONS: 47
LOCATIONS: 12
● CORRELATING
CAM-04 // CLIENT ENUMERATION
DEVICE INVENTORY
42 DEVICES LOGGED
FLASH: /etc/oui-tertf
FORENSIC: READY
● RECORDING
DATA RETENTION ACTIVE // ALL IDENTIFIERS STORED SUBJECTS: IDENTIFIABLE

SIGNAL LOST

ALL IDENTIFIERS ERASED

REC
MASS SURVEILLANCE IS NOT SECURITY // 5.3 BILLION CELLPHONE RECORDS COLLECTED DAILY // DATA RETENTION: THEY STRUCK DOWN THE LAW BUT KEPT THE INFRASTRUCTURE // STINGRAY IMSI CATCHERS IN 27 US STATES // 802 MILLION WIFI NETWORKS IN WIGLE DB // THEY CALL IT METADATA. WE CALL IT YOUR LIFE. // PRIVACY IS NOT NEGOTIABLE // MASS SURVEILLANCE IS NOT SECURITY // 5.3 BILLION CELLPHONE RECORDS COLLECTED DAILY // DATA RETENTION: THEY STRUCK DOWN THE LAW BUT KEPT THE INFRASTRUCTURE // STINGRAY IMSI CATCHERS IN 27 US STATES // 802 MILLION WIFI NETWORKS IN WIGLE DB // THEY CALL IT METADATA. WE CALL IT YOUR LIFE. // PRIVACY IS NOT NEGOTIABLE //
red-merle
cellular identity erasure // gl-e750 mudi
Every cell tower logs your IMEI. Every WiFi probe leaks your history.
Every carrier stores your location under data retention laws.
They call it national security. We call it mass surveillance.
Privacy is not a privilege. It is a right they chose to violate.
001

The problem

Your Mudi broadcasts four unique identifiers every second. Each one is a thread. Pull any thread and you unravel the user: IMEI ties them to a device, BSSID pins them on a map, MAC links their sessions, client DB inventories their contacts.

002

Attack surface

IMEI

Hardware serial. Persists across SIM swaps. Retained by carriers. Links all identities to one device.

BSSID

In every beacon frame. Indexed by WiGLE, Google, Apple. Passive collection = GPS coordinates.

WAN MAC

Visible to upstream APs. Static across reboots. Correlates sessions across locations.

Client DB

Every connected device logged to flash. Seizure = complete device inventory.

Carrier GPS

LPP/SUPL/RRLP: carrier silently requests your coordinates. Modem responds without user consent.

System logs

syslog, dmesg, shell history. Device seizure reveals full IMEI change history with timestamps.

003

Countermeasures

VectorExposureAction
IMEICarrier trackingBand-aligned TAC prefixes + Luhn-valid serial (random.choices, 10^6 keyspace)
BSSIDGeolocation DBsRandomized every boot
WAN MACAP loggingRandomized every boot
Client DBDevice seizureShredded + tmpfs (RAM only)
Carrier GPSSilent locationLPP/SUPL/RRLP disabled at boot via AT+QGPSCFG
LogsForensicssyslog, dmesg, shell history wiped at boot, after IMEI change, and at shutdown
DNSSession correlationdnsmasq cache flushed after IMEI change
004

Procedure

root@mudi● live
005

Deployment

localbuild
$ git clone https://github.com/franckferman/red-merle.git $ cd red-merle # Quick build (no SDK needed) $ ./build.sh # Build with OpenWrt SDK (same as CI) $ ./build.sh sdk-build # Build + deploy to Mudi via SSH $ ./build.sh install
006

Lineage

Fork of blue-merle
(Security Research Labs, 2022)

Fixes: TAC/band fingerprinting (Issue #1), IMEI entropy loss (random.sample), syslog IMEI leak, carrier GPS tracking (LPP/SUPL/RRLP)

by Franck FERMAN

download source readme

AUTHORIZED USE ONLY

For journalists, activists, and researchers under surveillance threat.
IMEI modification may violate local law.

franckferman