Clutch: Cellular Security Monitor
Your Phone Trusts Every Tower
Every day, your phone scans for cell towers. Finds the strongest signal. Connects automatically.
No questions asked. No verification. Just trust.
The problem: Some of those towers are fake.
IMSI catchers (StingRays) impersonate legitimate cell towers. Your phone connects. Now law enforcement (or whoever deployed it) can:
- Track your location in real-time
- Intercept calls and messages
- Force encryption downgrades (4G → 3G → 2G)
- Identify everyone at a protest, conference, or location
Your phone doesn't warn you. It just connects.
Clutch warns you.
What This Does
Real IMSI Catcher Detection:
- Signal pattern analysis (tower behavior anomalies)
- Technology downgrade alerts (4G suddenly dropping to 2G)
- Machine learning threat classification
- RF fingerprinting (identifying fake towers by signature)
Professional Signal Analysis:
- Signal strength monitoring (unusual power levels)
- Timing advance analysis (distance calculation)
- Encryption tracking (which protocols active)
- Power consumption spikes (indicator of active interception)
Coordinated Threat Intelligence:
- Multi-device correlation (multiple phones seeing same fake tower)
- Geographic clustering (threat maps)
- Remote monitoring server (optional, encrypted)
- Real-time threat sharing (warn other users)
- Historical analysis (track deployment patterns)
No Permission Bullshit:
- All threat detection happens on your device
- No cloud dependency (unless you enable remote sharing)
- Encrypted communication for coordination
- No content interception, no personal data collection
Why This Exists
Traditional "security" solutions:
- Expensive hardware ($3,000+ spectrum analyzers)
- Academic tools (broken links, unmaintained repos)
- Fake apps (placebo security theater)
- Government spyware (literally the threat you're detecting)
Clutch is open-source.
Built for journalists covering protests. Activists organizing movements. Security professionals doing pentests. Anyone who needs to know if their phone is being surveilled.
Who Uses This
Journalists covering protests:
- Detect StingRays deployed at demonstrations
- Know when surveillance is active
- Coordinate with other journalists (shared threat intel)
Activists organizing:
- Identify surveillance patterns
- Plan routes avoiding known deployment areas
- Document government overreach
Security professionals:
- Pentest cellular infrastructure
- Audit client security posture
- Train clients on surveillance detection
NOT for:
- Committing crimes (defensive tool only)
- Violating laws (comply with local regulations)
- Paranoia without cause (know your threat model)
Technical Architecture
iOS App (Swift + CoreTelephony):
- Real cellular API access (not fake readings)
- Machine learning threat classification
- WebSocket client for coordination
- Location services for geographic clustering
- Local SQLite database (no cloud required)
Python Backend (Optional):
- Multi-platform data collection (if running coordination server)
- Advanced RF analysis algorithms
- ML model training pipeline
- Threat database aggregation
Remote Coordination Server (Optional):
- WebSocket server (encrypted connections)
- Device authentication (no anonymous submissions)
- Coordinated attack detection (multiple phones → same fake tower)
- Geographic threat correlation (map deployment patterns)
- Historical analysis (track surveillance over time)
Installation
# Clone the repo
git clone https://github.com/ghostintheprompt/clutch
cd clutch
# Run quick start (sets up dependencies)
./quick_start.sh
# Open iOS app project
open iOS-App/NetworkSecurityMonitor.xcodeproj
# Build and run on device (requires Apple Developer account)
# Simulator won't work - needs real cellular hardware
Requirements:
- iOS 14+ device (real hardware, not simulator)
- Xcode 12+ (for building)
- Apple Developer account (for code signing)
- Python 3.8+ (optional, for backend/coordination server)
Usage
Basic monitoring:
- Launch app on device
- Go to Cellular tab
- Tap "Start Monitoring"
- Watch for threat alerts
What to watch for:
- Red alerts = High confidence threat (likely IMSI catcher)
- Orange alerts = Suspicious behavior (investigate)
- Technology downgrades (4G → 2G = major red flag)
- Power consumption spikes during idle
- Signal timing anomalies
Coordination mode (optional):
- Deploy coordination server (Python backend)
- Configure server URL in app settings
- Enable remote sharing
- See threats detected by other users in area
Real-World Detection Example
Scenario: Covering protest in downtown area.
Normal behavior:
