How to change your IMEI and spot fake cell towers with Blue Merle and Raypager

This is an Advanced guide. It involves connecting to a small computer with typed commands. Take your time, and read the warnings first. Everything here is aimed at protecting your own privacy.

Check the law first. In some countries it is a crime to change a device's IMEI (for example in the United Kingdom, and in several other countries). Never use this to hide a stolen device or to avoid a block. Raypager's own page says it is for authorized security research and counter-surveillance only. You are responsible for following the laws where you live.

What these words mean

• IMEI is a serial number built into a phone or modem. Every time you connect to a mobile network, the network sees it.
• IMSI is the number stored on your SIM card that identifies your subscription.
• Together they let a network, or someone who watches it, follow a particular device and SIM around, even if you swap one for the other. Changing the IMEI when you change SIM stops the old and new SIM from being tied together by the device.
• An IMSI catcher (also called a "stingray" or fake cell tower) pretends to be a normal mobile tower so that nearby phones connect to it. It can be used to track people or capture data.

What you will use

• GL-E750V2 "Mudi V2": a portable 4G Wi-Fi router from GL.iNet. It has a mobile modem in it. Your phone connects to the Mudi's Wi-Fi, and the Mudi connects to the mobile network.
• Blue Merle: a free tool from the security company SRLabs that changes the Mudi's IMEI and wipes some identifying data. It is open source.
• Raypager: a free tool that checks the mobile tower the Mudi is connected to and warns if it looks fake. It also links to Blue Merle so you can rotate the IMEI.
• Optional: a WiFi Pineapple Pager (used as a small screen and controller for Raypager) and a u-blox GPS USB dongle (so it can compare the tower's known position with your real position). You can set up Blue Merle without these.

Before you start

1. Charge the Mudi and put in a SIM card.
2. You need a computer to type the commands. On Windows you can use PowerShell or the free tool PuTTY. On Linux and Mac use Terminal.
3. The Mudi's first Wi-Fi name and password are printed on the box or under the battery cover.
4. Check Blue Merle supports your exact Mudi and software version. SRLabs says Blue Merle 2.0 was tested on the original GL-E750 Mudi with firmware 4.3.8 to 4.3.12, and says they do not promise it works on newer firmware. Raypager lists the GL-E750V2 as its target. Open the Blue Merle page and Raypager page and read what they say about your firmware before you install anything. If your version is not listed, ask in their GitHub "Issues" section first.
5. Do not use your only router for this while travelling. If something goes wrong, you want a spare way to get online.

Part 1: Connect to the Mudi

1. On your computer, join the Mudi's Wi-Fi network.
2. Open a web browser and go to 192.168.8.1. Create the admin password when asked. Make it long and different from your other passwords.
3. In the same screen, check the firmware version (look under the system or upgrade section).

Part 2: Install Blue Merle

These steps follow the official Blue Merle page. The file names change between versions, so use the names shown there.

1. On your computer, download the latest Blue Merle .ipk file from the Blue Merle releases.
2. Copy it to the Mudi. In your terminal type: scp -O blue-merle_2.0.0-0_mips_24kc.ipk root@192.168.8.1:/tmp (use the exact file name you downloaded). Enter your Mudi admin password when asked.
3. Connect to the Mudi: ssh root@192.168.8.1 and enter the password.
4. Install it: opkg update and then opkg install /tmp/blue-merle*.ipk. The Mudi needs an internet connection for this step. There is also an offline version on the same page.
5. If the tool asks to update the Mudi's small controller (MCU) software, allow it. Blue Merle needs MCU version 1.0.7 or newer.
6. Reboot the Mudi.

Part 3: Change the IMEI

You can do this in three ways. The easiest is the web page.

1. Join the Mudi's Wi-Fi and open 192.168.8.1.
2. Go to the Network menu and press the SIM Swap button. This sets a random IMEI.
3. When asked, shut the Mudi down, swap the SIM card, and move to a different place before turning it on again.
4. Turn it on and let it connect.

How it works, in simple words: Blue Merle switches the mobile radio off first, so your old IMEI is not sent to the network while you swap, then writes a new random IMEI into the modem. The internet connection drops while this happens and comes back after a restart.

The toggle switch on the side of the Mudi can also do this in two steps. The first step starts the SIM swap and the second sets the IMEI and powers the device off. Read the Blue Merle page for the exact meaning of each switch position before you use it.

Why change place?

If you turn on a new SIM and new IMEI in the same place where the old ones were last seen, a watcher can still guess they are the same person. Moving away makes that link weaker.

Other things Blue Merle does

It also wipes the list of devices that connected to the router and randomizes the router's network identifiers on each start. These happen on their own.

Part 4: Install Raypager (optional)

Raypager reads information about the mobile tower the Mudi is using and compares it with the free OpenCelliD database of known towers. If the tower is not where the database says, or is unusually strong, or forces you down to old 2G/3G, you get a warning.

You will need a free OpenCelliD API key. Create an account on the OpenCelliD website to get one.

On the Mudi (type these one at a time after ssh root@192.168.8.1):

1. opkg update && opkg install python3 curl
2. git clone https://github.com/tschakram/raypager.git /root/raypager. If git is missing, install it with opkg install git git-http first. Or download the files on your computer and copy them over with scp.
3. cd /root/raypager
4. cp config.example.json config.json
5. Open the settings file with vi config.json and fill in your OpenCelliD key and the Mudi values shown in the file. (In vi, press i to type, then Esc and :wq and Enter to save.)
6. mkdir -p /root/loot/raypager/reports /root/loot/raypager/upload_queue
7. Turn on the mobile data connection: gl_modem -B 1-1.2 connect-auto. Raypager's page says this is needed after every restart.

If you use the WiFi Pineapple Pager as the screen:

1. Join the Pager's Wi-Fi client to the Mudi's Wi-Fi.
2. On the Pager, create a key: ssh-keygen -t ed25519 -f /root/.ssh/mudi_key -N ""
3. Copy the public key (/root/.ssh/mudi_key.pub) into the Mudi file /etc/dropbear/authorized_keys.
4. Copy Raypager's payload.sh into /root/payloads/user/reconnaissance/raypager/ on the Pager, make it runnable with chmod 755, and create the Pager's own config.json with the Mudi address, user, key path and Python path, as shown on the Raypager page.

Part 5: Understand a Raypager result

Raypager gives each scan a level:

A warning is not proof. Towers get moved and databases are out of date. Treat it as a reason to be careful: stop sending sensitive things, move to another place and scan again.

Good habits

• Change the IMEI together with the SIM, never on its own. See Part 3.
• Pay for the SIM and the Mudi in a way you are comfortable with. Your payment can identify you even if the IMEI does not.
• Do not log in to accounts that already know who you are on the Mudi. Doing so links the new IMEI to you.
• Keep the Mudi software updated, but check the Blue Merle page before updating, because updates can break it.
• Use a VPN on the Mudi too. See why use a VPN router.

If something goes wrong

• Mudi will not connect to the internet after the change: restart it. Blue Merle says the connection only returns after a restart by default.
• Cannot reach 192.168.8.1: check you are on the Mudi's Wi-Fi and not another network.
• **The scp command fails:** add -O as shown above, and check the file name.
• Everything stopped working after a firmware update: this is the known risk. Ask on the project's GitHub Issues page.

Credits: Blue Merle by SRLabs (github.com/srlabs/blue-merle) and Raypager by tschakram (github.com/tschakram/raypager). We have not tested this on every firmware version, so please test on a spare setup first.