The speculation about how they do it is to measure the TCP TTL. If it's off by one from what you expect, then the packet originated with a tethered device, rather than the native device.