Tag Info

Hot answers tagged

17

MAC addresses are link-local only. Most attacks don't (have to) come from the same subnet, so most rely on higher-layer addressing. Changing your mac address does little to hide you. There are a variety of problems with changing your MAC address often. One, off the top of my head, would be that DHCP reservations wouldn't work. It could be marginally less ...


14

MAC addresses are supposed to be unique worldwide, so that no two devices use the same MAC address. This matters when several devices are on the same link: if two devices have the same MAC address, things do not work well at all, in a hard-to-diagnose way. It is possible to force that by changing your MAC address, but then you did it on purpose; with a ...


11

The question in the original title of your post ("Can a website still detect my real MAC address even if I use different virtual machine each time I visit the website?") is different than the question in the body of your post. To the question in the original title: No, a website should never be able to "detect" your MAC address, under any circumstances. ...


7

MAC addresses are not usually available outside of your local network so that won't be an issue. If you use a different VM it could be possible to fingerprint you if you're just cloning the same base machine repeatedly (e.g. panopticlick), however if you use different base machines, then the only likely way to identify you (assuming you don't authenticate ...


7

Common cases for MAC spoofing alarms are: virtual machines being cloned or reconfigured people pulling the plug to connect notebooks DHCP recycling ip addresses loading different firmware on network cards (especially wireless cards) (rarely) bit flipping in the PROM of the network card. It would be interesting to know, if those alarms are for miss ...


7

Whilst at the moment (as mentioned in other answers) MAC addresses are generally link local (although there are some protocols which leak that information to remote networks), it's interesting to note that when IPv6 becomes more prevalent MAC addresses are likely to be more important. A common way of constructing an IPv6 host address is to include the MAC ...


7

If you don't broadcast the SSID it takes some monitoring of traffic with Kismet, but it will eventually pick it up. The more traffic actually going across the wifi, the faster it will identify it. Mac filtering can be bypassed multiple ways, by being patient, or by flooding a device with garbage. The second can be done with a jammer and a directional ...


6

There is no effective way to prevent a dedicated attacker from creating multiple accounts. No matter what you do, the attacker will still be able to create multiple "sock puppet" accounts. The best you can do is raise the cost of creating additional accounts. One approach is to require the user to provide a mobile phone number, authenticate the user's ...


6

It has a downside in enterprise environments - switches optimise traffic flow by various methods, including remembering which port traffic from a particular MAC address comes in - so that traffic back to that MAC is only sent out that port. MAC tables are updated in switches as new data comes in, but changing MAC addresses all the time would add ...


5

802.1x-2010 will provide authentication to the network switch and encrypt traffic exchanged. Older 802.1x specifications do not encrypt traffic. IPsec can be a useful solution or layer on top of older 802.1x, but the increase in configuration work to allow only desired clients may be notable.


5

I see one good defensive value of routinely changing the MAC address for your wireless card when using laptop. Even when using encryption, your client mac address is leaked out in the air whenever your laptop is turned on. When it probes for known access points, or sending traffic to associated access-points. An attacker can track a victim by setting up ...


5

I suppose it depends on what problem you are trying to solve. If you are trying to maximize your anonymity then yes, I could see MAC address randomization as a part of a larger solution focused on remaining anonymous. I could imagine a scenario where a vulnerability existed in a given vendor's NIC firmware and by targeting a vendor's NICs by their MAC ...


4

In wireless networks, the signals travel through the air; anybody can listen to them and capture the source MAC address. Therefore, it's easy for an attacker to find out the white-listed MAC addresses and impersonate them. Think of it this way: A group of friends talking to each others, and they only talk to people they know. When one of them says ...


4

I see your solution as security through obscurity, it is really not that important to change your mac address after each bootup. But I can see it from your perspective, people mapping the networks and such, will have a "huge list" of computers suddenly, from all sorts of vendors (Depends on how often you reboot your pc). And thus, will make it harder for him ...


4

To sumpplement D.W.'s excellent answer... You can't read the MAC address of a client across a router. A MAC adress can easily be changed (so easy it doesn't even dserve the 'spoofed' epiphet). A browser user agent is not unique and again trivial to change. The only 'Computer name' you'll see at server end is the DNS PTR record for the IP address - hence ...


3

It is really that simple, if the AP has a MAC filter, any device which attempts to authenticate that doesn't have a MAC address on the list will just be denied. However the problem from a security perspective (which is why this should not be used as a security function) is that it is trivial to spoof a valid MAC address (by sniffing them wirelessly and ...


3

According to my research on the subject, and running tests there are no quick fixes for tracking the source individual perpetrating this type of attack because of the nature of it. Meaning tracking, but not filtering/blocking. The attack method itself is basically easy to do compared to the scale of other types of attacks out there due to fundamental flaws ...


2

Using a different VM means you're using a different computer, so theoretically you're a different person. If they DO identify you as the same individual, they are potentially doing so incorrectly -- or at least would be incorrectly assuming OTHER unique users are actually the same person. The way they would almost certainly be doing such grouping is by IP ...


2

Partially, yes. Windows OS (eg. using ipconfig command) sees the spoofed MAC address as the permanent MAC address. However you can NOT say all of the applications running on Windows will see the spoofed one as the permanent one. Applications might be using some ways to acquire the permanent (burned-in) MAC address of the adapter. (For instance they might be ...


1

Switches, Hubs, and Broadcast In old-style ethernet networks connected with a hub, all packets were broadcast to all stations on the network. This is also the way wireless networks typically act today. But in order to improve network performance, switches have largely replaced hubs in connection stations together. Once a switch sees a packet originating ...


1

If the above answer doesn't help, if I remember correctly this router has the ability to perform MAC address filtering (?) you may want to check that this is either turned off, or compatible with the MAC address you are choosing.


1

You might find the solution to your problem in this answer on superuser: Some more information on a big related to your issue here.


1

If you've spoofed someone else's MAC address and they're on the network with you chances are you've received the same IP address and are causing enough collisions that the all transferred frames are being dropped or are timing out. If 2 devices try to transmit at the same instant, the transmit collision is detected, and both devices wait a random (but ...


1

I am not sure of any commercial implementation, but I saw an interesting idea that you can track physical proximity using signal strength, which AP, etc and determine that if the location suddenly is very different, that is likely a spoofer. I also found an interesting paper on spoofing detection using a fingerprinting technique. The captive portal will be ...


1

You are correct that MAC addresses are easily spoofed, and should never be used as a strong measure of identity. I'd guess IPsec or RADIUS would be your best bet here, but any kind of strong authentication and integrity checking between the legitimate client and the server would work.


1

In Windows vista and above, the OS allows change to specific MAC addresses only, which are, the addresses starting with 2A. However, as far as I know, there is no such limitation in Linux. I suggest you try to spoof your MAC again in windows, this time choose an address starting with 2A and see if it works this time. EDIT: It doesn't have to be exactly 2A. ...


1

If you are looking for a tool to do that on windows check this one : http://www.irongeek.com/i.php?page=security/madmacs-mac-spoofer


1

I'd try making multiple accounts less attractive alternative than having a single account. Maybe have users accumulate privilege like SO through good behavior (new accounts have little privilege but can do very little) so the effect of the ban is losing all privileges? Possibly only do silent bans, so banned users aren't aware they've been banned, but ...


1

Can an attacker eavesdrop on Ethernet data, if they can connect to it? Yes. An attacker who is physically connected to your Ethernet network can probably eavesdrop upon all of the packets sent upon that local-area network. You might think that switched Ethernet would prevent that, but in fact on many/most Ethernet switches, it does not. An attacker can ...



Only top voted, non community-wiki answers of a minimum length are eligible