Tag Info

MAC addresses are link-local only. Most attacks don't (have to) come from the same subnet, so most rely on higher-layer addressing. Changing your mac address does little to hide you. There are a variety of problems with changing your MAC address often. One, off the top of my head, would be that DHCP reservations wouldn't work. It could be marginally less ...

MAC addresses are supposed to be unique worldwide, so that no two devices use the same MAC address. This matters when several devices are on the same link: if two devices have the same MAC address, things do not work well at all, in a hard-to-diagnose way. It is possible to force that by changing your MAC address, but then you did it on purpose; with a ...

Common cases for MAC spoofing alarms are: virtual machines being cloned or reconfigured people pulling the plug to connect notebooks DHCP recycling ip addresses loading different firmware on network cards (especially wireless cards) (rarely) bit flipping in the PROM of the network card. It would be interesting to know, if those alarms are for miss ...

If you don't broadcast the SSID it takes some monitoring of traffic with Kismet, but it will eventually pick it up. The more traffic actually going across the wifi, the faster it will identify it. Mac filtering can be bypassed multiple ways, by being patient, or by flooding a device with garbage. The second can be done with a jammer and a directional ...

802.1x-2010 will provide authentication to the network switch and encrypt traffic exchanged. Older 802.1x specifications do not encrypt traffic. IPsec can be a useful solution or layer on top of older 802.1x, but the increase in configuration work to allow only desired clients may be notable.

Whilst at the moment (as mentioned in other answers) MAC addresses are generally link local (although there are some protocols which leak that information to remote networks), it's interesting to note that when IPv6 becomes more prevalent MAC addresses are likely to be more important. A common way of constructing an IPv6 host address is to include the MAC ...

There is no effective way to prevent a dedicated attacker from creating multiple accounts. No matter what you do, the attacker will still be able to create multiple "sock puppet" accounts. The best you can do is raise the cost of creating additional accounts. One approach is to require the user to provide a mobile phone number, authenticate the user's ...

I see one good defensive value of routinely changing the MAC address for your wireless card when using laptop. Even when using encryption, your client mac address is leaked out in the air whenever your laptop is turned on. When it probes for known access points, or sending traffic to associated access-points. An attacker can track a victim by setting up ...

I suppose it depends on what problem you are trying to solve. If you are trying to maximize your anonymity then yes, I could see MAC address randomization as a part of a larger solution focused on remaining anonymous. I could imagine a scenario where a vulnerability existed in a given vendor's NIC firmware and by targeting a vendor's NICs by their MAC ...

It has a downside in enterprise environments - switches optimise traffic flow by various methods, including remembering which port traffic from a particular MAC address comes in - so that traffic back to that MAC is only sent out that port. MAC tables are updated in switches as new data comes in, but changing MAC addresses all the time would add ...

To sumpplement D.W.'s excellent answer... You can't read the MAC address of a client across a router. A MAC adress can easily be changed (so easy it doesn't even dserve the 'spoofed' epiphet). A browser user agent is not unique and again trivial to change. The only 'Computer name' you'll see at server end is the DNS PTR record for the IP address - hence ...

However what if a computer is connected via Ethernet and does not ask for an IP address? What can they skim off the network with a standard network card? I think you're asking if it's possible, like it is on a wireless network, to connect to a wired network and sniff packets just like the likes of aircrack allow for promiscuous mode wireless traffic. ...

I see your solution as security through obscurity, it is really not that important to change your mac address after each bootup. But I can see it from your perspective, people mapping the networks and such, will have a "huge list" of computers suddenly, from all sorts of vendors (Depends on how often you reboot your pc). And thus, will make it harder for him ...

It is really that simple, if the AP has a MAC filter, any device which attempts to authenticate that doesn't have a MAC address on the list will just be denied. However the problem from a security perspective (which is why this should not be used as a security function) is that it is trivial to spoof a valid MAC address (by sniffing them wirelessly and ...

If you've spoofed someone else's MAC address and they're on the network with you chances are you've received the same IP address and are causing enough collisions that the all transferred frames are being dropped or are timing out. If 2 devices try to transmit at the same instant, the transmit collision is detected, and both devices wait a random (but ...

I am not sure of any commercial implementation, but I saw an interesting idea that you can track physical proximity using signal strength, which AP, etc and determine that if the location suddenly is very different, that is likely a spoofer. I also found an interesting paper on spoofing detection using a fingerprinting technique. The captive portal will be ...

You are correct that MAC addresses are easily spoofed, and should never be used as a strong measure of identity. I'd guess IPsec or RADIUS would be your best bet here, but any kind of strong authentication and integrity checking between the legitimate client and the server would work.

In Windows vista and above, the OS allows change to specific MAC addresses only, which are, the addresses starting with 2A. However, as far as I know, there is no such limitation in Linux. I suggest you try to spoof your MAC again in windows, this time choose an address starting with 2A and see if it works this time. EDIT: It doesn't have to be exactly 2A. ...

I'd try making multiple accounts less attractive alternative than having a single account. Maybe have users accumulate privilege like SO through good behavior (new accounts have little privilege but can do very little) so the effect of the ban is losing all privileges? Possibly only do silent bans, so banned users aren't aware they've been banned, but ...

I was just about to write a lengthy answer when I remembered I had a lengthy article explaining sniffing in depth even when connected directly to your ethernet cabling. All in all, a great beginners article with some a lot of good stuff. If you have any other questions just shoot em this way. Welcome to security stackexchange. ...