6

You hear about black hats working from coffeeshops on public WiFi, but I'm wondering how you would be able to completely mask your IP when doing this. I realize you would obviously use a VPN, but before you can do this, you need to make a connection to WiFi, where your MAC address is going to be used during this initial setup.

Because of this, wouldn't there be evidence of traffic from your IP on this network right before connecting to a VPN? Or is there some way around this that I'm not thinking about? Basically wondering how a black hat would actually hide every trace of their IP, or if this is even possible?

This answer discusses this chicken and egg problem somewhat.

Improve this question
2
  • When connecting to a wifi you are assigned a ip address by the router, but what you would want is hide you MAC address. Because MAC-addresses is used to route traffic within a LAN. What exactly do you mean by "real ip"?
    – JoakimE
    Commented Mar 13, 2017 at 7:46
  • 1
    I advise you to edit the title of your question, so that it would be found by readers with a possible right answer to the right problem, and wouldn't be found by readers with a right answer to a wrong problem.
    – athena
    Commented Mar 13, 2017 at 16:42

3 Answers 3

Reset to default
11

You are going to want to research Public vs Private IP address.

Note: Before you connect to their network you have NO ip address(assuming you are not connected to another network at that time).

Let's say you are at a coffee shop and you want to connect to the Wifi. The coffee shop has a public ip address and when you connect to the Wifi hotspot, it is going to assign you a private IP address. This private IP address can be assigned to a different user later when you are done using it. So when it comes to hiding your identity before connecting to a Wifi hotspot you are going to want to change your MAC address also called MAC spoofing. (Note: MAC addresses work at Layer 2 and IP addresses work at Layer 3).

This is because some Wifi hotspots or businesses can keep track of which MAC address was assigned to which private IP address and since MAC addresses are unique to every device, they can use this to associate your computer being connected to that private IP at that time.

Also research Layer 2 vs Layer 3 in the TCP/IP hybrid model.

Hope this helps!

Improve this answer
9
  • 1
    MAC addresses SHOULD be unique per device, but I have seen some vendors selling multiple devices with the same MAC address
    – Mr. E
    Commented Mar 13, 2017 at 15:49
  • In Windows, you automatically are still given an IP Address when not connected to a network. techrepublic.com/forums/discussions/…
    – Ryan Kelso
    Commented Mar 13, 2017 at 17:42
  • 1
    @RyanKelso that's when your computer can't find a DHCP server and doesn't really apply here. The wifi hotspot is going to act as a DHCP and if your computer is assigned the 169..... address that means it can't get a IP address from the hotspot and therefore is not going to be connected to that network.
    – nd510
    Commented Mar 13, 2017 at 18:48
  • @Mr.E interesting, usually vendors are assigned an EUI identifier but never heard of the same mac being used. Do you remember what kind of devices they were selling?
    – nd510
    Commented Mar 13, 2017 at 18:50
  • 2
    @RyanKelso Okay sure you have 169 address but that does not apply to his question because this random ip address generated by the computer, not the network, is NOT going to be used to identify you so its completely irrelevant to what he is asking and is only specific to Windows. If you feel the 169 is so relevant to his question, then answer the question yourself.
    – nd510
    Commented Mar 13, 2017 at 19:42
-1

Edited.

Yes, an answer to the question you linked provides a possible solution which is to block all outgoing traffic with a firewall, until a VPN connection has been set up.

I have similar rules for my desktop which kills certain applications if the VPN suddenly disconnects.

But whether you do not pass ANY information, even with the aforementioned solution, I'm unsure of. This could be tested with WireShark perhaps.

Improve this answer
2
  • A question about MAC addresses not having a single mention of them in your answer is why you are getting downvoted.
    – whatever489
    Commented Mar 14, 2017 at 19:31
  • I completely missed that! I wonder if the title+question has been edited. Thank you for the feedback thou - I'll be more thoughtful of such matter in the future nevertheless.
    – Tobias Andersen
    Commented Mar 14, 2017 at 20:29
-1

In addition to the information provided by others, I'll add that you are best off not accepting DHCP leases from such networks. Using a trivial DHCP starvation attack (dhcdrop, dhcpstarv, scapy) anyone can take over and serve leases => route, DNS servers, by running their own DHCP server. Use netdiscover (in e.g. Ubuntu repo) to discover the network range, and OpenDNS/Google DNS, and a static configuration. Add a VPN configuration as well, and use a firewall rule to use only the VPN virtual network (e.g. tun0) interface to route your traffic out.

Have a look at the attacks made possible with the wifi pineapple.

And additionally, avoid entering any password you use elsewhere into a public wifi's captive portals.

Improve this answer
2
  • When down-voting, it's a good idea to say why.
    – user400344
    Commented Mar 13, 2017 at 20:15
  • 2
    Not the one who down voted, but your answer doesn't really address the question.
    – 123
    Commented Mar 13, 2017 at 23:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .