Captive Portal Security Measures

Question

I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they were previously added to the table via MAC address. A website is hosted on the same machine, which uses a Node JS process to add the device MAC address to the tables once the user accepts terms and conditions.

I know for people with adequate knowledge it's not hard to grab someone's MAC address that's already authenticated and spoof it to access the network. What are some security measures to prevent this from happening and is there anything else I should consider.

Ps.: this is not in production at this stage and since it's designed to cover free wireless AP's.

Answer 1

Depending on how your wireless network is set up if you could detect the same MAC on different access points communicating at the same time then it could be spoofed.

If this is detected you could then try and re-authenticate the user, but as soon as the legitimate user authenticates the malicious spoofer will be granted access again. It might be annoying to the user if they happen to be on a coverage boundary between two APs and is flipping between them.

You could also look at other identifiers such as differing TTL values on packets etc to try and identify the legitimate user but it gets involved. How much do you really care?

If you really don't want people to spoof their way on to a network perhaps look at username and password protection using EAP and a RADIUS server, but delivering credentials to the user in the first place is an additional step in the on-boarding process.