Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
My school has recently asked us to submit our MAC address to the school along with our designated name to be used to connect to the Wi-Fi. Previously this wasn't needed.
I would like to ask about what kind of information that they can collect from this? Would they be able to track our browsing history or more? What if I use Tor Browser? Would it have any effect?
If they can track me, what measures can I take to prevent them from invading my privacy?
I think you should ask why they want to use the MAC address, not necessarily for privacy reasons; "why do you need the MAC Address?" I think it's a reasonable question to ask them.
Firstly, they will have MAC addresses of all the individuals who connect to the WiFi. Any device connecting to the WiFi will reveal their MAC address, based on the ARP protocol.
They may think locking down WiFi to known MAC addresses is a good security measure. It's not really because I can obtain your MAC address if both of us are in the same Starbucks and on the same WiFi. I can then spoof your MAC address quite easily. So from a security measure this is not great.
They may want to track your activity. They can do this already without asking for your MAC, just giving them the MAC address allows them to map it to a individual easier. They can get a history of MAC & IP address from logs and their NAT can keep a history of IP Address & Ports and map back to the MAC address.
If you use Tor, they will be able to say you used Tor, but not the content.
So, I would ask why do you want my MAC address, giving out the MAC address is not going to really affect you. Unless of course on your home WiFi or something else you are using MAC address as a method to identify yourself; as MAC address can be easily spoofed.
For a school, having all student device MAC addresses (unique hardware identifier) is a way to filter out a lot of unwanted traffic from the LAN. Even if outside devices from non-students spoof a legitimate, student-registered MAC, the packets being sent over the network can still be captured, opened, and the user agents, and other system identifiers can be observed. This lets the network admin know if someone is using a spoofed MAC and then the admin can effectively boot that MAC from the access point easily without filtering the specific MAC, which would block the legit student if done, with packet filtering blocks.
Using MAC address registeries helps to keep a check on who is supposed to be connecting and who is not. But it is only a single security method. There are others such as 3rd party proprietary or open source tools that can determine the user agents and many other things such as system hardware specs, OS being used, browser plugins, etc. Even if these things are themselves spoofed. These will identify TOR daemon/browser users as well as identify Tails users (linux OS that sends all system and web traffic through the TOR network).
If you wish to avoid being tracked, you have a few methods:
This is just a small number of ways and not the best methods either. You may find more by doing some research.
Well, the school already has your MAC address since you've connected to their access points in the past. What they don't (necessarily) know is the association between your MAC addresses and your real name.
If that concerns you, just use a different MAC while you are at school:
ip link set dev wlp1 address XX:XX:XX:XX:XX:XX
Pick a Locally Administered MAC to avoid conflicts with devices that are using their manufacturer-assigned MAC on the same AP.
Note that a malicious user would run airodump-ng to discover another student's MAC address, kick that student off the network with aireplay-ng -0, and then use their MAC to impersonate them. If your school thinks that MAC-filtering is good security, they're in for a big surprise!
They might not be thinking of it in terms of tracking measure but as an alternative to giving out WiFi password. MAC address white listing is a pretty common alternative.
If they gave out a WiFi password for logging in nothing is to stop another student from giving those details. Whereas white listing per MAC address prevents this information from being easily passed along.
Of course there is a concern of MAC address spoofing. But to connect to the network with a spoofed MAC address you will need to know a MAC address that already has access. And if the MAC address can be traced back to you then you likely would not want to share this information with a friend. And finally if you spoof once you gave them your MAC address it will only prevent you from connecting.
As far as privacy if they have the technical means to retrieve your MAC address sent from your device to match it to their white list nothing is stopping their firewall from logging additional information and making a match to your mac address. For example, we get an IP returned in our firewall logs. We can just go to our MAC address list and search it for MAC address's that used that IP.
Since they can intercept the traffic they can also get a bird's eye view of known applications you may be using and websites you are browsing. Getting a detailed idea of your activity on the other hand, while possible, is unlikely to happen due to the work involved. So while they might not know the contents of message X they could of known you where on service Y or website Z to send it. Bottom line if privacy is a concern avoid connecting to their network at all. Or at least avoid doing activities on their network that you wish to be private.
I would like to ask about what kind of information that they can collect from this?
Having your MAC address facilitates in analyzing log files.
Network log files often contain an IP address and some information about the connection.
For example, the following fictional log entry would indicate that a device with the IP address 10.10.100.123 connected to a system with the IP address 216.58.210.46 (google.com) on port 443 (HTTPS).
TIMESTAMP | SOURCE IP:PORT | DEST IP:PORT
-----------------------------------------------------------
2016-08-05 12:11 | 10.10.100.123:123456 | 216.58.210.46:443
Further research in other log files (e.g. DHCP leases) could indicate that the internal IP address 10.10.100.123 was handed out to the MAC address 01:23:45:67:89:01.
IP ADDRESS | MAC ADDRESS | LEASE START | LEASE END
-----------------------------------------------------------------------
10.10.100.123 | 01:23:45:67:89:01 | 2016-08-03 09:35 | 2016-08-10 09:35
That MAC address can then be matched to the network adapter of the device of a certain student.
This allows the school, or any authority that is able to request the school's log files (e.g. Law Enforcement agencies), to trace back certain online activities.
If some criminal investigation shows that the public IP address of the school is linked to certain illegal activities, the school could be requested to hand over their log files and list of 'MAC address - student' combinations.
It could also be the case that the school wants to track down which student spent 10% of their bandwidth on browsing 18+ websites.
Whether this information can be used for these reasons depends on local legislation in regards to privacy and computer crime.
Would they be able to track our browsing history or more?
They cannot detect your complete browser history using this information. However, as I explained before, the MAC address could be used to link your device to certain activity on the network.
What if I use Tor Browser? Would it have any effect?
Using Tor does not change anything to the fact that your device's network adapter has a certain MAC address and that this MAC address could be linked to your device and to you.
If they can track me, what measures can I take to prevent them from invading my privacy?
It is fairly trivial to change the MAC address of your device's network adapter(s). Changing your MAC address after having handed them your original one (or providing them with a fake one), makes it more difficult for the IT administrators to link an MAC/IP address to you.
However, if the network requires identification through Active Directory (each student having a unique username to authenticate to the network) or some other form of authentication (e.g. certificate based), they'd still be able to check the logs files to try to match an IP to you.
If the school uses a proxy, they could also sniff web traffic in search for Personally Identifiable Information, such as your email address or Facebook username, ... But I suppose this would be a huge breach of privacy regulations in most countries.
Additional info
It could also be the case that your school wants to implement MAC address based access control on the network, allowing only whitelisted (allowed) MAC addresses to connect to the network.
However, as others have pointed out (and as I have touched upon slightly), MAC addresses can be edited. This allows anyone to change their own MAC address to that of a legitimate student, granting them access to the network.
MAC address based access controls will stop some people from being able to access the network using the password they received from a friend at your school (as they don't have the knowledge/skills to bypass this weak line of defense), but it won't stop those who are determined to access the network.
If the school is serious about wanting to track student's network usage and/or want to limit access to students only, there are much better alternatives available.
One example of this is RADIUS authenticated WiFi.
Extract from: FreeRadius.org
IEEE 802.1X and RADIUS Authentication
The IEEE standards for Wi-Fi (IEEE 802.11) foresee an "Enterprise" mode which is fundamentally different from PSK networks because the Wi-Fi encryption keys are provisioned per user and per session. Every user needs to authenticate with their personal credentials; at that moment a key is generated and is communicated to the user's device and the NAS they connect to.
Before users send their authentication credentials, the the user must authenticate the network, proving that it is indeed genuine; only then is the client's credential released. The IEEE standard IEEE 802.1X (using RADIUS and the Extensible Authentication Protocol, EAP) is used for authentication and key management.
Enterprise Wi-Fi authentication also enables advanced features such as putting users dynamically into a specific VLAN (e.g. separate guest and staff logins into different IP networks even though being on the same SSID), and dynamic ACLs
Enterprise Wi-Fi requires:
- A RADIUS server which can do EAP authentication.
- Wi-Fi equipment which is correctly configured to use RADIUS authentication.
- User devices configured to do Enterprise Wi-Fi correctly.
You are not giving the school any additional information.
When one connects the Wifi network, one is already showing one's MAC address. All the frames between one's computer and the Wifi access point carry the source and destination MAC. Otherwise, it would be imposible to transmit and receive.
So the school asks you this information for security, to make it more difficult for others to connect. It is a reasonable security request.
It is not very strong, though, because MAC address can be easily spoofed. But it can help to correlate in case of trouble. If someone uses your user with a different MAC address, the school can suspect that your account has been hacked.
A MAC address just represents the physical address of a device. A device's MAC address is given out the second the device connects to the WIFI, based on the ARP protocol.
Asking for your MAC address could make it easier for them to filter a list of devices that would be allowed to access the specific network.
I personally think they are asking for your MAC address in order to only let the students access the school's internet connection. A random person will not be able to access their network if their MAC address is not added (even if they have the password).
However, it is easy to obtain someone's MAC address and change yours to match theirs (but I bet a minimal amount of people would take this path).
To answer your questions now, they won't really collect any additional information about you that they didn't already have. Once you connected to the WIFI, they were able to get access to your MAC address right away. However now they are capable of finding you faster.
They could be ale to track your history but that will require a lot of work that I doubt a school will do unless they are required to. They usually use proxies (middle men between you and the web page) to stop students from visiting certain websites or to add privacy to their server.
Using Tor will keep your history anonymous but they will be aware that you used such an internet browser.
Measure that you can take to prevent them: - Use a virtual box where you can edit your MAC address - When browsing the web you can always alter your DSN and your proxies (of the virtual box)
There are many other ways but in a way it is also quiet difficult to prevent someone from invading your privacy if you are using their network.
I would like to ask about what kind of information that they can collect from this?
Like others have mentioned. The best way is to ask "Why do you want my MAC Address?"
What if I use Tor Browser? Would it have any effect?Would they be able to track our browsing history.
Through some other applications and protocols of course they can. but not with your MAC Address.
The only reason I can think of regarding MAC Address request, is to filter or spoof. And I think your school only taking that as a security measure to filter who can access the internet.
I don't think that this is a problem. If you browse in the internet your MAC address isn't needed, only the IP-address, so this wouldn't have any effect.
I think the school implemented this, so that nobody outside from the school could access the Wi-Fi. Or that if somebody has the idea to do something illegal, they could know who (or at least which computer) did that.
Concerning to your browsing history: I think that they collect your browsing history somewhere on a school server anyways. But this is of course only for the browsing history that you make at school. If you for example the night before search something in the internet with your "home-internet" they can't get access to that, because it wasn't in the school's network.
