74

My school has recently asked us to submit our MAC address to the school along with our designated name to be used to connect to the Wi-Fi. Previously this wasn't needed.

I would like to ask about what kind of information that they can collect from this? Would they be able to track our browsing history or more? What if I use Tor Browser? Would it have any effect?

If they can track me, what measures can I take to prevent them from invading my privacy?

migrated from serverfault.com Aug 4 '16 at 8:04

This question came from our site for system and network administrators.

  • 110
    "what measures can I take to prevent them from invading my privacy?" - don't use their WiFi for anything you want kept private. – brhans Aug 4 '16 at 19:29
  • 1
    @brhans You don't need to go to such extremes however. You could use end-to-end encryption (so for example, Whatsapp should be safe) or a VPN to tunnel all your traffic. – Jon Bentley Aug 7 '16 at 9:23
  • 1
    I use "MAC Filtering" at my home network for preventing unwanted access from outsiders. Imagine it as a white list of MAC addresses, including all those who have access or as a Black list including those who have no access. – mchar Aug 7 '16 at 10:57
  • 3
    Have you considered telling them your device randomly selects a MAC address from the range 00:50:56:00:00:00 to 00:50:56:3f:ff:ff:ff every time it boots and you will need to reserve all of them? – Eric Towers Aug 8 '16 at 6:28
  • 3
    @cyanide: They wouldn't. They would say "you may not connect this device to our network" and wouldn't allow it to authenticate with the wireless access point. – Lightness Races in Orbit Aug 8 '16 at 11:37
79

I think you should ask why they want to use the MAC address, not necessarily for privacy reasons; "why do you need the MAC Address?" I think it's a reasonable question to ask them.

Firstly, they will have MAC addresses of all the individuals who connect to the WiFi. Any device connecting to the WiFi will reveal their MAC address, based on the ARP protocol.

They may think locking down WiFi to known MAC addresses is a good security measure. It's not really because I can obtain your MAC address if both of us are in the same Starbucks and on the same WiFi. I can then spoof your MAC address quite easily. So from a security measure this is not great.

They may want to track your activity. They can do this already without asking for your MAC, just giving them the MAC address allows them to map it to a individual easier. They can get a history of MAC & IP address from logs and their NAT can keep a history of IP Address & Ports and map back to the MAC address.

If you use Tor, they will be able to say you used Tor, but not the content.

So, I would ask why do you want my MAC address, giving out the MAC address is not going to really affect you. Unless of course on your home WiFi or something else you are using MAC address as a method to identify yourself; as MAC address can be easily spoofed.

  • 107
    In my personal opinion, students attempting to persuade the school that the schools IT policies are stupid (even if they are) is unlikely to produce a useful outcome for the student. They are likely to seem as frivolously argumentative. Using an organisation's network for private personal activities is not always sensible and rarely an inalienable right. – RedGrittyBrick Aug 4 '16 at 16:31
  • 46
    If they are using MACs to track students then this sounds like a great way to troll the student you don't like. Step 1: spoof their MAC since they are on the same network, Step 2: download a bunch of porn :) – David Grinberg Aug 4 '16 at 20:23
  • 15
    "any device connecting to the WIFI will give out there MAC address, based on the ARP protocol." - Every packet your computer sends, be it over WiFi or Ethernet, contains your MAC address. It's part of the physical layer protocol, and has very little to do with ARP. – marcelm Aug 4 '16 at 21:52
  • 22
    @DavidGrinberg: Maybe you think that "the students are downloading porn" is somehow noteworthy, but to the net admins, it's Tuesday. Somehow, I don't think your proposed trolling technique would be very effective. – Kevin Aug 5 '16 at 6:08
  • 9
    @svick: WPA2 enterprise with client certificates. – R.. Aug 5 '16 at 20:32
33

For a school, having all student device MAC addresses (unique hardware identifier) is a way to filter out a lot of unwanted traffic from the LAN. Even if outside devices from non-students spoof a legitimate, student-registered MAC, the packets being sent over the network can still be captured, opened, and the user agents, and other system identifiers can be observed. This lets the network admin know if someone is using a spoofed MAC and then the admin can effectively boot that MAC from the access point easily without filtering the specific MAC, which would block the legit student if done, with packet filtering blocks.

Using MAC address registeries helps to keep a check on who is supposed to be connecting and who is not. But it is only a single security method. There are others such as 3rd party proprietary or open source tools that can determine the user agents and many other things such as system hardware specs, OS being used, browser plugins, etc. Even if these things are themselves spoofed. These will identify TOR daemon/browser users as well as identify Tails users (linux OS that sends all system and web traffic through the TOR network).

If you wish to avoid being tracked, you have a few methods:

  1. Don't use school LAN.
  2. Use a bootable thumb drive and a USB wifi adapter.
  3. Create a virtual wireless interface and a custom interface profile.
  4. Use a virtual machine with a thumb drive.
  5. Tunnel through a legit student device such as a virtual NIC created using an adhoc virtual interface bridged to the real interface. Spoof the VNIC identifiers.

This is just a small number of ways and not the best methods either. You may find more by doing some research.

  • 4
    I'm not sure the IT admins would go as far as implementing deep-packet inspection (for which they'd also need a HTTPS proxy) to detect changes in User-Agents (which could be caused by using a different browser) or anomaly detection of web browsing traffic. I'm also curious to what device information you think could be captured in Ethernet packages. I also wonder how you would kick a specific device of a network, if you can't use it's MAC address for it. If they use MAC address filtering as a security measure, they'll definitely not be using certificate based authentication. – BlueCacti Aug 5 '16 at 9:57
  • 4
    @ArtOfCode That's quite a heavy monitoring strategy of your school. However, User-Agents and MAC addresses can be spoofed quite easily. The only thing that worries me is that they intercept and inspect all traffic, including HTTPS. That would allow them to see capture your credentials and sensitive data. – BlueCacti Aug 5 '16 at 11:45
  • 4
    @mikato: In ArtOfCode's example, they explicitly required the users to install and trust a root CA certificate that would allow the firewall to spoof everything and MitM the connections. – Henning Makholm Aug 5 '16 at 20:23
  • 4
    @GroundZero: What school was this? They need to be named and shamed (and probably prosecuted). – R.. Aug 6 '16 at 2:14
  • 2
    @R..This did not happen at my school, but at ArtOfCode's. A company or school can do this, if the local (privacy/cyber crime) legislation allows it. In most cases, this has to be included in the school/labor contract and cannot be used to arbitrarily sniff employee's/student's internet behavior. – BlueCacti Aug 8 '16 at 8:58
25

Well, the school already has your MAC address since you've connected to their access points in the past. What they don't (necessarily) know is the association between your MAC addresses and your real name.
If that concerns you, just use a different MAC while you are at school:

ip link set dev wlp1 address XX:XX:XX:XX:XX:XX

Pick a Locally Administered MAC to avoid conflicts with devices that are using their manufacturer-assigned MAC on the same AP.

Note that a malicious user would run airodump-ng to discover another student's MAC address, kick that student off the network with aireplay-ng -0, and then use their MAC to impersonate them. If your school thinks that MAC-filtering is good security, they're in for a big surprise!

  • 6
    This should be popularised at the school, to ensure that the MAC idea dies quickly - back when I was at school they tried to introduce fingerprint scanners with some strange and rapidly broken promise that they'd improve security. – Mark K Cowan Aug 5 '16 at 12:15
  • What should I do to discover another student's MAC address? Where should I run airodump-ng? Do you have a good source to teach someone to sniff MAC addresses at a network? – cyanide Aug 6 '16 at 15:14
  • 5
    "Do you have a good source to teach" Did you try googling for "airodump-ng", @cyanide? – AnoE Aug 8 '16 at 9:12
  • @Navin Knocking off a legit student using the aircrack-ng suite may work briefly, but if you spoof the same mac to appear as the real student, and are continuously deauthenticating the exact same mac, you wouldn't be able to connect as that student either. Whether legit student or spoofed, if aireplay-ng -0 is used to deauth the HWaddr: 00:11:22:33:44:55 and you spoof your HWaddr to 00:11:22:33:44:55, then you will also be deauthenticated as well. – Yokai Aug 20 '16 at 7:33
3

They might not be thinking of it in terms of tracking measure but as an alternative to giving out WiFi password. MAC address white listing is a pretty common alternative.

If they gave out a WiFi password for logging in nothing is to stop another student from giving those details. Whereas white listing per MAC address prevents this information from being easily passed along.

Of course there is a concern of MAC address spoofing. But to connect to the network with a spoofed MAC address you will need to know a MAC address that already has access. And if the MAC address can be traced back to you then you likely would not want to share this information with a friend. And finally if you spoof once you gave them your MAC address it will only prevent you from connecting.

As far as privacy if they have the technical means to retrieve your MAC address sent from your device to match it to their white list nothing is stopping their firewall from logging additional information and making a match to your mac address. For example, we get an IP returned in our firewall logs. We can just go to our MAC address list and search it for MAC address's that used that IP.

Since they can intercept the traffic they can also get a bird's eye view of known applications you may be using and websites you are browsing. Getting a detailed idea of your activity on the other hand, while possible, is unlikely to happen due to the work involved. So while they might not know the contents of message X they could of known you where on service Y or website Z to send it. Bottom line if privacy is a concern avoid connecting to their network at all. Or at least avoid doing activities on their network that you wish to be private.

  • 4
    MAC address spoofing is trivial: if you're close enough to the WiFi to connect to it, you're close enough to see the MAC addresses of every computer connected to it. – Mark Aug 4 '16 at 20:17
  • 2
    @Mark I didn't recommend the school use MAC addresses for whitelisting. I simply pointed out that is why they are doing this. Is that the reason for the downvote? – Bacon Brad Aug 4 '16 at 20:24
  • 1
    @baconface, your third paragraph does seem to imply that it is hard to obtain a known MAC address for spoofing. – dan1111 Aug 5 '16 at 9:51
  • 1
    @cyanide, you just need a wifi sniffer such as airodump-ng or Kismet -- start it up, select which AP you want to monitor, let it run for a few minutes, and you've got a list of the MAC addresses everyone who's currently connected. – Mark Aug 6 '16 at 18:32
  • 2
    @cyanide an AP is an (wireless) Access Point, the device that sends out a WiFi signal so you can connect to it. It'd suggest not playing around with any of these tools if you don't know the basics of (wireless) networking. It'd be better to first teach yourself some general stuff regarding Ethernet, IP, MAC addresses, WiFi protocols etc. before you delve into wireless sniffing and spoofing – BlueCacti Aug 8 '16 at 8:52
3

I would like to ask about what kind of information that they can collect from this?

Having your MAC address facilitates in analyzing log files.
Network log files often contain an IP address and some information about the connection.
For example, the following fictional log entry would indicate that a device with the IP address 10.10.100.123 connected to a system with the IP address 216.58.210.46 (google.com) on port 443 (HTTPS).

TIMESTAMP        | SOURCE IP:PORT       | DEST IP:PORT
-----------------------------------------------------------
2016-08-05 12:11 | 10.10.100.123:123456 | 216.58.210.46:443

Further research in other log files (e.g. DHCP leases) could indicate that the internal IP address 10.10.100.123 was handed out to the MAC address 01:23:45:67:89:01.

IP ADDRESS    | MAC ADDRESS       | LEASE START      | LEASE END
-----------------------------------------------------------------------
10.10.100.123 | 01:23:45:67:89:01 | 2016-08-03 09:35 | 2016-08-10 09:35

That MAC address can then be matched to the network adapter of the device of a certain student.

This allows the school, or any authority that is able to request the school's log files (e.g. Law Enforcement agencies), to trace back certain online activities.
If some criminal investigation shows that the public IP address of the school is linked to certain illegal activities, the school could be requested to hand over their log files and list of 'MAC address - student' combinations.
It could also be the case that the school wants to track down which student spent 10% of their bandwidth on browsing 18+ websites.

Whether this information can be used for these reasons depends on local legislation in regards to privacy and computer crime.

Would they be able to track our browsing history or more?

They cannot detect your complete browser history using this information. However, as I explained before, the MAC address could be used to link your device to certain activity on the network.

What if I use Tor Browser? Would it have any effect?

Using Tor does not change anything to the fact that your device's network adapter has a certain MAC address and that this MAC address could be linked to your device and to you.

If they can track me, what measures can I take to prevent them from invading my privacy?

It is fairly trivial to change the MAC address of your device's network adapter(s). Changing your MAC address after having handed them your original one (or providing them with a fake one), makes it more difficult for the IT administrators to link an MAC/IP address to you.
However, if the network requires identification through Active Directory (each student having a unique username to authenticate to the network) or some other form of authentication (e.g. certificate based), they'd still be able to check the logs files to try to match an IP to you.
If the school uses a proxy, they could also sniff web traffic in search for Personally Identifiable Information, such as your email address or Facebook username, ... But I suppose this would be a huge breach of privacy regulations in most countries.

Additional info

It could also be the case that your school wants to implement MAC address based access control on the network, allowing only whitelisted (allowed) MAC addresses to connect to the network.

However, as others have pointed out (and as I have touched upon slightly), MAC addresses can be edited. This allows anyone to change their own MAC address to that of a legitimate student, granting them access to the network.
MAC address based access controls will stop some people from being able to access the network using the password they received from a friend at your school (as they don't have the knowledge/skills to bypass this weak line of defense), but it won't stop those who are determined to access the network.

If the school is serious about wanting to track student's network usage and/or want to limit access to students only, there are much better alternatives available.

One example of this is RADIUS authenticated WiFi.
Extract from: FreeRadius.org

IEEE 802.1X and RADIUS Authentication

The IEEE standards for Wi-Fi (IEEE 802.11) foresee an "Enterprise" mode which is fundamentally different from PSK networks because the Wi-Fi encryption keys are provisioned per user and per session. Every user needs to authenticate with their personal credentials; at that moment a key is generated and is communicated to the user's device and the NAS they connect to.

Before users send their authentication credentials, the the user must authenticate the network, proving that it is indeed genuine; only then is the client's credential released. The IEEE standard IEEE 802.1X (using RADIUS and the Extensible Authentication Protocol, EAP) is used for authentication and key management.

Enterprise Wi-Fi authentication also enables advanced features such as putting users dynamically into a specific VLAN (e.g. separate guest and staff logins into different IP networks even though being on the same SSID), and dynamic ACLs

Enterprise Wi-Fi requires:

  1. A RADIUS server which can do EAP authentication.
  2. Wi-Fi equipment which is correctly configured to use RADIUS authentication.
  3. User devices configured to do Enterprise Wi-Fi correctly.
2

You are not giving the school any additional information.

When one connects the Wifi network, one is already showing one's MAC address. All the frames between one's computer and the Wifi access point carry the source and destination MAC. Otherwise, it would be imposible to transmit and receive.

So the school asks you this information for security, to make it more difficult for others to connect. It is a reasonable security request.

It is not very strong, though, because MAC address can be easily spoofed. But it can help to correlate in case of trouble. If someone uses your user with a different MAC address, the school can suspect that your account has been hacked.

  • 2
    He is giving the info that MAC X is linked to user Y. That is "a lot" – niilzon Aug 5 '16 at 13:06
  • Not really, because that link is absurdly weak. MAC addresses are public on the network and anyone can claim any MAC address. – David Schwartz Aug 5 '16 at 16:14
  • 1
    @DavidSchwartz While we all know better than to rely on linking a MAC address to a person for anything, it seems likely that the school implementing such a daft policy wouldn't know better, which has potentially severe implications in being held responsible for the actions of anyone who chooses to spoof "your" MAC address. – HopelessN00b Aug 5 '16 at 17:16
  • 1
    @HopelessN00b I agree. I'd be concerned that the school thinks this information is more useful than it really is. If they think it's hard to spoof or unlikely to be spoofed, ... – David Schwartz Aug 5 '16 at 17:30
2

A MAC address just represents the physical address of a device. A device's MAC address is given out the second the device connects to the WIFI, based on the ARP protocol.

Asking for your MAC address could make it easier for them to filter a list of devices that would be allowed to access the specific network.

I personally think they are asking for your MAC address in order to only let the students access the school's internet connection. A random person will not be able to access their network if their MAC address is not added (even if they have the password).

However, it is easy to obtain someone's MAC address and change yours to match theirs (but I bet a minimal amount of people would take this path).

To answer your questions now, they won't really collect any additional information about you that they didn't already have. Once you connected to the WIFI, they were able to get access to your MAC address right away. However now they are capable of finding you faster.

They could be ale to track your history but that will require a lot of work that I doubt a school will do unless they are required to. They usually use proxies (middle men between you and the web page) to stop students from visiting certain websites or to add privacy to their server.

Using Tor will keep your history anonymous but they will be aware that you used such an internet browser.

Measure that you can take to prevent them: - Use a virtual box where you can edit your MAC address - When browsing the web you can always alter your DSN and your proxies (of the virtual box)

There are many other ways but in a way it is also quiet difficult to prevent someone from invading your privacy if you are using their network.

  • 4
    MAC address spoofing also gives law enforcement the evidence of intentional wrongdoing they need if they choose to throw the book at an unwanted user. – Ben Voigt Aug 4 '16 at 20:18
  • This doesn't answer the question that was asked. The question is not asking "Why did they ask for MAC address filtering?" Instead, the question is asking: "Can the school track me? What can I do to protect my privacy?" This answer hasn't answered any of those questions. – D.W. Aug 5 '16 at 0:59
  • 1
    MAC addresses are not handed out by the ARP protocol. They are defined by the manufacturer to uniquely identify a network device. IP addresses are handed out by DHCP. ARP is used to find the MAC address matching a certain IP address – BlueCacti Aug 5 '16 at 10:08
  • Wouldn’t the WiFi have to use the real machine’s radio? The VM must be able to program it to listen to multiple mac’s for it to use the mac of the VM. – JDługosz Aug 6 '16 at 23:54
-1

I would like to ask about what kind of information that they can collect from this?

Like others have mentioned. The best way is to ask "Why do you want my MAC Address?"

What if I use Tor Browser? Would it have any effect?Would they be able to track our browsing history.

Through some other applications and protocols of course they can. but not with your MAC Address.

The only reason I can think of regarding MAC Address request, is to filter or spoof. And I think your school only taking that as a security measure to filter who can access the internet.

-6

I don't think that this is a problem. If you browse in the internet your MAC address isn't needed, only the IP-address, so this wouldn't have any effect.

I think the school implemented this, so that nobody outside from the school could access the Wi-Fi. Or that if somebody has the idea to do something illegal, they could know who (or at least which computer) did that.

Concerning to your browsing history: I think that they collect your browsing history somewhere on a school server anyways. But this is of course only for the browsing history that you make at school. If you for example the night before search something in the internet with your "home-internet" they can't get access to that, because it wasn't in the school's network.

  • 6
    Bad information. The MAC is the interface hardware identifier used by DHCP to assign the interface an ip address in the range set on an access point of the default gateway. Without the MAC, the router doesn't get told which interface is being used to send and recieve packets. Because no ip address gets assigned. Thus, traffic does not flow. The MAC is essential for monitoring LANs and who is doing what for security reasons. – Yokai Aug 4 '16 at 9:31
  • 1
    @Yokai While I agree that everything you say is technically true, I think you're giving people a false impression that a MAC address is a way to uniquely identify someone, when it's not. (It's intended to be, but changing your MAC address is trivial) – Patrick M Aug 6 '16 at 16:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.