Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I noticed our Internet was bogged down. I checked the IP addresses of all devices connected and found the MAC addresses of the culprits:
Question: How to find their geographical location based on the MAC addresses?
I know they are in the neighborhood of Columbia, Md. 21045. One of them is an iPhone and another is an Android phone which would should allow GPS triangulation, but that option is only available to the carrier and law enforcement.
Physically finding them is not easy. If you are really willing to catch them, buy a couple ESP8266 modules (search eBay for them), research this project a little, drop a couple modules around and you can probably find them. But will cost a lot of time, effort and some money.
Even if you cannot physically locate them, you can play some tricks with them:
Install a captive portal, saying the network is an experiment on automated hacking and ask user to only continue if they agree. Ask for email or Facebook auth, or ask for a phone number to send a PIN to login.
Install something like Upside Down Ternet, Backdoor Factory or AutoPwn.
Put QoS in place on your router, and 1kbps bandwidth for anyone outside of a list.
Install Responder along with mitmproxy, get all auth data you can.
My network is pretty secure, but sometimes I think about installing a WEP wifi network just to play around with internet thieves.
So the question is how to find their physical address location based on the mac address?
You can't, IP addresses and MAC addresses do not carry any location information.
Your access point may be able to give information on the signal strength, which could be used as an indication of the distance between the access point and the device. But not all brands are able to do so, and there are many more factors which may affect signal strength.
Your best option is to make sure your wireless network is secure: use WPA2, change your password, and possibly consider MAC filtering.
Change your WiFi Password - make sure it's strong.
Make sure you are using WPA/WPA2
Check your "plugged in" devices. They show up in the MAC list as well, and just because something says "Android" doesn't mean it's a phone.
Ensure your router's admin password is not the default.
Just because they are on that list doesn't mean the device is still connected. It could have been your friend that came over earlier and his phone attached to the WiFi, and you're just seeing the entry the router remembers (so that is can re-assign the same IP if that device returns shortly).
Nobody is hacking your WiFi. That's a sexy story, but it simply doesn't really happen in the real world to regular people. You're not an important enough target, and certainly not worth all the effort to crack WPA/WPA2. Follow steps 1-4 above, and you're going to be just fine.
MAC addresses are tied to equipment manufacturers. So MAC address can tell you the vendor that produced the device that is accessing your network, and not a bit more. You can use that page for a lookup, there are probably many more out there:
Relying solely on whitelisting MAC addresses is an extremely bad practice security-wise, since MAC addresses of personal computers (including notebooks) can be easily changed (therefore limiting the usefulness of the MAC lookup anyway). You can bet that the malicious user will change their MAC to one of the whitelisted ones (can be obtained by sniffing the traffic), unless he is absolutely clueless.
Please use proper encryption on your network (WPA).
If you want to find the source you need to triangulate the wifi signal with an access point, either the router itself or perhaps something small like a raspberry pi or laptop configured to look like your router (turn the router off, map the area.)
The process is similar to 'warchalking', you can expect to be on foot and checking wireless signal strengths.
You could also set up multiple hotspots around the area, then see which hotspot(s) the client connects to. This could let you map their movements if "they" are configured to autoconnect. Again, you could use some low-cost battery-powered raspberry pis for this as well. The hotspots can be placed anywhere, in theory, including intersections and paths leading in/out of your neighborhood/complex. Pair that with some cameras and you would know who was using your wifi.
It's less work to reconfigure your network (MACs can be spoofed, so, really you want a better authentication protocol and to routinely change out secrets/passwords/keys).
A MAC adress may have once been conceived of as a unique identifier for a piece of hardware, but in reality its just a configurable driver parameter.
If your culprits have the know-how of how to circumvent even the simplest of real-world security measures, you can be pretty sure they know how to change their MAC-address.
There is a great utility called macchanger for Linux, that is really easy to use. For windows, your wifi driver has this function (unless purposefully stripped of it by the vendor).
It is a security issue that people believe that a MAC address is something unchangeable. Consider that the MAC address is sent un-encrypted with every packet, so anyone can mask as anyone else, as far as the MAC-address goes. Finding someones MAC address gives you next to nothing to identify them. Think of it only as a parameter used to make low-level communication work, nothing more.
Following ThoriumBR's excellently nefarious suggestions you could possibly (if the perpetrators are not smart) create a trap page that requests the device's location - obviously most computers won't have this, and security conscious types will turn it off, but most mobile devices by default have location services enabled, allowing you to snag a GPS coordinate or (less accurate) location based on the SSID's of nearby hotspots.
Triangulating wifi devices by signal strength etc. sounds like it should be easy but it's not, there has been so many attempts and no-one has yet managed it to any convincing level. What law enforcement have access to is triangulation based on the locations of cell towers that can "see" the phone, obviously that requires access to the carrier's backend network and you're not getting that.
GPS location you can get through a simple web page served from your network with some javascript.
In general though - secure your router, create a MAC whitelist, perhaps upgrade to a better/smarter router with stronger security etc. and/or OpenWRT if yours has some known weakness or is a cheapy consumer-grade device.
Capture the HostTrace.. if you have HostTrace and MAC it should be easy for a team to nail down the location. FYI : some equipment allows MAC spoofing, so I always capture the PCName as well.
old school server method.. Request.ServerVariables[""] .NET commands require [control.]
control.Request.ServerVariables["HTTP_X_FORWARDED_FOR"]
control.Request.ServerVariables["REMOTE_ADDR"]
control.Request.UserHostAddress
control.Request.ServerVariables["REMOTE_HOST"]
control.Request.UserHostName
control.Request.Browser.Browser
control.Request.Browser.Platform
control.Request.UserAgent;
//trace // use this to trace all IPs returned on user when they are connected.
string[] pop = System.Net.Dns.GetHostEntry(control.Request.UserHostAddress).HostName.Split(new Char[] { '.' });
