0

Now I'm pretty sure I know the answer to this question, but I am just curious to see what the security experts of the world think of this.

First a little back story:

I was a former member of a website (I won't be saying any names) and they got mad at me because I was able to successfully exploit their site (after being asked to). I got banned and the rest is history. Turns out they threatened me (personally), and said they are capable of getting my MAC address.

So here's where I started asking questions, I was accessing their site one of three ways; Tor/TAILS, a VPN, or random proxies in random countries. The administrator of the website told me:

"I am able to get your IPv6 and then your MAC address from that no matter how you enter the site, via my firewall."

If I am not mistaken, there are multiple issues with this statement:

  1. You can turn IPv6 off on any system, and it is off by default
  2. Getting a IPv6 address from a unfriendly proxy server would be extremely difficult
  3. Getting an IPv6 from Tor/TAILS would be extremely difficult unless you had access to their exit nodes.
  4. That networking just does not make sense in a security aspect

So my question being, would it be even remotely possible to get my IPv6/MAC from a firewall accessing a website via Tor/TAILS, proxies, or a VPN? And if so, how could this be done?

|improve this question
  • 4
    IPv6 might include MAC address. But how is getting a MAC address a threat? – pri Oct 27 '17 at 13:10
  • @PriyankGupta I'm not entirely sure lol. They made other threats that I did not post that had to do with my family and myself, you know stupid child stuff. I'm just curious to see if this firewall is possible or not theoretically. – Gyzo Oct 27 '17 at 13:17
  • This seems like some low-life’s trying to scare you because you exploited their site. It seems unlikely they would be able to get any of the information they said they would. I’d just stay away from them. – 13aal Oct 27 '17 at 13:30
  • The problem here is that none of this is a security issue. – schroeder♦ Oct 27 '17 at 13:37
  • Mapping from IPv6 to MAC would require that you're using something like RFC 2464 address assignment, but that was effectively obsoleted by RFC 3041 (published in early 2001). However, mind the fact that there have been issues with software storing type 1 or type 2 GUIDs in data files. As I recall, one major example was that Microsoft Word did that for a while, and this was used on occasion to de-anonymize authors. Sometimes correlation is all it takes. – a CVn Oct 27 '17 at 14:44
2

First and foremost, understand what a MAC (Media Access Control) address is and IP (Internet Protocol).

A MAC (semi-unique but not really) is an identifier for your network card to talk with it's local network at a level lower than Internet Protocol. Typically this is an ethernet packet along the lines of:

      | MAC | Flags | Payload_1 |

Inside the payload is your IP protocol.

As soon as the ethernet packet hits your local router or access point, everything except payload_1 is stripped away for connection to the next router up the line, becoming:

     | controls | Source address | Destination address | Payload_2 |

The MAC is gone, it's not part of Internet protocol! The only MAC the web site can get is his own router connection, yours is long gone.

As far as your IP, if you are using Tor or a functional anonymizing VPN, that's been changed as well by the time it hits the web server.

One odd exception is an obscure IPv6 auto configuration mode that computes an IPv6 address from your Mac. This can be reversed back to a MAC. Even if the Mac were obtained this way, at most it identifies the network card type (such as Netgear) and a number that may or may not be a real identifier that is not directly traceable.

|improve this answer
  • Um, "obscure"? MAC-based addresses have been the default (and in some devices, the only) IPv6 auto-configuration mode since at least 1997. (Which was probably inspired by the same behavior in IPX and ATM addresses from late 1980's, so in that context it's not particularly odd either.) – grawity Jan 25 at 22:31
  • True, but even Microsoft doesn't use it because of the inherent privacy problems it creates. Mostly “Privacy Extensions for Stateless Address Autoconfiguration in IPv6” RFC 4941 replaces it for common use. – user10216038 Jan 25 at 22:44
  • "Even Microsoft"? On the contrary, if I remember correctly, they were the first to get rid of it in Windows 7 -- other major operating systems followed much later. (RFC 4941 doesn't replace the default interface identifier in general, only provides additional addresses alongside it. Windows XP didn't enable IPv6 yet, but if you installed it, you always got MAC addresses by default. Windows Vista enabled IPv6 and 4941 by default but still had a MAC-based address. Only Windows 7 started randomizing the main interface identifier, a practice that was later adopted by other OS as RFC 7217.) – grawity Jan 25 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.