0

My MAC address has been spoofed by a neighbor to access my WiFi, positively. I know it's futile changing the WPA key or not broadcasting the SSID.

What are my options at this point ?

  • 3
    Use a secure protocol such as wpa2 for authentication? – Vipul Nair Nov 27 '19 at 15:39
  • 3
    No.WPA2 is immune to mac spoofing.Mac spoofing only works against captive portals – Vipul Nair Nov 27 '19 at 15:47
  • 4
    Why do you think that changing the key would not help? – schroeder Nov 27 '19 at 15:56
  • 2
    @Gaurav yes the key change should be fine.If you want to learn more you can google How WPA2 works. – Vipul Nair Nov 27 '19 at 17:29
  • 2
    You can check which devices are currently connected to your Wireless router. The router maintains a list of active devices with their MAC addresses and (in some cases) IP addresses. I'm unsure if two devices with the same MAC address would be listed multiple times or just once. However, the advice given to you by the other answers to change your PSK and to ensure it is not a poor one should be sufficient for your neighbour to not gain access to your router. – NewToThis Nov 28 '19 at 15:09
2

You mention that in comments that you are a novice and it appears you do not understand wireless in any great deal. You also don't provide a lot of information so your "problem" is very vague.

When a device associates to a wireless network, it goes through a number of steps. Among these steps there is an "open authentication" which normally is simply a two packet exchange. This is where MAC authentication takes place if configured. If the MAC is configured then the open authentication will succeed, if not it will fail.

Once the open authentication is done, the WPA2 handshake takes place. This is where your device and the wireless access point negotiation encryption making use of the PSK. Even if a device is allowed in the MAC filtering, it still must complete this handshake before it completes the association to the wireless network. If the handshake fails, the client is disconnected.

Once associated, the other semi-common place that MAC filtering can take place is if you have some sort of captive portal. These are not common in most home networks and may have seen these at businesses that provide public wireless access. Once you connect to the wireless network (which generally is an open network or doesn't use any sort of PSK), you have to login/click through a web page before you can connect to the Internet (or anywhere else). It is only in these cases where MAC spoofing will allow any sort of "unauthenticated" access.

So, if you are using WPA2 with a PSK, then simply MAC spoofing will not be sufficient to let your neighbor connect to your network. If you have a sufficiently strong PSK and have WPS disabled on your router, then you should be fine.

Steps I would take if I was hired to simply remediate this problem:

  1. Factory reset the wireless access point/router.
  2. Connect by a wired connection to the router and access the administrative interface.
  3. Disable the wireless network(so no devices can connect by any fashion).
  4. Change the password to access the router administrative interface (this may require reconnecting to the interface).
  5. Change the SSID from any sort of default value to something more user specific.
  6. Enable WPA2/AES and configure a strong PSK on the wireless network (16+ characters, not something used previously).
  7. Disable WPS if the hardware supports WPS.
  8. Re-enable the wireless network.
  9. Most devices will automatically save the configuration changes when you submit them, but if your doesn't, then make sure you save the configuration.
  10. Update router firmware if available.
  11. Configure each of your wireless client devices to connect to the new wireless network using the configure PSK.
  12. Update device firmware, OS, and/or drivers as available.

Note: Without knowing exactly which hardware you have this is a general list and some steps may not be applicable or even possible with your device. There may also be additional steps that are required depending on the device.

I had applied MAC filtering and the neighbor revealed to a non-tech friend of mine that he spoofed my MAC address. Do you think he's lying ?

Possible. I have known a few people in recent years who get some sort of amusement out of their own limited tech knowledge and something like a joke/prank app to fool their non-technical friends or acquaintances that they could accomplish a number of wireless (or other types) of "hack." These types of apps make it "appear" that they can do all sorts of things without actually doing so and it can leave their non-technical friends amazed at what they can do and make them fearful of what others are doing to them.

Or your non-technical friend could have completely misunderstood and/or miscommunicated their conversation with your neighbor. If they didn't really understand/follow the conversation, they could easily mix up different aspects of it and walk away with a misinterpretation of what was actually said.

Or our neighbor really did reveal that they are doing this. But your network would have to be using one of the two types of MAC filtering mentioned earlier as the primary means of "security" for accessing your network. If you have WPA2 with a PSK enabled, then your neighbor would also need to do more than MAC spoofing to get access to your network.

  • Thanks a lot, this was really comprehensive and educative ! As you say, it might have been the poor key that was responsible whether or not spoofing was done. This month the usage was way too much compared what it usually is. – Gaurav Nov 28 '19 at 9:22
3

If your neighbor is using your WiFi, the fundamental problem is that they have your password.

Change your router password to a strong password and make sure you use WPA2 authentication. Make sure you perform the router change from a wired connection and disable WAN side administrative access.

Spoofing your MAC address would be a poor choice for them because it would result in collision problems with your MAC, which would not work well for either of you.

MAC spoofing would only come into play if you have applied MAC access controls to your router, which is not a default setup.

Last but not least, duplicate MAC addresses can be difficult to detect, so I would suspect spoofing your MAC is unlikely. Again, it’s probably just your password.

  • Thanks ! I'll take your advice. I had applied MAC filtering and the neighbor revealed to a non-tech friend of mine that he spoofed my MAC address. Do you think he's lying ? Since there are many devices using the same connection, I'm not sure which one's been spoofed. If, as you say they're difficult to detect, is there no way out ? – Gaurav Nov 28 '19 at 4:34
  • 1
    @Gaurav - Mac Spoofing is something commonly said to sound Hacker-ish. Whether it actually happened or not is irrelevant, without the password a MAC spoof could do no more than denial service (DOS), not full access. – user10216038 Nov 28 '19 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.