0

Suppose that I use a smartphone with an external WiFi adapter to cover up my real MAC address and on top of that I use a no-log VPN. In what way could I still be identified? I have heard a lot of talk against smartphones as hacking devices as they contain a lot of personal information, but I cannot see the validity of this argument as none of this personal information is related to the packages being sent when penetration testing another device.

I only see two things identifying oneself: MAC address and IP address.

Using an external adapter, the MAC address of the phone is not used. Suppose that the wifi adapter is bought with cash in some local store, there would be no way of identifying someone by knowing the MAC address of the external WiFi adapter.

VPN to fake the location and IP address.

Why would it be more secure to pentest or "hack" from a computer that contains no personal information about me compared to my smartphone? If the argument is because the entity that I am hacking could hack me and break into my system and reveal all my information, well they can't. Understanding the Android system shows that everything is sandboxed, every app is within its own environment and cannot see the rest of the system. Hacking into an Android device would just hack into a useless environment that is completely locked down. Even commands like "iwlist" are not allowed. I see smartphones as more secure devices to hack from than computers.

Can anyone expand my knowledge or prove that I am completely wrong?

  • 2
    Why would you ever want to pentest from a phone? I'm pissed off whenever I have to use a laptop and can't use my comfy mutli-monitor setup and nice keyboard. Not having any physical keyboard at all, lots of space to arrange information, etc. is just a nightmare – MechMK1 Dec 21 '19 at 19:27
  • MAC addresses are not sent to the target if it is on another network. So, you can safely remove that whole part from consideration (if not in the same network). – schroeder Dec 21 '19 at 20:23
  • 2
    "I have heard a lot of talk against smartphones as hacking devices as they contain a lot of personal information" - can you cite a source on this? Your entire question seems to hinge on this, and I'm not sure it's a valid argument to begin with (making this more of an X/Y problem). – schroeder Dec 21 '19 at 20:23
  • I cannot cite a source for discussions I have had / heard in real life, but I understand your reasoning. – Pentester27 Dec 22 '19 at 0:49
  • As for @MechMK1's question, there are different kinds of tools to use. A phone is a lot more practical to move around in scenarios like wifi war driving or MITM to monitor packets as it is in your pocket, or to setup a Social engineering website running on your phone where your phone is your server, as your phone is always on unlike your computer. A phone is much easier to move around for automated idle tasks, like packet sniffing, than moving around with a laptop, especially not talking about a desktop. – Pentester27 Dec 22 '19 at 0:51
2

By default, smartphones have a lot of services that phone home with diagnostic information that could identify you.

If you root the phone and remove all this, then the phone is basically a computer. Still I would prefer to start from a known baseline (e.g. simple Linux distro) and only add what I need, rather than risk missing a service that identifies me.

For pen testing you don't normally need to be anonymous as you're working with permission. But I've still answered your question as occasionally pen testers have good reason to be anonymous.

  • I understand your reasoning, but as I said, I know smartphones contains lots of personal information, but this information is not sent with packets when I pentest? – Pentester27 Dec 21 '19 at 16:40
  • 1
    @Pentester27 - I think that's right. However, I don't know for sure, and that's enough to discourage me. – paj28 Dec 21 '19 at 16:51
  • @paj28 if connecting remotely and over a VPN, do the "phone home" features come into play? I wouldn't think so. – schroeder Dec 21 '19 at 20:24
  • @schroeder - yeah that's exactly my point, we're only confident in this to the level of "I wouldn't think so" – paj28 Dec 22 '19 at 9:25
  • I initially agreed, as there are plenty of apps that make plain HTTP requests with specific device identifiers (e.g. for telemetry/bug reporting/usage stats/ads etc.). That said, as long as the VPN provider is considered trusted and this identifying traffic can't be correlated with your pentesting traffic, then there shouldn't be an issue. – multithr3at3d Dec 22 '19 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.