0

If person Y sticks his adapter device into a fixed computer, person Y will be able to bypass MAC related restrictions since the inserted device has an unknown MAC-address. How do we protect from this beside enforced policy?

Assuming the restricted host is a Windows machine.

1

By whitelisting MAC addresses. If you are doing any sort of MAC address based filtering, you need to only allow known MAC addresses to connect to begin with.

They don't even need a separate adapter - changing your MAC address is easy to do in software, and some cell phones now randomize their MAC automatically when connecting to wifi to help anonymize them.

Even then, if an attacker can see traffic on the network, they could simply forge a MAC address from an already authorized machine. It provides some security, but not absolute security - there are a lot of ways a smart attacker can work around MAC address restrictions.

If you want to ensure even clever people can't bypass those restrictions, they need to be enforced by something like 802.1x, which validates the machine being connected either with a username and password or SSL certificate, before allowing them to connect to the rest of the network.

If you just want to make the restrictions a bit harder to get around, you can do that by restricting EVERYTHING that connects to the network, then whitelisting the devices you don't want to be blocked. There is still some potential there for spoofing the mac address of a whitelisted device, but it will at least be harder than just changing your MAC address to any random value.

1

If person Y sticks his adapter device into a fixed computer, person Y will be able to bypass MAC related restrictions since the inserted device has an unknown MAC-address. How do we protect from this beside enforced policy?

Don't use MAC addresses for authentication. They're not designed for security applications. They're designed for unique addressing on a local network segment.

They are sent in clear text over the wire, trivially spoofable, and implement no security model what so ever.

You can simply not base any useful security on MAC addresses in any sense. Roll out good authentication for whatever you're trying to achieve.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.