What is the best way to protect a captive portal againt MAC spoofing?
The MAC Address appears one of the only ways to distinguish wireless clients from one another, anything one authenticated client sends can simply be spoofed by a rogue client. The IP address, MAC address, and any other part of a request can simply be spoofed, so how is the best way to protect a captive portal against such attacks?
I am not sure of any commercial implementation, but I saw an interesting idea that you can track physical proximity using signal strength, which AP, etc and determine that if the location suddenly is very different, that is likely a spoofer. I also found an interesting paper on spoofing detection using a fingerprinting technique.
The captive portal will be a web page. You may or may not be blocking all other ports before authentication, let's assume you can only get to 443 (80 redirects to 443) and only allow HTTPS. At this point they can only get to your captive portal page. Once they agree to the terms, log in, etc. you then can open up the other ports and allow web browsing anywhere they need to go.
If you are in a corporate environment, you will probably want to be implemented 802.1x, certificates, VPN, etc. to let them go anywhere and only keep the minimum ports open for authenticated users. VPN either at the IPSec or a higher layer would make the spoofing issue less likely. This allows you to restrict access where it won't matter if they spoof the mac, because they still can only get out to the VPN, and would need to attack the VPN.
If you are a hotel where you are tracking people by room number, spoofing the MAC would give someone a free ride, but it ends after the time period for which the legit user paid. You could implement something at the web proxy level to check certain cookies, headers, etc that will be more client specific.
The main security challenge of wifi is that your on an open network unless you are doing per-host type encryption (e.g., VPN). A MAC address should never be considered sufficient to identify someone.
Here are some resources related to security and captive portals:
You are correct that MAC addresses are easily spoofed, and should never be used as a strong measure of identity. I'd guess IPsec or RADIUS would be your best bet here, but any kind of strong authentication and integrity checking between the legitimate client and the server would work.
