I was logged on to my router and filling out some information. I clicked a button and a field was automatically filled in with my computer's MAC address. How is this possible? Does it present a security risk?
I'm connected through VPN and my computer is up to date and running Microsoft Security Essentials (MSE). Is there JavaScript code that can get the MAC address? Is the MAC address sent in an IP header? I was surprised I wasn't at least prompted to share this information.
This is not a security risk.
The router looks in its ARP table to find the MAC address of your IP address. The reason it can do this, is because you are connected to the router via layer 2 in the OSI model. The router simply looks up your IP address in the ARP cache to find its MAC address. A website on the Internet is not connected to your LAN and will not be able to determine your MAC address.
In the same way, you from your computer determine the MAC address of your router by looking in the ARP cache of your computer. If you open up your command prompt (cmd.exe on Windows) and type "arp -a", you will see your router's MAC address. This does not pose a security risk, and is required for IP traffic to work on an Ethernet network.
There is no risk here.
The Internet is not just one protocol, but a series of protocols that stack up on top of each other. The exact definitions of each part of the stack differ somewhat from person to person, but the two we're concerned about here are fairly well-defined: the link layer and the network layer. Depending on who you ask, these layers have different numbers, so I'm going to use the names instead.
The link layer defines how to get a signal across two computers that are directly connected in some way. Ethernet is one example, and so is is the 802.11 family of wireless protocols; I list these because they use MAC addresses. PPP, which is often used by modems, is another example of a link-layer protocol, but it does not use MAC addresses. There are other link-layer protocols too, but I won't get into them here.
The network layer defines how to get a signal across two computers that are NOT directly connected, using computers that ARE directly connected in some way. This is where IP lives, and it doesn't use MAC addresses.* Data still has to be passed between machines that are directly connected to each other, but even if this is done using only protocols that use MAC addresses, it uses the MAC addresses of the two machines that are passing information between them at the moment, not the MAC address that started it all. Your MAC address is only visible to the very first link in the chain -the one between your computer and the router- and it legitimately needs that, because that's how it tells data from your computer apart from data from other computers connected to it. But after that, your address is gone.
The reason that your router knows your MAC address is that you are directly connected to it, using the link layer (it can also see you in the network layer, which is how it's presenting its interface to you, but that doesn't matter here). It cannot see the MAC addresses of anyone who is not directly connected to it in this way, because that information gets lost in the network layer.** The same is true of other machines. So yes, your router can see your MAC address, but no one else can.
*: IPv4 doesn't use MAC addresses, and if you're not sure what IP version you're using, it is probably IPv4. IPv6 allows (but doesn't require) computers to use MAC addresses in certain ways, and some implementations do this, but it has caused a lot of controversy.
**: Again, this assumes you're not using an IP version that leaks MAC address information.
Nice juicy answers but none of them has answered the question.
How is this possible?
The answer is it's possible with your permission.
Is there JavaScript code that can get the MAC address?
Well.. Java can
The webpage that you have visited most likely has asked for your permission to run a Java application and you must have agreed. A Java application can easily retrieve your MAC and send it back to the webpage.
