0

Due to a high number of clients connected to one of my routers I recently changed it's password and reboot it. I also disabled WPS. The router is a ZyXEL Prestige 660.

After the reboot the client list looked like this:

Status  Host Name   IP Address  MAC address Reserve Modify
  1. DeepThought 192.168.1.10 08:3E:8E:*:*:*
  2. Louises-iPhone 192.168.1.11 C0:9F:42:*:*:*
  3. H-iPhone 192.168.1.12 E0:C9:7A:*:*:*

Of course the '..*' where actual numbers, but the problem is that I've only connected two devices. The first two ones. DeepThought is an Acer laptop, and Louises-iPhone is a 4S.

What is 'H-iPhone', and where does it come from? Due to my physical position (a retreatment area in the deep jungles of Thailand), I don't think anyone around here managed to hack it in less three minutes. I didn't however find any useful information about the hostname 'H-iPhone' on Google.

Is it possible that the iPhone I connected, for some reason, could retrieve two IPv4-adresses, with two different MAC adresses?

I assume all listed clients already are authed through my pre-shared WPA2-PSK key?

I'm thankful for any thoughts and/or explanations! Please feel free to update the tags of this question if not suitable.

Improve this question

3 Answers 3

Reset to default
0

Well, the MAC address prefixes C0:9F:42 and E0:C9:7A are both registered to Apple according to the IEEE: http://www.ieee.org/netstorage/standards/oui.txt, so it's some Apple device, probably.

Turn the iPhone off, reset the router, check the address assignments, turn the iPhone on, and See What Happens.™

Alternatively, you should be able to see the MAC addresses through Settings -> General -> About.

But wait... iOS 8 supposedly randomizes MAC addresses to help foil tracking: https://apple.stackexchange.com/questions/147613/does-ios-8s-mac-address-randomization-give-the-actual-mac-address-once-connecte Could that be it?

Improve this answer
6
  • Hmm, seems that one of them in the linked article is for the bluetooth adapter, which I guess cannot connect to the router and obtain a IPv4 adress? My iPhone (Louises-iPhone) just dropped, but H-iPhone is still there... It's driving me nuts :D
    – swaglord mcmuffin'
    Dec 16, 2014 at 18:05
  • Rats! I linked the wrong article. I'll edit the answer. I think (without evidence) that 'H iPhone' is a randomized address. Are you running iOS 8? Are the last octets of the MAC the same as before? (And yes, Bluetooth can't connect to your WiFi.)
    – Bob Brown
    Dec 16, 2014 at 18:13
  • I'll look into to it as soon as possible! It's not always in the client list, but I'll keep an eye open!
    – swaglord mcmuffin'
    Dec 18, 2014 at 6:38
  • Update: IOS7, but I do have another phone around that might use IOS8, but not connected to the wifi (but maybe scanning for it). That seems to be an explanation anyway! So it can literally be any iPhone...? But I thought the client list only listed authed devices, but maybe not :) I'll look into the exakt MAC adress as soon I can find it again (sometimes its not listed, which makes sense regarding the article).
    – swaglord mcmuffin'
    Dec 18, 2014 at 6:46
  • Do note that the first link I posted was incorrect, and I've changed the link in the answer.
    – Bob Brown
    Dec 18, 2014 at 11:49
1

Or maybe it is bluetooth? I found something like that: Bluetooth PAN and this, which says

My Mac reports very similar IP addresses for both, starting with 172.20.10 and differing only in the last octet.

It seems like you could be able to get IP address for a bluetooth connection like that. Try to investigate more into it, because from what I saw, different MACs in iPads and iPhones are only for wifi and bluetooth.

Improve this answer
6
  • Seems like the most helpful answer so far.
    – cremefraiche
    Dec 17, 2014 at 0:05
  • Alright, like the first answer I got. So Bluetooth can actually be viewed, trying to connect to a Wifi device, or am I misunderstanding anything here? I guess BT can't establish a wifi connection anyway? I mean, they are not even on a close frequency? Or is the iPhone just passing that information over its wifi connection?
    – swaglord mcmuffin'
    Dec 18, 2014 at 6:41
  • Although Bluetooth and WiFi can both operate in the 2.4GHz spectrum, the specifications are fundamentally different. I haven't performed the experiment but I'd be astonished if a Bluetooth device could associate with a WiFi router, and yes, I'd expect that you'd see only devices that had associated with the router, i.e. had passed authentication.
    – Bob Brown
    Dec 18, 2014 at 11:48
  • From wikipedia: "A personal area network (PAN) is a computer network used for data transmission among devices such as computers, telephones and personal digital assistants. PANs can be used for communication among the personal devices themselves (intrapersonal communication), or for connecting to a higher level network and the Internet (an uplink)." But if you CAN connect to Internet with PAN, there must be a router in the way...
    – wtrmeln
    Dec 19, 2014 at 10:31
  • Plus, support.apple.com/library/content/dam/edam/applecare/images/… it suggests that you actually have to add a router ip number in settings to have a PAN but I don't know if you can set up a connection like that on a mobile device.
    – wtrmeln
    Dec 19, 2014 at 10:35
0

You haven't noted the security algorithms in place on the access point, (Edit: just noticed that you did. Leaving the rest of the post intact though) but there are some that are insecure enough to be either effectively plain-text or trivial to crack the password to. 3 minutes seems more than reasonable for an automated attack on, say, WEP.

As far as the hostname and MAC, I would most definitely hide an automated Wi-Fi cracker behind an innocuous name like "H-iPhone" and give it an Apple vendor code. It makes a lot more sense than being detected because you named yourself "ImHaxoringUrWifis" with all 6s in the MAC.

The above is not intended to be a "definite", but more to show you that you can't assume the 3 minute timing and host/MAC pairings are necessarily indicative of a non-attack.

Improve this answer
1
  • But with the "Thailand-jungle-part" I can assume that :) Since I can actually see more of the surroundings than my Wifi covers, but I'll get your point thou. It is possible :)
    – swaglord mcmuffin'
    Dec 18, 2014 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.