MAC Address

From Kicksecure
Revision as of 02:25, 18 November 2024 by Nurmagoz (talk | contribs) (Created page with "<!-- Copyright: {{project_name_long}} MAC Address wiki page Copyright (C) Amnesia <amnesia at boum dot org> {{project_name_short}} MAC Address wiki page Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later v...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

MAC Address Spoofing and Tracking Threats

Info For Kicksecure on macOS, see macOS.

Introduction

All network cards, both wired and wireless, have a unique identifier called a MAC address. [1] MAC addresses are stored in hardware and are used to assign an address to computers on the local network.

The MAC address is normally not traceable because it is not passively sent to computers beyond the local router. [2] However, other computers on the local network can potentially log it, which would then provide proof the user's computer connected to that specific network. If users intend to use an untrusted, public network then MAC spoofing should be considered. [3]

MAC Spoofing Warning

Warning: According to recent research, MAC address spoofing is not effective against advanced tracking techniques that can still enumerate the address by inspecting the physical characteristics of the Wi-Fi card. [4] Unfortunately, a viable solution requires manufacturers to modify drivers or firmware of their hardware products to add privacy preserving mitigations.

Auto-connect Risk

Apart from the difficulty in creating an appropriate MAC address for spoofing purposes, there are also technical hurdles to overcome in the form of preventing automatic network connections.

It is futile to prepare a spoofed MAC address if the computer instantly connects to the public network after booting, disclosing the user's real MAC address in the process:

  • Kicksecure as a host: Kicksecure automatically connects to the internet after start.
  • USB Wi-FI Device: Automatic connections might also occur, depending on the configuration.

Burner Wi-Fi USB Sticks

One immediate workaround for the Wi-Fi card profiling threat is to buy new "burner" Wi-Fi USB sticks from different manufacturers. Take care to disable the computer's native Wi-Fi functionality in the BIOS settings if pursuing this option -- the computer's characteristics will have likely been logged if it was ever used from an untrusted hotspot. Burner devices should only be enabled for connectivity at the intended public destination. If this advice is ignored and burner devices are used for network connections at locations tied to or regularly visited by the user, this will defy the original purpose. A different burner stick should be used for each new location to avoid geographical profiling / tracking.

Random MAC Addresses

Warning: Using a completely random MAC address is not recommended. While this technique might be sufficient to confuse lesser adversaries, it will not defeat skilled adversaries.

The problem with using a random MAC address is that the chosen vendor ID may be non-existent. Even if it exists, it is possible to end up with a vendor ID which has either never been used or not for decades. When spoofing MAC addresses, it is critical to use a popular vendor ID. The initial, second part of the MAC address can safely be random or unique. [5]

Research on this issue is still ongoing. At present, Kicksecure cannot provide detailed instructions on how to create appropriate MAC addresses fulfilling the criteria above.

Other Location Tracking Risks

Authentication Fingerprinting Techniques

An authentication technique can fingerprint devices by observing inter-packet timings on a LAN's wire-segment; one side effect is that user devices can be tracked. The timing effects are the result of how various components in a machine create packets. [6] Fortunately, this technique cannot be used to identify devices across the Internet. [7]

This technique can be defeated by inducing random delays in a machine's packet stream. Since there is no problem with impersonating other devices on the LAN, it does not matter that such an authentication system will view these machines as "unknown". [8] Note also that spectrum analyzers have been used to fingerprint the unique electromagnetic (EM) characteristics of a Wi-Fi card. The disposable USB Wi-Fi workaround described further above would mitigate this attack. [9]

MAC Spoofing on Different Networks

Home Connections

Info Tip: MAC address changes for home connections are not required.

Warning: This recommendation comes with an important caveat. If a browser exploit is successfully used to reveal activities outside a VM, then the physical MAC address might be discovered by the attacker. If a user is already under suspicion, this would eventually provide proof of identity. In this scenario, if the MAC address was changed beforehand, then root access is required to discover the real physical address (this has not yet been tested).

Connectivity Risk

If the user's home network has a cable modem internet connection, the ISP either provides the cable modem device as part of the service or requires pre-registration of the MAC address of the self-provided cable modem in order to setup the service.

If a user manages to hack or change the MAC address of the modem, the service would immediately cease functioning because the IP address assignment is apportioned for, and bound to, that specific MAC address. As a result, when connecting from behind a cable modem/NAT router, MAC address spoofing of the computer's ethernet adapter may be pointless. If a user is traced, the trackable endpoint will be the MAC address of the cable modem device.

Public Computers

Info This refers to use of computers in public places like libraries and Internet cafes.

The MAC address should not be changed in this scenario, otherwise it may bring undesired administrator attention to the service/user and/or simply prevent access to the Internet.

Changing MAC Addresses

Linux Hosts

If you are interested in MAC address spoofing in Kicksecure, please press on Expand on the right.

Qubes Hosts

Info Qubes OS does not currently "anonymize" or spoof the MAC address automatically in all cases.

Qubes users can manually change MAC addresses in the NetVM by following either the Network Manager or macchanger guides. MAC Address Randomization capability for Wi-Fiarchive.org iconarchive.today icon has been implemented.

network: enable MAC randomization for wifi connections by defaultarchive.org iconarchive.today icon was implemented.

This is currently applied by Debian and Fedora templates only.https://github.com/QubesOS/qubes-issues/issues/938#issuecomment-1221605861archive.org iconarchive.today icon

ethernet mac randomization by default, which was denied.https://github.com/QubesOS/qubes-issues/issues/938#issuecomment-1300587911archive.org iconarchive.today icon

Consequently, users wanting ethernet mac randomization will need to modify their templates manually, and in all new downloaded templates after OEL deprecation,https://github.com/QubesOS/qubes-issues/issues/938#issuecomment-1300587911archive.org iconarchive.today icon

Refer to the following Qubes documentation and related support items for further information and advice:

Sources

See footnote. [10]

References

  1. ↑ https://en.wikipedia.org/wiki/MAC_addressarchive.org iconarchive.today icon
  2. ↑ Unless the computer is infected with malwarearchive.org iconarchive.today icon designed to disclose this identifier.
  3. ↑ https://en.wikipedia.org/wiki/MAC_spoofingarchive.org iconarchive.today icon
  4. ↑ Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanismsarchive.org iconarchive.today icon
  5. ↑ Also note that if MAC address changing is always enabled, it might cause connectivity problems on some networks.
  6. ↑ A Passive Technique for Fingerprinting Wireless Devices with Wired-side Observationsarchive.org iconarchive.today icon
  7. ↑ The primary weakness of this technique is that it relies on fine-grained packet timing; timing that is lost as a result of buffering in switches and routers. Therefore, this technique and similar methods are not suited for identification across the Internet. Rather, it is perfectly suited for the significant challenge of local network access control and other local network activities like counterfeit detection.
  8. ↑ Figure 7(a) shows attackers that can vary their packet sizes, change their data rate, and tunnel their packets through another protocol. Figure 7(b) presents attackers that can introduce constant or random delays to the packet stream and load the CPU with intensive applications to overshadow normal behavior. Figure 7(c) shows an attacker that can modify or change its operating system. GTID (the passive fingerprinting method) detects these attacks and classifies all of these devices that generated attack traffic from previously seen devices as unknown.
  9. ↑ There have also been physical layer approaches to fingerprinting wireless devices. Radio frequency (RF) emitter fingerprinting uses the distinct EM characteristics that arise from differences in circuit topology and manufacturing tolerances. This approach has a history of use in cellular systems and has more recently been applied to Wi-Fi and Bluetooth emitters. The EM properties fingerprint the unique transmitter of a signal and these differ from emitter to emitter. This technique requires expensive signal analyzer hardware to be within RF range of the target.
  10. ↑

License

Kicksecure MAC Address wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Kicksecure MAC Address wiki page Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <

This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=MAC_Address&oldid=88240"