13

Most wireless routers can use MAC-based authentication as part of their overall security scheme. It seems like a good idea, but I've heard that it is very ineffective, because it's easy to spoof MAC addresses.

I believe that it's easy to spoof these addresses, but I don't see how that's a problem. Wouldn't hackers still need to know what MAC address to pretend to have? There are 16^16 possible MAC addresses, so that doesn't seem like too big of a problem to me. Can anyone explain?

7 Answers 7

7

In an ethernet network the MAC address is used to uniquely identify each node (computer etc) on the network. Every packet broadcast over the network must contain the MAC address of the intended receiver to ensure packets get where they need to go.

Therefore using a packet sniffing tool it is quite easy to extract valid MAC addresses "off the wire". Once you have the MAC address, as you already know, spoofing the MAC address is even easier.

Also, I seem to remember that MAC addresses are part of the OSI Data Link layer (level 2) and are still visible in packets even if encryption such as WEP / WPA2 is used. This may have changed more recently however.

29

Even with wireless encryption enabled, MAC addresses are sent unencrypted. The reason for this is that if you encrypted the MAC address, every client on the wireless network would need to decrypt every single packet, just to find out whether it was sent to them or not.

Imagine watching a Netflix movie on your laptop using your home wireless connection, with a smartphone in your pocket also connected to the wifi. Your phone would need to receive every packet containing the streaming movie, decrypt it, then discard it. This would consume a huge amount of CPU and battery for no real reason.

Since the MAC address in each packet is always unencrypted, it's trivial for any attacker to run a packet sniffer, get a list of all the MAC addresses communicating on the network, then impersonate one of them.

Security Now podcast #11 (MP3, transcript) covers MAC filtering as well as WEP, disabling SSID broadcasts, and other ineffective ways of securing a wireless network.

3
  • If I'm using WPA, will the MAC portion of the packets still be unencrypted?
    – AaronLS
    Aug 7, 2009 at 5:45
  • 5
    Yes. The MAC portion is always unencrypted. Aug 7, 2009 at 8:15
  • This is definitely a much better answer than the current accepted one.
    – cregox
    Mar 31, 2010 at 21:48
4

It's only insecure if you actually have something valuable to protect. If you're just trying to prevent unauthorized users from using your wireless connection MAC-based authentication is fine.

MAC addresses aren't intended to be kept private, so it's very easy for someone to clone it.

1
  • This is a good point. For most home networks the main goal is to make it difficult for people to leech your bandwidth. MAC filtering does this. Anything that requires real security on my computer I use HTTPS web sites or some local encryption scheme.
    – Ash
    Aug 7, 2009 at 3:10
4

It's bad because those who use it, apparently think it makes things more secure. And it's that wrong feeling of security that's the problem.

(Don't bother to filter on MAC-address, nor to hide the SSID. Use WPA or WPA2 with a good passphrase instead.)

2
  • Use WPA2, it seems WPA is also broken: networkworld.com/news/2009/…
    – CesarB
    Sep 29, 2009 at 2:44
  • Well, "broken" in the strict cryptographic sense (some information can be recovered). You cannot yet decrypt all the traffic. Still, you should switch to WPA2 ASAP.
    – sleske
    Jan 4, 2010 at 11:54
2

In computer security there is a statement "Users are the weakest links in the security chain " So I can imagine a one situation.

Say an internal user wants to do something "illegal".. So in this case he can use the MAC of his own machine and do whatever thing he want. Since the admins can see it is a "hack" there is no responsibility of the real user.

And as far as I know a user can scan for the MAC addresses within the LAN. I think packet sniffer tools can retrieve them. So in that case he can steal a MAC of a his mate as well.

Don't think the hackers are from the outside. They may be insiders as well.

0

I think it would be fairly trivial to find your MAC address if you were on any network other than your own along with a hacker. Not to mention, the MAC addresses aren't random. The first X digits represent the make of the router and I believe the other digits represent other things as well.

1
  • 2
    Part of the address is a number purchased by each manufacturer from the registrar. The rest is at the whim of each manufacturer to assign, as long as they guarantee that no two devices are ever shipped with the same address. The easiest way to meet that guarantee is often to dole them out sequentially from a single record keeper within the company.
    – RBerteig
    Aug 7, 2009 at 7:23
0

While they are easy to spoof, it is more work for the hacker to do so. I don't think it will hurt as part of your overall security scheme. Just don't rely on it alone.

2
  • Doesn't really answer the question... Should probably be a comment. Aug 8, 2009 at 17:22
  • 3
    It hurts, because you spend time and effort on implementing scheme that doesn't deter intruders (false sense of security) and usually annoys legit users (e.g. when they want to use new device or have network card/motherboard replaced).
    – Kornel
    Aug 31, 2009 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .