1

I locked down my whole network’s MAC addresses so that only NICs on the whitelist can get an IP from the AirPort Extreme DHCP server and router. Well, guess what. A Mavericks VM with a completely different MAC address from its hosts MAC address can request an IP through its host’s sanctioned MAC address connection, and the AirPort Extreme will hand over a viable and working IP to a VM with MAC address NOT on the white list, and that now connected VM can see the whole LAN and Internet, even though its own MAC address is NOT on the white list! This appears to be a glaring security hole. Is it? For instance...

Now that I have an IP, I can clone myself, and try to run independent of the host which created and holds my VM's data structures. In my case, the host had 10.0.1.16, and the VM got 10.0.1.100 (my forced pool of at least 1 spare IP as dictated by the AirPort Extreme). I’m not sure that once I have an IP, if the MAC address is checked again for communication to the LAN, but why would it? The DHCP has allocated an IP to a device, and that device can now talk as if it is the true host that was given the IP.

We used to use other hosts’ IPs all the time when I worked at Boeing - the ones that we knew were offline; we just borrowed their IPs to eliminate lots of paperwork to test various flight control systems. :-)

But the bottom line is that at a minimum, through a connected host, I am able to get an IP and use a network, even though MAC filtering is turned on, and my own host is not on the whitelist.

In my opinion, this is a problem. I’m not sure where the fault lies at this point. Could it be with the DHCP protocol itself? I don’t know, but as time permits, I will investigate it. I am certain that given enough time, I can exploit this, and take over my own network. How do I stop this from happening? I have other WiFi routers that I could give this a try with, but at this point, can anyone with a better understanding of WiFi, DHCP, routing, etc. please advise me as to whether this is a real problem to concern myself over.

Improve this question
15
  • 2
    I reckon MAC address filtering isn't particularly secure anyway. Most network devices can be configured to use a different MAC address to the default hardware-assigned one, so someone could read the MAC address label (for example the physical sticker on the wlan card on a laptop) and set their own laptop to use that MAC address
    – laurencemadill
    Apr 15, 2014 at 14:16
  • 1
    MAC address filtering is not a robust defense to secure your network. MAC addresses are easily spoofed and hence the defense is easily bypassed. You might look into 802.1x Authentication if you really need this, but that is way overkill for most networks.
    – heavyd
    Apr 15, 2014 at 14:16
  • I agree. We keep our MAC addresses as secure as our passwords. In fact, we made sure we wiped various WiFi routers that proved to be unsatisfactory before returning them to the store. For someone who wants to assign known IPs to their equipment for various technical reasons, and prevent unwanted access, MAC address filtering and WPA2, with no physical access to the equipment, should be enough for home use, no?
    – Billy McCloskey
    Apr 15, 2014 at 14:18
  • 6
    You do understand this whitelist is basically broadcasted in plain text to all devices attempting to connect to the access point right? MAC filtering is not a security feature.
    – Ramhound
    Apr 15, 2014 at 14:28
  • 1
    @BillMcCloskey - Again; MAC filtering isn't a security feature. Its a networking mangement tool.
    – Ramhound
    Apr 15, 2014 at 15:14

2 Answers 2

Reset to default
1

You're confusing two different layers of the OSI model. Your AirPort's MAC filtering is an access control mechanism for layer 2 which has nothing to do with DHCP. Since your VM is connecting to your AirPort via your Mac, it uses your Mac's MAC address for layer 2 communication.

What you are thinking of is a DHCP server without any dynamic pools. This however will only solve the other half. "Foreign" clients will be able to connect but will not be issued an IP address, but they can use a static IP configuration.

In order to accomplish both together, you would need a layer 4-7 router which generally cost > $10,000 new.

*Let me know if you want me to explain it further

Improve this answer
0

There is such a thing as "MAC NAT" and your VM software may be using this.

Please note that if someone obtains hardware or a wireless NIC capable of monitoring the channel your wireless network is on, the MAC addresses are visible even though their payload, the actual traffic, is encrypted.

Apologies for not really going into detail on what "MAC NAT" is. And it may not be what is really going on, just the first thing that came to my mind.

A Mavericks VM with a completely different MAC address from its hosts MAC address can request an IP through its host’s sanctioned MAC address connection, and the AirPort Extreme will hand over a viable and working IP to a VM with MAC address NOT on the white list

Have you verified on the AirPort router that it sees the VM's MAC, or the hosts' MAC? In a similar way that IP addresses can be NATted into private ranges for home use, MAC addresses can also be NATted, though the capability is typically not exposed on consumer Wifi routers. In this case, it'd be the VM software on the computer running the VM doing the MAC NAT, and not your router.

Is this system connected to the AirPort via a wired connection? If so, the MAC filter probably only applies to wireless connections.

Improve this answer
3
  • My network "Router Mode" is "DHCP and NAT." I can see where you are heading with this, but my understanding of the nomenclature and underlying architecture is rudimentary. Yes, that would be a good experiment. Try pure DHCP mode and see what happens. Thanks for pointing that out. Won't get back to trying this until my wife is off the network, you see, it is April 15th!
    – Billy McCloskey
    Apr 15, 2014 at 15:23
  • Hey @ultrasawblade - Changed my router from "DHCP and NAT" to "DHCP Only", and the router "kindly" changed all my DHCP Reservations to correspond with the internet service providers supplied dynamic IP. In other words, the router re-based my LAN's IPs from 10.0.1.1 to the Internet IP base + offset i.e. 23.N.0.1-255 with appropriate subnet mask. Saving the same config yields, "Sharing a range of IP address using DHCP Only requires manually configuring your WAN IP address..." My router is now expecting a service supplied range of static IPs! Answer: "DHCP and NAT" is desirable.
    – Billy McCloskey
    Apr 16, 2014 at 3:57
  • To everyone tinkering with their router's configuration, if there is a way to backup and restore the router's configuration to disk file, edit that file with an appropriate property editor, and restore that config to the router from file, I'd strongly suggest doing things that way. Relying on the router's toolset for configuration updates is notoriously slow, prone to error, and leads to lots of time re-doing things. Saving the router's base configuration, and subsequent stable configurations, and loading the same to the router is a great idea. IMHO.
    – Billy McCloskey
    Apr 16, 2014 at 4:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .