0

I found weird activity reported by my software that suggested multiple login attempts. The software is installed on that person's computer.

Don't worry the I am allowed to post the details up here since the person agreed to my Terms and Conditions that I can do this.

The MAC Address looks very strange

00FF2A4EA563

Anyone can figure out the vendor or VPN service that provided this MAC Address

Improve this question

2 Answers 2

Reset to default
0

Im sorry, but a Vendor or VPN service would make the encrypted mac address in a way so that no one would be able to find out where the MAC Address originated.

So i think you're lost on that one.

Improve this answer
1
  • No I meant who gave the address to that person not the location of the address where it was created.
    – Matty
    Jan 26, 2015 at 4:31
0

A MAC address is associated with hardware, but it can also be changed by the user/software. That means that its not possible to know if this address is even the default one assigned by the manufacturer.

Also, you need to specify more details in your question. It is not currently possible to give you a better answer when you have left out so much information: What software, network layout, what sort of attack and why would an attack agree to any TOS?

Improve this answer
4
  • The software is a software that I wrote. It is not public yet. However, it is distributed among many people.
    – Matty
    Jan 26, 2015 at 1:41
  • Could it be so simple that the attack is originating from the internet and going via the persons router/gateway to the client machine? Is it the persons router MAC you are seeing?
    – Christian Isaksson
    Jan 26, 2015 at 1:45
  • The software is a software that I wrote. It is not public yet. However, it is distributed among many people. My network is just the server connected directly to a router, the server is behind an NAT firewall. The TOS says that I am allowed to use the information (ip address and mac address of each activity) in any way I want and can even make it public. The attack is many failed login attempts. The person who tried to access the server many times changed his IP along the way once, first from US L.A and after that from Taiwan. No, the MAC of the attacking computer.
    – Matty
    Jan 26, 2015 at 1:49
  • I could only get the MAC when he was in US L.A, my software assumes that the MAC is permanent, so it only gets the MAC and no more on the first login. I only knew it was him through a generated unique identifier code that I designed which is stored in the person's computer. The code is always sent with every login attempt.
    – Matty
    Jan 26, 2015 at 1:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .