6 ms·

I wonder if there are any unintended consequences for this. For example, if you were able to identify the MAC address, and you were unethical, you could just b

I wonder if there are any unintended consequences for this. For example, if you were able to identify the MAC address, and you were unethical, you could just blackmail the "bomber" - whether they are innocent or not. Also, some devices allow you to reprogram the MAC address so you could in theory use this to blackmail someone as well, or at least get them harassed by the police.

devereaux 8y ago
For one, it gives you a nice mac address you can use with "ifconfig wlan0 hw ether..." next time you go to a cybercafé in Europe
kencausey 8y ago
Yes, I think the fact that MAC addresses are often changeable, sometimes quite easily, is going to be an issue if this evidence is ever used in court.
- darkpuma 8y ago
  Probably not. By the time it gets to a courtroom they'll almost certainly have a lot more than just MAC addresses, so while the bomber might plead "some jackass spoofed my MAC address to frame me", that wouldn't explain his purchase history, the explosives residue around his home and clothing, etc. A MAC address doesn't prove anything, but courtrooms aren't about proof. They're evidence, not proof, and enough evidence is all the German prosecution should need to have a relatively easy time in court.
  - jakejarvis 8y ago
    I'm certainly no legal expert, but wouldn't the whole "fruit of the poisonous tree" argument apply to any evidence found after and/or as a result of the MAC address connection?
    - llukas 8y ago
      There is no such thing outside common law. ie most of Europe.
      - donarb 8y ago
        In addition, the concept only pertains to information acquired through unconstitutional means, such as not having a warrant to search. Getting incorrect information is not unconstitutional and investigators rely on much more than a single piece of information when building a case. Edit: by unconstitutional I’m speaking of the US. I am not sure what constitutional protections apply to other country’s citizens, but assume they may be similar.
      - matt4077 8y ago
        There definitely is, just not using that name. In Germany, it’s an explicit law. It just doesn’t apply in this case, because it hinges on bad faith. Incidental evidence found while following some other legitimate trails is admissible.
    - roywiggins 8y ago
      If the cops get a search warrant for an address and it turns out that the bad guy lived next door, but the real occupants are running a meth lab, there's no doctrine anywhere that would suppress the evidence they find. As long as it's an honest mistake there's no problem.
    - blattimwind 8y ago
      This argument largely does not exist outside English law. Though I very much doubt it would apply, if it did.
      - stordoff 8y ago
        IIRC, it's barely a concept in English law, primarily US law. It has however seen some use in the ECHR , notably against Germany (citing various US court cases): > the applicant sought a declaration that [...] all items of evidence[...], which had become known to the investigation authorities because of the confession extracted – the so-called “fruit of the poisonous tree” – was prohibited [...] The Chamber considered that there was a strong presumption that the use of items of evidence obtained as the fruit of a confession extracted by means contrary to Article 3 rendered a trial as a whole unfair in the same way as the use of the extracted confession itself. Gäfgen v. Germany, at 25 and 147 https://hudoc.echr.coe.int/eng#{%22dmdocnumber%22:[%22868977%22],%22itemid%22:[%22001-99015%22] https://hudoc.echr.coe.int/eng#{%22dmdocnumber%22:[%22868977...} It almost certainly wouldn't apply here though (as there is no illegal act).
arunforthemunni 8y ago
I wonder about how a bunch of WAN interfaces being mac spoofed to replicate the evil MAC would be delt with?
- detaro 8y ago
  If the prosecutor is annoyed enough and it's clear enough you did it because of this, not some weird accident, "interference with a criminal investigation"?
  - arunforthemunni 8y ago
    very likely, but the guy that "owns" the mac is up for more than interfering. so its a win for him, not that its even remotly cool but this could take some time to resolve and get worse in the meantime.
- darkpuma 8y ago
  If police announced that they were looking for a guy in an orange jacket, you could put on an orange jacket and run around town generating lots of false reports. But why would you do that? That would be incredibly antisocial. As usual, the tech angle to this story doesn't make the story particularly novel, but some tech-oriented people seem to have trouble perceiving that. E.g. people commenting that MAC addresses aren't unique, as if other forms of police descriptions of suspects (like height, hair color, or clothing) are unique...
Mediterraneo10 8y ago
> Also, some devices allow you to reprogram the MAC address I might be mistaken, but don’t changed MAC addresses (at least using macchanger) persist only until the next reboot?
- inetknght 8y ago
  Any operating system worth its salt will save the changed address and reload it before/while bringing up the network drivers. It's often necessary to do this in order to connect to certain networks, so it'd be super annoying if you'd have to remember the address and type it in every time.
  - Mediterraneo10 8y ago
    > Any operating system worth its salt will save the changed address and reload it before/while bringing up the network drivers. Yes, but in the event that someone were reported to the police, any reasonably competent police force is going to check the device MAC independent of whatever operating system boots on the system, and so being able to falsely accuse another does not seem like a big danger here.
  - Johnny555 8y ago
    If you're going through the trouble of changing your MAC address, why would you want it to persist across reboots? If anything you'd want to change it with every reboot, and if you're really trying to hide something, you'd want to change it more often.
- wyldfire 8y ago
  Any volatile setting that can be changed can be made to be persistent.
  - deleted 8y ago
    [deleted]
- zaarn 8y ago
  I doubt it would stand up as good evidence in court, though it would help in finding at least some suspects.
renholder 8y ago
>For example, if you were able to identify the MAC address, and you were unethical, you could just blackmail the "bomber" - whether they are innocent or not. Didn't something along the lines of this happen with this with the Boston bombing and /r/, where they named the wrong - and innocent - person? >Also, some devices allow you to reprogram the MAC address so you could in theory use this to blackmail someone as well, or at least get them harassed by the police. According to IEEE[1], that MAC belongs to a Morotola Mobility, LLC. (a Lenovo Company) device. If anyone had a device in the F8E079 family, they would be - rightfully - shitting bricks, right now, for being correlated with it. So, to summarise: No, I don't think anything good (initially) will come of this. Also, it's a family included in macchanger, so that makes it ever-more probable that the mac address has - at some point - been used by someone else. macchanger -l | grep "f8:e0:79" 18898 - f8:e0:79 - Motorola Mobility LLC [1] - https://regauth.standards.ieee.org/standards-ra-web/pub/view.html#registries https://regauth.standards.ieee.org/standards-ra-web/pub/view...
- Johnny555 8y ago
  If anyone had a device in the F8E079 family, they would be - rightfully - shitting bricks, right now, for being correlated with it. Only if one normally shits bricks about something that's a 1 in 16 million chance of happening. But if someone does know that their MAC OUI is F8E079, they almost certainly know the rest of the MAC so they can rest easily unless it happens to match the published one. Also, it's a family included in macchanger, so that makes it ever-more probable that the mac address has - at some point - been used by someone else. macchanger -l just dumps the list of ~18,000 OUI's known to macchanger, so it doesn't really mean that it's more likely to have been set by someone using macchanger.
f- 8y ago
I'm no expert, but "blackmailing a bomber" does not sound like a particularly solid business plan...
- deleted 8y ago
  [deleted]
- toufiqbarhamov 8y ago
  It has to be up there with some of the all-time bad notions. Personally my mind immediately went to that scene in The Dark Knight... https://m.youtube.com/watch?v=AUfv32dmVFw https://m.youtube.com/watch?v=AUfv32dmVFw
- noobermin 8y ago
  The former possibility is problematic, but using it to get the police to harass someone is a real possibility. Just look at "swating" in the US.
- coldtea 8y ago
  Sounds like the "brilliant" idea that a Coen Brothers character would have...
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
nty 8y ago
So what? They'd investigate the victim, find nothing, and leave him be.
- coldtea 8y ago
  There have been far too many cases where they " investigate the [suspect], find nothing", and still charge them or harass them, even making stuff up or withholding evidence from the courts, because they "know for sure" that they did it. Especially if the suspect is black, muslim, immigrant, etc.

devereaux 8y ago

For one, it gives you a nice mac address you can use with "ifconfig wlan0 hw ether..." next time you go to a cybercafé in Europe

kencausey 8y ago

Yes, I think the fact that MAC addresses are often changeable, sometimes quite easily, is going to be an issue if this evidence is ever used in court.

darkpuma 8y ago
Probably not. By the time it gets to a courtroom they'll almost certainly have a lot more than just MAC addresses, so while the bomber might plead "some jackass spoofed my MAC address to frame me", that wouldn't explain his purchase history, the explosives residue around his home and clothing, etc. A MAC address doesn't prove anything, but courtrooms aren't about proof. They're evidence, not proof, and enough evidence is all the German prosecution should need to have a relatively easy time in court.
- jakejarvis 8y ago
  I'm certainly no legal expert, but wouldn't the whole "fruit of the poisonous tree" argument apply to any evidence found after and/or as a result of the MAC address connection?
  - llukas 8y ago
    There is no such thing outside common law. ie most of Europe.
    - donarb 8y ago
      In addition, the concept only pertains to information acquired through unconstitutional means, such as not having a warrant to search. Getting incorrect information is not unconstitutional and investigators rely on much more than a single piece of information when building a case. Edit: by unconstitutional I’m speaking of the US. I am not sure what constitutional protections apply to other country’s citizens, but assume they may be similar.
    - matt4077 8y ago
      There definitely is, just not using that name. In Germany, it’s an explicit law. It just doesn’t apply in this case, because it hinges on bad faith. Incidental evidence found while following some other legitimate trails is admissible.
  - roywiggins 8y ago
    If the cops get a search warrant for an address and it turns out that the bad guy lived next door, but the real occupants are running a meth lab, there's no doctrine anywhere that would suppress the evidence they find. As long as it's an honest mistake there's no problem.
  - blattimwind 8y ago
    This argument largely does not exist outside English law. Though I very much doubt it would apply, if it did.
    - stordoff 8y ago
      IIRC, it's barely a concept in English law, primarily US law. It has however seen some use in the ECHR , notably against Germany (citing various US court cases): > the applicant sought a declaration that [...] all items of evidence[...], which had become known to the investigation authorities because of the confession extracted – the so-called “fruit of the poisonous tree” – was prohibited [...] The Chamber considered that there was a strong presumption that the use of items of evidence obtained as the fruit of a confession extracted by means contrary to Article 3 rendered a trial as a whole unfair in the same way as the use of the extracted confession itself. Gäfgen v. Germany, at 25 and 147 https://hudoc.echr.coe.int/eng#{%22dmdocnumber%22:[%22868977%22],%22itemid%22:[%22001-99015%22] https://hudoc.echr.coe.int/eng#{%22dmdocnumber%22:[%22868977...} It almost certainly wouldn't apply here though (as there is no illegal act).

arunforthemunni 8y ago

I wonder about how a bunch of WAN interfaces being mac spoofed to replicate the evil MAC would be delt with?

detaro 8y ago
If the prosecutor is annoyed enough and it's clear enough you did it because of this, not some weird accident, "interference with a criminal investigation"?
- arunforthemunni 8y ago
  very likely, but the guy that "owns" the mac is up for more than interfering. so its a win for him, not that its even remotly cool but this could take some time to resolve and get worse in the meantime.
darkpuma 8y ago
If police announced that they were looking for a guy in an orange jacket, you could put on an orange jacket and run around town generating lots of false reports. But why would you do that? That would be incredibly antisocial. As usual, the tech angle to this story doesn't make the story particularly novel, but some tech-oriented people seem to have trouble perceiving that. E.g. people commenting that MAC addresses aren't unique, as if other forms of police descriptions of suspects (like height, hair color, or clothing) are unique...

Mediterraneo10 8y ago

> Also, some devices allow you to reprogram the MAC address I might be mistaken, but don’t changed MAC addresses (at least using macchanger) persist only until the next reboot?

inetknght 8y ago
Any operating system worth its salt will save the changed address and reload it before/while bringing up the network drivers. It's often necessary to do this in order to connect to certain networks, so it'd be super annoying if you'd have to remember the address and type it in every time.
- Mediterraneo10 8y ago
  > Any operating system worth its salt will save the changed address and reload it before/while bringing up the network drivers. Yes, but in the event that someone were reported to the police, any reasonably competent police force is going to check the device MAC independent of whatever operating system boots on the system, and so being able to falsely accuse another does not seem like a big danger here.
- Johnny555 8y ago
  If you're going through the trouble of changing your MAC address, why would you want it to persist across reboots? If anything you'd want to change it with every reboot, and if you're really trying to hide something, you'd want to change it more often.
wyldfire 8y ago
Any volatile setting that can be changed can be made to be persistent.
- deleted 8y ago
  [deleted]
zaarn 8y ago
I doubt it would stand up as good evidence in court, though it would help in finding at least some suspects.

renholder 8y ago

>For example, if you were able to identify the MAC address, and you were unethical, you could just blackmail the "bomber" - whether they are innocent or not. Didn't something along the lines of this happen with this with the Boston bombing and /r/, where they named the wrong - and innocent - person? >Also, some devices allow you to reprogram the MAC address so you could in theory use this to blackmail someone as well, or at least get them harassed by the police. According to IEEE[1], that MAC belongs to a Morotola Mobility, LLC. (a Lenovo Company) device. If anyone had a device in the F8E079 family, they would be - rightfully - shitting bricks, right now, for being correlated with it. So, to summarise: No, I don't think anything good (initially) will come of this. Also, it's a family included in macchanger, so that makes it ever-more probable that the mac address has - at some point - been used by someone else. macchanger -l | grep "f8:e0:79" 18898 - f8:e0:79 - Motorola Mobility LLC [1] - https://regauth.standards.ieee.org/standards-ra-web/pub/view.html#registries https://regauth.standards.ieee.org/standards-ra-web/pub/view...

Johnny555 8y ago
If anyone had a device in the F8E079 family, they would be - rightfully - shitting bricks, right now, for being correlated with it. Only if one normally shits bricks about something that's a 1 in 16 million chance of happening. But if someone does know that their MAC OUI is F8E079, they almost certainly know the rest of the MAC so they can rest easily unless it happens to match the published one. Also, it's a family included in macchanger, so that makes it ever-more probable that the mac address has - at some point - been used by someone else. macchanger -l just dumps the list of ~18,000 OUI's known to macchanger, so it doesn't really mean that it's more likely to have been set by someone using macchanger.

f- 8y ago

I'm no expert, but "blackmailing a bomber" does not sound like a particularly solid business plan...

deleted 8y ago
[deleted]
toufiqbarhamov 8y ago
It has to be up there with some of the all-time bad notions. Personally my mind immediately went to that scene in The Dark Knight... https://m.youtube.com/watch?v=AUfv32dmVFw https://m.youtube.com/watch?v=AUfv32dmVFw
noobermin 8y ago
The former possibility is problematic, but using it to get the police to harass someone is a real possibility. Just look at "swating" in the US.
coldtea 8y ago
Sounds like the "brilliant" idea that a Coen Brothers character would have...

deleted 8y ago

[deleted]

deleted 8y ago

[deleted]

nty 8y ago

So what? They'd investigate the victim, find nothing, and leave him be.

coldtea 8y ago
There have been far too many cases where they " investigate the [suspect], find nothing", and still charge them or harass them, even making stuff up or withholding evidence from the courts, because they "know for sure" that they did it. Especially if the suspect is black, muslim, immigrant, etc.