7 ms·

It's worth noting the following facts: - There were a chain of human and technical vulnerabilities exploited - MAC addresses can be changed – nearly all ether

by dpwm 8y ago

It's worth noting the following facts: - There were a chain of human and technical vulnerabilities exploited - MAC addresses can be changed – nearly all ethernet controllers and some wireless chipsets support changing the MAC address; - MAC addresses are public knowledge. Anybody who ever receives a packet from your machine has your MAC address – and don't forget that Apple devices send tons of auto-discovery broadcast packets; and - Anybody suitably competent to pull off the technical side of the attack is likely to be able to spoof MAC addresses. It's worth noting that Knoll's letter also includes this gem of total misunderstanding: "... date stamps are easy to edit. In fact, the photos you shared with me clearly include an "edit" button in the upper corner for this very purpose." The article seems to me to be far more about low-burden-of-proof disciplinary panels – where the same people who set the rules interpret and administer the rules whilst trying to appear reasonable. The fact that a "defendant" asks for a date and time of alleged incidents before submitting evidence is not at all "puzzling" – the alternative is submitting every photo over a months-long time-frame, which is certainly not reasonable.

ec109685 8y ago
Your MAC address doesn’t leave your local network, so I am not sure how that can be used to track anyone?
- jsjohnst 8y ago
  I came here to comment that too. It didn’t sound like she was on a campus network from the article, so there is literally no way the university would know what MAC address was used.
- dpwm 8y ago
  "said to be traced from either her computer — based off a unique identifier, known as a MAC address — and the network she allegedly used, either the campus’s wireless network or her off-campus residence. When her grades went up, sometimes other students’ grades went down, the school said." I'm guessing that the evidence they've got is that the IT dept have the MAC address that was used by the devices that connected to their network, and have associated MAC addresses with the IP addresses allocated. Then that IP was used to connect to their internal system to change grades. It's pretty flimsy evidence, as anybody who had received a packet from her machine on the same network (i.e. if she ever connected to the university, which she allegedly did) would know the MAC address. So when I say it's public knowledge, I suppose I should've said it's public knowledge given you can connect to the same network. It really wouldn't be that hard to frame someone that way, and things like iTunes library sharing really help – because they conveniently tell you whose library is being shared. It's quite possible that somebody who knew who she was and who knew her MAC address could have done this. That could have been somebody sat in the same class. It's also entirely possible that she had the technical skills to pull of the technical side of the hack (bypassing 2fa) and didn't know a thing about networking. It also sounds like they have figured out the IP address that she has used to connect to her own university intranet account and found that it matched the IP that accessed the hijacked account. That's again pretty inconclusive.
nikofeyn 8y ago
that letter was hard to read. it was from someone who had already made up their mind and put up a reflector. her response made me think of someone playing play investigator and reminded me of michael bluth and maritime law in arrested development.
tptacek 8y ago
The more important part of the letter regarding the photos is the fact that they weren't produced until after the student was given the exact time periods of the incidents.
- oh_sigh 8y ago
  Is she supposed to just give every photo of herself to the school?
  - tptacek 8y ago
    She obviously doesn't have to, but the manner in which she turns over photos certainly impacts their credibility as evidence.
- cv120 8y ago
  The letter sounded as if it was part of a written conversation between two spouses fighting over when/what/where. Far too emotional and completely out of place for a Dean writing an official letter.
- upofadown 8y ago
  Obviously there would of been no point in producing random photos until they counted for an alibi.
  - darkpuma 8y ago
    That's true. But nevertheless it's still low quality evidence of her innocence.
    - ada1981 8y ago
      They could have said, ok, send us photos from this wide date range and then we will look to see. Even so, if she knew when she hacked the accounts she could create edited photos without them telling her when she hacked them (assuming she recalled when she did it)
xkcd-sucks 8y ago
Also the incentives of the university staff are not at all aligned with "the truth". If they spend a hundred hours investigating it and find that they really did falsely accuse her and cause her harm, it advances their careers no more than rubber-stamping her expulsion
uberman 8y ago
"MAC addresses can be changed – nearly all ethernet controllers and some wireless chipsets support changing the MAC address" Just to be clear. Windows 10, MacOS and Ubuntu, all allow one to set/override their MAC address usually via a dialogue box. I don't recall ever using a DSL/Cable modem that did not support setting/overriding the MAC address.
- sandworm101 8y ago
  Cellphones. Mine certainly doesn't allow me to alter my mac.
  - uberman 8y ago
    You must not be using android, because my android allows it without rooting
    - gamblor956 8y ago
      Some manufacturers and/or carriers require the phone to have developer options enabled (aka developer mode) for the MAC address to be changed, for example...most Verizon phones.
  - mindslight 8y ago
    FWIW, that says more about your relationship with "your" cell phone than its own capabilities. Protocol wise, a MAC address is fundamentally the choice of the client. And for cloning, they aren't even obscure but printed right on every device. That this has to be continually re-explained to lawyers unfamiliar with technology, because they see some identifier and immediately assert it's immutable until rebutted, is getting to the root of the real problem here. An ethernet MAC is at best, circumstantial - acceptable for tracking down a lead, but means jack-squat when it comes to proof. Furthermore, the fact that we're still going over this in a technology forum demonstrates the probable lack of competent diligence done by the school's IT department before presenting their "expert" opinion.
  - sfopdxnonstop 8y ago
biggestdecision 8y ago
> Anybody suitably competent to pull off the technical side of the attack is likely to be able to spoof MAC addresses. From reading the article, the technical side of the attacks seems to be illegitimately using an administrators password. There are no details of how the hacker obtained the password, perhaps they just glanced over the shoulder of the library staff member as they entered it?

by dpwm 8y ago

ec109685 8y ago

Your MAC address doesn’t leave your local network, so I am not sure how that can be used to track anyone?

jsjohnst 8y ago
I came here to comment that too. It didn’t sound like she was on a campus network from the article, so there is literally no way the university would know what MAC address was used.
dpwm 8y ago
"said to be traced from either her computer — based off a unique identifier, known as a MAC address — and the network she allegedly used, either the campus’s wireless network or her off-campus residence. When her grades went up, sometimes other students’ grades went down, the school said." I'm guessing that the evidence they've got is that the IT dept have the MAC address that was used by the devices that connected to their network, and have associated MAC addresses with the IP addresses allocated. Then that IP was used to connect to their internal system to change grades. It's pretty flimsy evidence, as anybody who had received a packet from her machine on the same network (i.e. if she ever connected to the university, which she allegedly did) would know the MAC address. So when I say it's public knowledge, I suppose I should've said it's public knowledge given you can connect to the same network. It really wouldn't be that hard to frame someone that way, and things like iTunes library sharing really help – because they conveniently tell you whose library is being shared. It's quite possible that somebody who knew who she was and who knew her MAC address could have done this. That could have been somebody sat in the same class. It's also entirely possible that she had the technical skills to pull of the technical side of the hack (bypassing 2fa) and didn't know a thing about networking. It also sounds like they have figured out the IP address that she has used to connect to her own university intranet account and found that it matched the IP that accessed the hijacked account. That's again pretty inconclusive.

nikofeyn 8y ago

that letter was hard to read. it was from someone who had already made up their mind and put up a reflector. her response made me think of someone playing play investigator and reminded me of michael bluth and maritime law in arrested development.

tptacek 8y ago

The more important part of the letter regarding the photos is the fact that they weren't produced until after the student was given the exact time periods of the incidents.

oh_sigh 8y ago
Is she supposed to just give every photo of herself to the school?
- tptacek 8y ago
  She obviously doesn't have to, but the manner in which she turns over photos certainly impacts their credibility as evidence.
cv120 8y ago
The letter sounded as if it was part of a written conversation between two spouses fighting over when/what/where. Far too emotional and completely out of place for a Dean writing an official letter.
upofadown 8y ago
Obviously there would of been no point in producing random photos until they counted for an alibi.
- darkpuma 8y ago
  That's true. But nevertheless it's still low quality evidence of her innocence.
  - ada1981 8y ago
    They could have said, ok, send us photos from this wide date range and then we will look to see. Even so, if she knew when she hacked the accounts she could create edited photos without them telling her when she hacked them (assuming she recalled when she did it)

xkcd-sucks 8y ago

Also the incentives of the university staff are not at all aligned with "the truth". If they spend a hundred hours investigating it and find that they really did falsely accuse her and cause her harm, it advances their careers no more than rubber-stamping her expulsion

uberman 8y ago

"MAC addresses can be changed – nearly all ethernet controllers and some wireless chipsets support changing the MAC address" Just to be clear. Windows 10, MacOS and Ubuntu, all allow one to set/override their MAC address usually via a dialogue box. I don't recall ever using a DSL/Cable modem that did not support setting/overriding the MAC address.

sandworm101 8y ago
Cellphones. Mine certainly doesn't allow me to alter my mac.
- uberman 8y ago
  You must not be using android, because my android allows it without rooting
  - gamblor956 8y ago
    Some manufacturers and/or carriers require the phone to have developer options enabled (aka developer mode) for the MAC address to be changed, for example...most Verizon phones.
- mindslight 8y ago
  FWIW, that says more about your relationship with "your" cell phone than its own capabilities. Protocol wise, a MAC address is fundamentally the choice of the client. And for cloning, they aren't even obscure but printed right on every device. That this has to be continually re-explained to lawyers unfamiliar with technology, because they see some identifier and immediately assert it's immutable until rebutted, is getting to the root of the real problem here. An ethernet MAC is at best, circumstantial - acceptable for tracking down a lead, but means jack-squat when it comes to proof. Furthermore, the fact that we're still going over this in a technology forum demonstrates the probable lack of competent diligence done by the school's IT department before presenting their "expert" opinion.
- sfopdxnonstop 8y ago

biggestdecision 8y ago

> Anybody suitably competent to pull off the technical side of the attack is likely to be able to spoof MAC addresses. From reading the article, the technical side of the attacks seems to be illegitimately using an administrators password. There are no details of how the hacker obtained the password, perhaps they just glanced over the shoulder of the library staff member as they entered it?