5 ms·
Time to invest in a DD-WRT router to be sure there aren't any backdoors for ARP requests to map IP addresses to physical hardware.
by pilom 16y ago
Time to invest in a DD-WRT router to be sure there aren't any backdoors for ARP requests to map IP addresses to physical hardware.
- blhack 16y agoYou should elaborate on that so other people reading the discussion can get an idea what you're talking about.
- ramidarigaz 16y agoMy understanding is that proprietary router firmware may have unknown vulnerabilities that someone could use to discover the MAC addresses of computers making specific requests. That would allow, for instance, law enforcement to tie internet usage to specific computers. DD-WRT and other open source firmware should be a little more secure in this regard. The open source firmware out there is definitely more reliable over long periods of time than the stock firmware that comes on most routers, so I assume it's also more secure.
- pilom 16y agoCouldn't have said it better myself.
- yid 16y agoMAC addresses can be easily spoofed. For example, on some ethernet cards: sudo ifconfig eth0 hw ether 00:12:34:56:78:9A will change your hardware address.
- zcid 16y agoTrue but if your MAC just happened to match a MAC the litigating attorney had on file due to the exploits which ChuckMcM is referring, it would be much more difficult to claim innocence as you can do with a shared IP. MAC spoofing would only be relevant if you were regularly using random spoofed MACs on your own network.
- sigil 16y ago> MAC spoofing would only be relevant if you were regularly using random spoofed MACs on your own network. Or, if for some reason that practice was widespread enough that it provided plausible deniability.
- holdenk 16y agoThe case for MAC spoofing being common (at least with people "borrowing" your wi-fi) makes sense because some networks have MAC address based white lists, so this defense isn't quite as crazy as it sounds at first. IANAL etc.
- yid 16y agoNot necessary -- someone could spoof their MAC to match mine. IMO, this is more likely when there is already malicious intent, and it's almost trivial to do.
- deleted 16y ago[deleted]
- epochwolf 16y agoI've used spoofing frequently on a local college's campus to get around blocks they've put on my system. Apparently some of the student use Ethernet jacks aren't for student use.
- sigil 16y agoYup. I've actually used this, to work around certain cable modems that only allow the mac address they were set up from.
- JonnieCache 16y agoJust use the DD-WRT feature that lets you have 2 APs, one encrypted and one open. Connect all your kit to the private one, and limit the outgoing bandwidth of the open one. This should surely give both security and plausible deniability?
- pilom 16y agoThey still break down your door though.