5 ms·

My high school provided MacBook Pros to students that would only connect to the network if the MAC address was whitelisted. Since I wanted to use my own newer M

My high school provided MacBook Pros to students that would only connect to the network if the MAC address was whitelisted. Since I wanted to use my own newer Mac, I spoofed the address of my school provided one. Since it was an open network, it was simple scraping the network for other connected devices and spoofing one at random, and I was surprised when the same technique worked in say, hotels with open networks.

adventurer 6y ago
I'm not positive if any of them charge at this point, but years ago this would also work at airports.
nanidin 6y ago
My university required registration of MAC addresses for whitelisting & bandwidth metering. My enterprising roommate and I worked out that we could bypass all bandwidth limitations by spoofing the MAC addresses of machines in the computer labs as long as the machine was turned off. We eventually got caught for using something like 90% of the university's total bandwidth - the security admin was thrown for quite a loop when he tracked down the machines that were supposedly using all of the bandwidth and found that they were turned off at the time. Apparently it took some creative techniques to figure out where the traffic was actually coming from. Our punishment was something like two weeks with all internet access revoked (except for the use of lab machines for classwork), plus a written apology, plus a signed agreement not to violate the acceptable use policies again or else face the real punishment for what we did. The school administrator in charge of the punishment asked the security admin what we were downloading (this was when the MPAA/RIAA were cracking down hard on people uploading files on sharing networks), but the security admin had mercy on us and told her he didn't think it was relevant, thank god!
- mercora 6y ago
  > Apparently it took some creative techniques to figure out where the traffic was actually coming from. probably they did lookup the MAC address on the switches and saw it on a port that did not match expectations. if you were using a wired connection this would trivially lead to you... on wireless you would have to narrow it down further by monitoring signal strength of the station :)
  - pastage 6y ago
    See how Aaron Schwartz got caught, if someone really wants to get you, even wireless is easy to trackdown if you physicaly visit the location.
- kome 6y ago
  wow, whitelisting & bandwidth metering - I never saw a university SO strict.
  - nanidin 6y ago
    This was ~15 years ago. The bandwidth metering was in place to throttle people doing big downloads via the internet. We had something like 1gb per week at 100mbps, then gradually got brought down to something like dialup. Internet2 was not metered. There were people running internal torrent trackers and file indexing/sharing sites on the LAN that could saturate the network infrastructure between the various dorms and buildings on campus. I guess the whitelisting also helped figure out who was doing what when problems happened.
  - yoz-y 6y ago
    In my uni there was a limit of one mac address per network socket in dorms (also metering). Also no wifi.
- schnevets 6y ago
  My university dorms didn't allow XBox 360s or other gaming systems on the network, so I did the same thing by spoofing my laptop's address. I wasn't much of a "HACKERMAN" growing up, but this was one accomplishment that really drew me in and caused me to start studying OSI.
siraben 6y ago
Since I have no use for it anymore, here is the script[0]. I wrote most of it during a free period :D [0] https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8f273 https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8...
- mercora 6y ago
  this[0] is likely slow because it will try to do reverse DNS lookups for each host which can be disabled, at least on linux, with "-n" [0] https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8f273#file-autocollect-sh-L71 https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8...
mercora 6y ago
>Since it was an open network, it was simple scraping the network for other connected devices and spoofing one at random you should probably know that using the same mac address in parallel will cause connectivity issues for both...
- siraben 6y ago
  Correct. In a sibling comment I posted the actual script I used that scrapes and dedupes, and a "spoof only" mode to lessen the chance of a collision.
- pvtmert 6y ago
  Yes but if they were connected to the same router. Most of these systems are distributed and having multiple APs connected to some central Radius server. Because modern systems optimize for roaming between nodes, you can join network, use dns-sd to gather mac addresses of the computers which are not physically connected to your AP (in conjuction with 'tcpdump -I') Then voila, 2 devices using same MAC without any problems. PS. I personally use "printer" addresses for 2 reasons: 1: generally everyone forgets to nicely setup firewall for them since they're infrastructure objects. 2: they have relatively less traffic and probably located some obsecure room with an AP for them.
  - mercora 6y ago
    i was less concerned about authentication issues and more about routing issues as ARP would lead to results depending on time and location inside the network topology...

adventurer 6y ago

I'm not positive if any of them charge at this point, but years ago this would also work at airports.

nanidin 6y ago

My university required registration of MAC addresses for whitelisting & bandwidth metering. My enterprising roommate and I worked out that we could bypass all bandwidth limitations by spoofing the MAC addresses of machines in the computer labs as long as the machine was turned off. We eventually got caught for using something like 90% of the university's total bandwidth - the security admin was thrown for quite a loop when he tracked down the machines that were supposedly using all of the bandwidth and found that they were turned off at the time. Apparently it took some creative techniques to figure out where the traffic was actually coming from. Our punishment was something like two weeks with all internet access revoked (except for the use of lab machines for classwork), plus a written apology, plus a signed agreement not to violate the acceptable use policies again or else face the real punishment for what we did. The school administrator in charge of the punishment asked the security admin what we were downloading (this was when the MPAA/RIAA were cracking down hard on people uploading files on sharing networks), but the security admin had mercy on us and told her he didn't think it was relevant, thank god!

mercora 6y ago
> Apparently it took some creative techniques to figure out where the traffic was actually coming from. probably they did lookup the MAC address on the switches and saw it on a port that did not match expectations. if you were using a wired connection this would trivially lead to you... on wireless you would have to narrow it down further by monitoring signal strength of the station :)
- pastage 6y ago
  See how Aaron Schwartz got caught, if someone really wants to get you, even wireless is easy to trackdown if you physicaly visit the location.
kome 6y ago
wow, whitelisting & bandwidth metering - I never saw a university SO strict.
- nanidin 6y ago
  This was ~15 years ago. The bandwidth metering was in place to throttle people doing big downloads via the internet. We had something like 1gb per week at 100mbps, then gradually got brought down to something like dialup. Internet2 was not metered. There were people running internal torrent trackers and file indexing/sharing sites on the LAN that could saturate the network infrastructure between the various dorms and buildings on campus. I guess the whitelisting also helped figure out who was doing what when problems happened.
- yoz-y 6y ago
  In my uni there was a limit of one mac address per network socket in dorms (also metering). Also no wifi.
schnevets 6y ago
My university dorms didn't allow XBox 360s or other gaming systems on the network, so I did the same thing by spoofing my laptop's address. I wasn't much of a "HACKERMAN" growing up, but this was one accomplishment that really drew me in and caused me to start studying OSI.

siraben 6y ago

Since I have no use for it anymore, here is the script[0]. I wrote most of it during a free period :D [0] https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8f273 https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8...

mercora 6y ago
this[0] is likely slow because it will try to do reverse DNS lookups for each host which can be disabled, at least on linux, with "-n" [0] https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8f273#file-autocollect-sh-L71 https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8...

mercora 6y ago

>Since it was an open network, it was simple scraping the network for other connected devices and spoofing one at random you should probably know that using the same mac address in parallel will cause connectivity issues for both...

siraben 6y ago
Correct. In a sibling comment I posted the actual script I used that scrapes and dedupes, and a "spoof only" mode to lessen the chance of a collision.
pvtmert 6y ago
Yes but if they were connected to the same router. Most of these systems are distributed and having multiple APs connected to some central Radius server. Because modern systems optimize for roaming between nodes, you can join network, use dns-sd to gather mac addresses of the computers which are not physically connected to your AP (in conjuction with 'tcpdump -I') Then voila, 2 devices using same MAC without any problems. PS. I personally use "printer" addresses for 2 reasons: 1: generally everyone forgets to nicely setup firewall for them since they're infrastructure objects. 2: they have relatively less traffic and probably located some obsecure room with an AP for them.
- mercora 6y ago
  i was less concerned about authentication issues and more about routing issues as ARP would lead to results depending on time and location inside the network topology...