Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #69710

Re: Apple Time Capsule -- Unknown User

Show all headers | View raw

On 2015-02-11, nospam <nospam@nospam.invalid> wrote:
> In article <ck1c7hFpnuqU5@mid.individual.net>, Jolly Roger
><jollyroger@pobox.com> wrote:
>
>> >>> > And what he said is technically true. MAC address white lists *do*
>> >>> > prevent devices with MAC addresses that are not on the list from
>> >>> > connecting.
>> >>> 
>> >>> But it is trivial to spoof a MAC address that IS on the list.
>> >>
>> >> But one would first have to know that MAC address.
>> >
>> > And it is trivial to discover them.
>> 
>> I'm in. How would I discover the MAC addresses in a router MAC address
>> filter list? Got a link handy?
>
> the original claim was to block the offending mac address, so simply
> changing it to *anything* else will let them in. change just one digit
> and it will work. 

Actually, the original claim was that there is a *whitelist* of
acceptable MAC addresses, where any device whose MAC address was not
registered would not be able to connect, which is how most routers I
have used work:

On 2015-02-10, Paul Sture <nospam@sture.ch> wrote:
>
> I'm not using an Airport but I whitelist the MAC addresses belonging
> to my devices; any device not registered there cannot connect.
>
> Can an Airport do that?

Honestly, I don't get why you continue to argue about this. It's pretty
silly. 

> if there is a list of allowed mac addresses (which is a huge pain to
> maintain)

It's not a huge pain for those wanting to use it. I've done it in the
past myself. All it takes is knowledge of the MAC addresses of the
devices to be allowed on the network. If you have an Apple access point,
configuration of the whitelist is ultra-simple. I've also done it on
Netgear and others, which are also not all that complicated.

> then all it takes is watching traffic since mac addresses
> are always sent unencrypted (they have to be) and then pick one. 

Casual users don't typically have traffic-watching apps on their phones
or computers though. Casual users also don't typically have the ability
to *change* the MAC address of the device they want to connect. In fact
it's not even possible on most iOS devices, since most are not
jailbroken. Again, it's meant to *augment* rather than replace security
measures, to prevent casual connections from unknown devices.

> although it's possible that there will be zero devices connected and
> therefore no mac addresses to find, that is *extremely* unlikely,
> especially these days with mobile devices, set top boxes, thermostats,
> etc., that all connect via wifi. in other words, it's pretty much
> guaranteed that there will be at least one device to find.

And if an advanced user did go through the trouble of snooping wireless
activity to gather valid MAC addresses, and went through the trouble of
changing their device MAC address to one that matched, they would have
bypassed only the whitelist - not other security protections in place,
such as key-based encryption, which is standard on most routers out
there. Again, as far as I can see nobody here (certainly not me) is
suggesting that one should rely *solely* on MAC address filtering for
security, but rather to augment it.

> again, mac address filtering stops the casual user which isn't the type
> of user to worry about. maybe they just want to check mail or facebook.
> not a big deal. 

Again, what to "worry about" is not for you to decide for everyone else.
If I want to use a MAC address whitelist to prevent unknown MAC
addresses from connecting to augment the security of my router, then
that's a perfectly valid thing for me to do, even if you disagree.

> the people you *do* need to worry about, the ones with ill intent, have
> absolutely no problem whatsoever getting past a mac address filter and
> once in, can possibly do all sorts of stuff.

Not with other standard protections in place, they can't.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

Back to comp.sys.mac.system | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Apple Time Capsule -- Unknown User TaliesinSoft <taliesinsoft@me.com> - 2015-02-08 21:47 -0600
  Re: Apple Time Capsule -- Unknown User Don Bruder <dakidd@sonic.net> - 2015-02-08 20:37 -0800
  Re: Apple Time Capsule -- Unknown User Michelle Steiner <michelle@michelle.org> - 2015-02-08 21:37 -0700
  Re: Apple Time Capsule -- Unknown User Tom Stiller <clusterfux.upmon@gmail.com> - 2015-02-09 14:05 +0000
    Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-09 09:19 -0500
    Re: Apple Time Capsule -- Unknown User nospam <nospam@nospam.invalid> - 2015-02-09 13:01 -0500
    Re: Apple Time Capsule -- Unknown User Paul Sture <nospam@sture.ch> - 2015-02-10 10:55 +0100
      Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-10 14:00 +0000
        Re: Apple Time Capsule -- Unknown User Paul Sture <nospam@sture.ch> - 2015-02-10 20:08 +0100
      Re: Apple Time Capsule -- Unknown User nospam <nospam@nospam.invalid> - 2015-02-10 14:42 -0500
        Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-10 20:03 +0000
          Re: Apple Time Capsule -- Unknown User nospam <nospam@nospam.invalid> - 2015-02-10 16:05 -0500
            Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-10 21:17 +0000
              Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-10 19:51 -0500
      Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-10 20:54 +0000
        Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-10 21:18 +0000
          Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-10 22:37 +0000
            Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 00:04 +0000
              Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-11 12:37 +0000
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 15:07 +0000
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 15:16 +0000
                Re: Apple Time Capsule -- Unknown User Michelle Steiner <michelle@michelle.org> - 2015-02-11 08:32 -0700
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 15:53 +0000
                Re: Apple Time Capsule -- Unknown User Michelle Steiner <michelle@michelle.org> - 2015-02-11 08:24 -0700
                Re: Apple Time Capsule -- Unknown User Huge <Huge@nowhere.much.invalid> - 2015-02-11 15:27 +0000
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 15:53 +0000
                Re: Apple Time Capsule -- Unknown User nospam <nospam@nospam.invalid> - 2015-02-11 12:22 -0500
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 18:00 +0000
                Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-12 01:51 +0000
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-12 14:11 +0000
                Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-12 14:52 +0000
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-12 15:11 +0000
                Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-12 15:38 +0000
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-12 16:03 +0000
                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-14 11:00 -0500
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-14 19:44 +0000
                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-14 10:58 -0500
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-14 16:47 +0000
                Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-15 01:10 +0000
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-15 01:39 +0000
                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-15 09:24 -0500
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-15 14:56 +0000
                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-15 11:13 -0500
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-15 16:53 +0000
                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-15 18:01 -0500
                Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-16 01:38 +0000
                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-16 12:04 -0500
  Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-09 09:21 -0500
    Re: Apple Time Capsule -- Unknown User TaliesinSoft <taliesinsoft@me.com> - 2015-02-09 14:05 -0600
      Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-09 15:32 -0500
      Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-09 20:58 +0000

csiph-web