Hands on: MAC attack

Lately I’ve had several emails asking me to clarify issues raised in recent articles.

Nick Helm in Sheffield was one of several readers to ask about wireless security: “After stating your golden rule – always use some form of encryption – you go on to say that if you don’t use any encryption, ‘you’re not protected and anyone will be able to connect to your wireless network’.

“Does this really apply when you are using Media Access Control (MAC) on your router? Surely not. A packet sniffer will be able to read your wireless data, but how could anyone without an authorised MAC address gain proper access to the network?”

The question is easily answered, but first we need to recap on what MAC address filtering is all about.

MAC filtering in a nutshell
MAC addresses are unique 48-bit numbers, usually represented using six pairs of hexadecimal digits separated by colons, such as 00:09:5B:98:73:46.

Every networking device has one of these addresses, from a Lan adapter to a wireless access point or router, typically encoded into the main Ethernet chip on the hardware itself. They can also be programmed into firmware, adapter drivers and other networking software which, as I’ll explain, is important to bear in mind.

It’s also important to understand that MAC addresses are employed independently of higher level protocols and are used to direct packets to their correct destination. For example, if you need to send TCP/IP packets to an IP address of 192.168.0.1, somewhere along the line that IP address will be translated, using the Address Resolution Protocol (ARP), to the associated MAC address to enable the delivery to take place.

So MAC addresses are used to identify network devices at a fundamental hardware level. On most wireless access points and routers, they can also be used to control access to the Lan and its resources, either by only allowing clients with certain known MAC addresses to connect and exchange information or by explicitly barring known ‘hostile’ clients.

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!