Defeating MAC Address Filtering

---

One security measure that many wireless network administrators put in place is filtering by MAC address. Enabling MAC address filtering is discussed in greater detail in Chapter 11, “Basic Wireless Security,” but, essentially, this implementation allows only network cards with certain MAC addresses to connect to your network. However, as with any security measure, a determined, knowledgeable attacker can usually find a way around such an obstacle.

Most commercial- and consumer-grade wireless networking equipment sends the MAC address clear text even if WEP is enabled. This means that if you passively sniff the traffic on a wireless network using a freeware tool such as Ethereal (www.ethereal.com), you can determine one or more MAC addresses that are allowed to connect to the network. If MAC address filtering is the only security measure in place, you just need to change your MAC address to one that is allowed access. In this section, we look at how to do this in Windows XP, Windows 2000, and Linux.

Defeating MAC Address Filtering in Windows

Changing your MAC address in Windows is not a difficult process. The steps that you need to take vary slightly between Windows XP and Windows 2000. We will also take a look at automated tools that are freely available to facilitate this process.

Manually Changing the MAC Address in Windows XP and 2000

Changing your MAC address in Windows XP or 2000 is done by modifying the Windows Registry.

Note 

Modifying the Registry can be dangerous and can cause the system to become unstable if it is done incorrectly.

Go to Start | Run and type in regedit. This will start the Registry Editor (see Figure 9.13).

Figure 9.13: The Windows Registry Editor

Expand the HKEY_LOCAL_MACHINE | System | CurrentControlSet | Control folders (see Figure 9.14).

Figure 9.14: Expanding the Registry

Scroll down to the Class folder and expand it. Next, scroll down to the {4D36E972-E325-11CE-BFC1-08002bE10318} folder and expand it. This folder contains the Windows XP Registry information regarding network adapters installed on your system. Scroll through each folder until you find your wireless network adapter, as shown in Figure 9.15.

Figure 9.15: Wireless Network Adapter Registry Entry

From the Registry Editor menu, choose Edit | New | String Value. This creates a new REG_SZ string and prompts for a value. Type NetworkAddress. Now, right-click the NetworkAddress key that was just created and choose Modify. Enter the new MAC address you want to use in the Value Data field (see Figure 9.16) and click OK.

Figure 9.16: Entering the New MAC Address Value

Simply close the Registry Editor and reboot the system. The new MAC address is assigned as the system starts. Verify this by typing ipconfig /all.

To return the MAC address to its original, hardware-assigned value, delete the key that you just created and reboot the system.

Note 

Changing the MAC address to a random address may cause the adapter not to bind correctly and prompt the card to become unresponsive to the network. This is because some cards require that the first six bits of the MAC address conform to the IANA Number Assignments Database (www.iana.org/assignments/ethernet-numbers) in order to function correctly. The latest MAC address Organization Unique Identifier (OUI) listing is available at http://standards.ieee.org/regauth/oui/oui.txt.

Changing the MAC Address in Windows XP and 2000 Using Automated Tools

blackwave has developed a program called BWMACHAK, that changes the MAC address of an ORiNOCO card, and is available at www.irvineunderground.org/blackwave/bwmachak.zip. BWMACHAK is an easy-to-use command-line program that requires only three steps.

1. Remove the card.

2. Run BWMACHAK.

3. Reinsert the card.

After removing your ORiNOCO card from your PCMCIA slot, run BWMACHAK from the command line.

C:\>BWMACHAK.EXE 00022D123456

Now reinsert the ORiNOCO card and type ipconfig /all to verify the new MAC address.

To return the card to its original MAC address, run BWMACHAK with the remove string.

C:\>BWMACHAK.EXE <removembwmachak> 

Note 

Changing the MAC address to a random address in Windows XP and 2000 using automated tools will have the same effect as changing the address manually.

Defeating MAC Address Filtering in Linux

Similar to Windows, defeating MAC address filtering when using a Linux operating system is accomplished by changing the MAC address assigned to your wireless card. This is an extremely simple process in Linux that can be accomplished from the command line, or by using automated tools.

Manually Changing the MAC Address in Linux

Changing the MAC address that your wireless interface uses in Linux requires only three simple steps.

1. Bringing the interface down.

2. Configuring the new MAC address.

3. Bringing the interface back up.

Before making changes to the interface configuration, you should disable or bring the card down. This is accomplished using the ifconfig command.

root@roamer:/root# ifconfig eth0 down

Note 

eth0 should be replaced with your card’s interface designation (for example: eth1, wlan0, and so on).

Next, configure the interface to use a MAC address that is allowed to access the wireless network. For example, if you had discovered that the MAC address 00022D123456 was allowed to connect to the network, you could assign that MAC address to your card using the ifconfig command.

root@roamer:/root# ifconfig eth0 hw ether 00:02:2D:12:34:56

Now, simply bring the interface back up, once again using the ifconfig command.

root@roamer:/root# ifconfig eth0 up

The card is now configured and using the MAC address 00022D123456. You can verify this by viewing the configuration of the card. The first six bits (00:02:2D) are called the Organization Unique Identifier (OUI). In this case, the OUI is consistent with an ORiNOCO card. It is always a good idea to use the proper first bits for your card. The latest MAC address OUI listing is available at http://standards.ieee.org/regauth/oui/oui.txt.

root@roamer:/root# ifconfig eth0  eth0    Link encap:Ethernet   HWAddr 00:02:2D:12:34:56

Changing the MAC Address in Linux Using Automated Tools

The Church Of Wifi has developed a tool to automate MAC address changing for Linux operating systems; SirMACsAlot (www.michiganwireless.org/tools/). SirMACsAlot can be run three different ways.

• From the command line with prompts

• From the command line with arguments

• Using the GUI interface

If no command-line arguments are supplied, SirMACsAlot prompts for the interface you would like to change the MAC address on. SirMACsAlot then prompts for the new MAC address you want to assign to that interface.

SirMACsAlot can also be run directly from the command line by providing two arguments: the interface and the MAC address.

root@roamer:/root# ./SirMACsAlot.pl eth0 00022D123456 

SirMACsAlot can also be run from the graphical user interface (GUI) by entering the network interface and MAC address values into the relevant textboxes.

Once you have run SirMACsAlot, you can verify that the MAC was set correctly by viewing the configuration of the card.

root@roamer:/root# ifconfig eth0  eth0    Link encap:Ethernet   HWAddr 00:02:2D:12:34:56

If MAC address filtering is the only security measure that the wireless network employs, you can now access the network by following the steps outlined earlier in Accessing Wireless Networks Using the Direct Approach in Linux.

---