Re[2]: About War Driving ..

[Kluge <kluge () kluge org>]

On Tue, 5 Dec 2006, Roman Shirokov wrote:

> > Pointless, because the MAC address can be easily sniffed as well as
> > spoofed.
>
> > Regards
> > Ansgar Wiechers
>
> Easily sniffed - yes, easily spoofed - hm... I doubt. (also not
> impossible for experienced cracker)

...also not impossible for anyone who can type  'man ifconfig' either...

Here's what I just did on my laptop here 30 seconds ago:

root@hostile:~# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:10:A4:C7:F4:C6
          inet addr:192.168.1.26  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:402 errors:0 dropped:0 overruns:0 frame:0
          TX packets:340 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:445776 (435.3 Kb)  TX bytes:26399 (25.7 Kb)
          Interrupt:3 Base address:0x300

root@hostile:~# ifconfig eth0 down
root@hostile:~# ifconfig eth0 hw ether C0:ff:ee:ee:ee:ee:ee:ee
root@hostile:~# ifconfig eth0 up
root@hostile:~# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr C0:FF:EE:EE:EE:EE
          inet addr:192.168.1.26  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:405 errors:0 dropped:0 overruns:0 frame:0
          TX packets:342 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:445968 (435.5 Kb)  TX bytes:26567 (25.9 Kb)
          Interrupt:3 Base address:0x300


...and Voila!  My NIC's new MAC address is now C0:FF:EE:EE:EE:EE...

Speaking of which, MMmmmm.. coffee-break time.

-Kluge

---------------------------------------------------------------------------
This list is sponsored by: ByteCrusher

Detect Malicious Web Content and Exploits in Real-Time.
Anti-Virus engines can't detect unknown or new threats.
LinkScanner can. Web surfing just became a whole lot safer.

http://www.explabs.com/staging/promotions/xern_lspro.asp?loc=sfmaildetect
---------------------------------------------------------------------------