Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Router MAC Spoof


  • Please log in to reply
14 replies to this topic

#1 Pajajn

Pajajn

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 18 January 2013 - 04:55 PM

I thought i could ask what i managed to do lately... basically im on a ADSL from my ISP with dynamic ip and a cable modem through a router and then out the every device in my internal network.

So i changed the last digit in my routers MAC adress and i instantly got a new ip adress pool. I mean the last xxx.xxx two collumns were different so i could enter ip banned webpages on my old ip etc

Is this legal? what are the negative conflicts and will my old IP be assigned to someone else now

I hope any "expert" could answer to every question above it will help so much :) thanks

BC AdBot (Login to Remove)

 


#2 Pajajn

Pajajn
  • Topic Starter

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 18 January 2013 - 06:25 PM

Beside that i just wan't to add the changed IP and what effect it had on changing the MAC

First of all destination
New IP
IP-nummer	90.231.171.157
Land	Sweden
Region	Skåne Län
Stad	Trelleborg
Latitude	55.366699
Longitude	13.166700
ISP	TeliaSonera AB
Organisation	TeliaSonera AB


Old IP
IP-nummer	90.231.99.23
Land	Sweden
Region	Vastra Gotaland
Stad	Lindome
Latitude	57.566700
Longitude	12.083300
ISP	TeliaSonera AB
Organisation	TeliaSonera AB

So how did this happen... is it
1. Legal?
2. Will someone else take my old (real) adress :wacko:

#3 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:21 PM

Posted 19 January 2013 - 05:15 AM

First of all, before we discuss this further, revert to your original MAC address ASAP.
There's a high probability that someone else has a device with the MAC address you just spoofed, and this could cause netowrk problems for them.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#4 Pajajn

Pajajn
  • Topic Starter

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 19 January 2013 - 06:13 AM

I took modem out for the night and restored old router settings which gave me the old IP back when i woke up some minute ago :whistle:

I just wanna know what happened back there since every time i changed the last digit to A, F i got an adress across the whole country down :blink: kinda cool that it actually worked i just followed a tip from a friend... thought it was legal and safe cause several others made the same thing

Could you describe this procedure and what's really happening, i mean its just changing a letter in the MAC adress couldnt hurt that much could it <_<

#5 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:21 PM

Posted 20 January 2013 - 05:43 AM

There's one thing I don't understand about your setup, can you clarify?

You speak about ADSL and cable modem. ADSL uses your phone line to connect to the Internet, while a cable modem uses cable TV to connect to the Internet.
Do you have both? And if so, both from the same ISP?

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#6 Pajajn

Pajajn
  • Topic Starter

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 20 January 2013 - 01:19 PM

I mispelled it schould be only ADSL :whistle:

#7 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:21 PM

Posted 21 January 2013 - 03:51 AM

A MAC address is a unique ID for network interfaces on an Ethernet network. If 2 devices use the same MAC address on the same Ethernet network, communication conflicts will occur.

Although I'm not familiar with ADSL in Sweden, I know that there are ADSL devices that use PPPoE (Point-to-point protocol over Ethernet https://en.wikipedia.org/wiki/Point-to-point_protocol_over_Ethernet). So I do not recommend that you change the MAC address by one digit of your ADSL device permanently, because it is very likely that you are using the MAC address of another ADSL device. Are you using an ADSL device provided by your ISP?

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#8 Pajajn

Pajajn
  • Topic Starter

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 21 January 2013 - 04:36 PM

Im using this modem http://www.prisjakt.nu/produkt.php?p=369325

Modem is provided several years ago by my ISP. Meantime ive been doing alot of router changes. Firmware upgrades in the modem itself too :thumbup2:

I just wanted to know if this is "legal", if my ISP could take this as a threat and take me to court by changing one digit in the MAC. I was happy myself since my brother IP banned our connection to a game i really like and therefore with the new adress i was able to play again... thats why i wanted to make sure it was legal and not illegal.

Beside my connection is IPoE automatic IP with UpnP

#9 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:21 PM

Posted 22 January 2013 - 06:54 PM

I cant' help you with the legal aspect. I've no idea what the law in Sweden says about this. Furthermore, you also have to respect the contract/ToS you have with your ISP.

If you just want to change your IP, doesn't restarting your modem give you another IP address? You don't have a static IP address, do you?

Edited by Didier Stevens, 22 January 2013 - 07:42 PM.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#10 Pajajn

Pajajn
  • Topic Starter

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 23 January 2013 - 07:20 AM

I tried restart my modem several times. Once i actually got a new IP but i dont know how... only things i could think of is these 2

1. Away for 3 weeks in thailand
2. Upgraded modem firmware

I got a new adress in late 2011 as far as i remember. But just restarting or resetting modem doesnt give me a new adress. Neither does have it offline during 24hours give me a new.

It says im on Dynamic IP DHCP from my ISP but the only way that goes fast is to spoof the router MAC with example my Laptop MAC adress to get a new IP instantly

#11 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:21 PM

Posted 23 January 2013 - 05:52 PM

DHCP servers maintain a table with MAC addresses & IP addresses. The IP address you are given has a lease time, this must be several days in your case. Maybe a week.
This means that the DHCP server will try to reserve that IP address for your for the time of the lease, even if you don't use it. If your ADSL modem was powered off during your 3 week holiday, then it's clear that you exceeded your lease time and were assigned another IP address.

Changing your MAC address makes the DHCP server give you another IP address, but if you use the MAC address of another ADSL modem, you will get that user's IP address, which could result in network errors.
Using the MAC address of the Ethernet port of your laptop ensures that noone else has that MAC address, but like I said, I don't know if this is within your ToS.

Edited by Didier Stevens, 23 January 2013 - 05:57 PM.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#12 Pajajn

Pajajn
  • Topic Starter

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 25 January 2013 - 10:06 AM

Thank you Stevens for your quick and experiencing answers :thumbup2: I don't really know if there actually is set up a such rule for us here in Sweden though but will investigate further into that before i do anything "stupid"

Yes as i said i just clone the MAC from my laptop and switch the last letter from A-F and 3 minutes later i get a new IP from all over the country

#13 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:21 PM

Posted 26 January 2013 - 04:52 AM

How did you actually change your MAC address? Is it just a field in the web configuration of your ADSL modem? If it is, it might be in accordance with your ToS, but I'm not a legal expert.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#14 Pajajn

Pajajn
  • Topic Starter

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 26 January 2013 - 09:08 AM

Video where i show you :thumbup2:

Edited by Pajajn, 27 January 2013 - 08:43 AM.


#15 Pajajn

Pajajn
  • Topic Starter

  • Members
  • 368 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:01:21 PM

Posted 28 January 2013 - 04:15 PM

But what happens if i have 2 channels, one 5 and one 2.4 opened. And i spoof the router with PC using 5Ghz connected. Afterwards i connect to 2.4 instead but router using my PC's MAC adress. Could still use internet on the 2.4 band but not 5 as i set up with that one :)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users