Hello everybody and welcome to this tutorial. Today, I will talk about mac
addresses, what they are how, they can be used, and how you can change them in
order to hide yourself. Well, what is a MAC address? A MAC address is a physical
address of pretty much, not your computer but rather instead the network
interface in your computer, so the network card. All of your network
interfaces they have a MAC address, be it a wireless or wired interface, regardless
it will have a mac address burned into it. And as as soon as you connect to a
wireless network, or as soon as you connect to any LAN network with a wired
cable, or something of a kind, that particular MAC address is used to
identify you in combination with an IP address within that LAN network. The MAC
addresses do not go further, do not go outside the LAN, do not go outside the
first jump from the first router. So as soon as you go through the first router
from your PC, your MAC address is no longer being shared. Anyway, let's just
see what a MAC address looks like. So, what command do we use if we want to
list our network interfaces? Well, you use ifconfig, sorry, ifconfig. Press enter,
there we go. So I have a loopback interface which I'm not really that
interested in. I just want to remove it for the time being. Ifconfig eth0, and
there we go. So I just wanted a listing for this particular interface,
and this is your Hardware address, here it is. Do not confuse it with the ipv6
address which is here. You can see that it is a lot longer, and has far more
characters than a MAC address. The MAC address is usually, well not usually,
but always, and I mean always, the first three sets are used to identify a
manufacturer of the device. So the manufacturer is identified by the first
three sets, and then the manufacturer assigns another three sets to particular
devices as is decided. You can't really utilize these last three sets
because you don't really know the manufacturer has done with them. But
you can use the first three sets in order to figure out who has
produced the device. And if you know which company has made has made the
device, then you can know the possible vulnerabilities of that device. This is
also one of the methods of foot printing, or figuring out a MAC address of a
device. And if you have a MAC address, you can conclude with reasonable safety who
the device belongs to, not who the device belongs to but who has produced it, and
in doing so you will get a better idea of what you can
do with the device, how you can exploit it, and so on. Now let's just have
a look at it a bit closer. Ifconfig... you can also do this. So, let me just give
an example of a grep command. You can use pipe grep, and you can type in this
HWaddr, and there you go. This is a far better listing. So it will list eth0, link
encap:Ethernet, and HWaddr, so you can see clearly what is written
here. There are methods I can filter this through awk,
awk, and then just remove this, and this, and leave only this to be printed out,
but here you just have a better overview of the MAC address. This is how you can
get it in a bit of a better way. Now keep in mind that this HWaddr can also be, a
lot of things can be written here, that depends from one system to another, but
it is irrelevant. You can always view it through using an ifconfig
command. And then you when you know how MAC addresses are written, when you know
their formats, you can always recognize them, even in the vast mass of
information. I'll just go ahead and clear the screen.
Since MAC addresses are used to identify you on a wireless network, you should
definitely...I mean they will identify the device, but nobody will know who is using
the device. However, you know if somebody actually bothers to check the devices
within the network, they will know who you are, they will be able to kick you
off the network, and
that's not a good idea, that's not what we want. We want to be anonymous and we
want to hide. One, of the downsides of mac addresses and them being used as means
of identification, is that if you can view the other MAC addresses on the same
network in LAN. And then you can copy those MAC addresses, use them as your own,
do some sort of shenanigans on the network, admins will notice that there is
a problem. They will permanently ban that MAC address, and there you go, you have
successfully DDoS the person you wanted to DDoS. I have seen this used in class
so many times. Basically, what people would do is figure out what the
professor's laptop MAC address is, and then they would
deliberately use malicious activity on the net, just try logging in to a router a
couple of times, the administrators would notice, and they would permanently ban
that mac address. Effectively, rendering that laptop useless for that
lecture because that laptop could no longer connect to the wireless
projectors where the presentations were being held. So that's a bit of a
downside of it all. They eventually did get caught and it was a pretty, pretty
messy situation, but I'm just giving you an example of how these things can be
used and abused as well. Not suggesting that you should do something of a kind,
use it for a benevolent purpose, use it to make money to advance your
career, and something like that. Don't use it for silly things such as these
because you literally have no gain, no benefit, you can only cause
yourselves harm in such a way. Anyway, without further ado, you can use a tool
called Mac changer, so macchanger, press enter, and there you go. You see it
is installed here and it gives you certain, I have given it no parameters,
nothing like that. So it says Usage: macchanger [options] and then device. But I
don't want that, I want to use the help bar, and I'm just going to clear
this, macchanger - -help. Let's see what we have here. So you have a few options,
not that many, it's a fairly simple tool, easy enough to use.
You have this one to print the help, print the version and exit, print the MAC
address, you can also view a MAC address with this. I didn't know that, actually.
Let's give it a try. macchanger...I didn't know it because I never
bothered to check it in such a way. I always used ifconfig. Wait, is it -s or - -show,
eth0...well, what do you know. It does actually work. So it says permanent MAC
address, this is its permanent MAC address, this is its manufacturer who
owns the first three sets of the MAC address, and then you have the
current MAC address with which we can do whatever we want. So just
go ahead and clear the screen, for convenience sake, and call the help
menu once more. So, this is one more way to check the MAC address and exit. This
you can use actually to verify things. I usually just go and use ifconfig, but
this is also a very nice thing to do. Now this is what I was talking about a moment ago.
It says do not change vendor bytes. So
if you want to change your MAC address but still stay within the same vendor, it
says don't change the vendor bytes. So those are the first six ones, the first
three sets that is. Set a random vendor Mac of the same kind, you can also use
those parameter, these parameters are not used that often. Usually, what you
would use is either a fully random MAC address, or you would use it of a
particular vendor. So you would go online, see what the particular vendor MAC
addresses are, or you can print known vendors. So you got list, let me just show
you, -l. and there are a lot of them. So it is only showing you the first three
sets, and then for the other three you can type in whatever you feel like typing in.
Again, it doesn't even matter. If you want to be...but people don't
generally do this. I mean, unless there is some sort of specific thing where you
want to hide in the network and pass off as a...
you see it says Belkin, this is a router, so Cisco routers, so if you want to pass
on a network, as a standardized device within that network, and not raise
any suspicions, this is a good way of doing it, actually. Because you can
have the MAC address of a device and if an administrator takes a look he's
gonna see, oh, this is one of my routers, but what do you suppose that's
doing here, or something of a kind, but he won't be able to figure it out until he
actually digs deeper. The important thing here is that if anybody digs deep enough,
surely they will find that
you are doing something, but the idea is not to raise any flags, any suspicion,
and in such a way pass off unnoticed. So, once again, call the help menu, and you of
course have an ability to generate a fully random MAC address, and this is what I
was talking about. See here use the - m parameter, or - - mac, and then you type
in the MAC address that you want, and this is what people were using. They were
using the MAC addresses of legit devices on the network to conduct malicious
activity, and then those devices would be banned. So that's a
pretty big problem that people were causing. So, let me just show you what I
mean by, let me just show you what the changing of the MAC address looks like.
We will deal with this sort of an attack a bit later on when
we get into wireless hacking, and breaking wireless encryptions, and what
you can do on a wireless LAN network, but here I just want to show you what a
changed MAC address looks like. So let's just show
eth0. Ok, so, we've seen this a moment ago, now here's what happens when I use
macchanger. macchanger -random eth0, press enter, and there we go.
It says permanent, current, new. So this is the new MAC address and it says unknown,
I haven't assigned it to any particular vendor, or anything of a kind, and if I
now say show, excellent! So it says permanent and
current. So the current one is the one that is being shown, that can
be seen within the lan network, and that is used to identify you, even though you
can't actually destroy your own MAC address because it's literally burned in,
this one will be shared with everybody else, and this one will remain
within your own computer. It will not go, it will not exit your interface under
any circumstances. Anyway, a good practice would be to
set up a script which upon booting changes the MAC address, and sets it
to random every time you boot your computer. So that's not a bad idea either,
so when you, if you are doing something and you forget to change the MAC address
and LAN, or something like that, it can be problematic. So a good idea would be
to set up an automatic Mac changing. So nothing really special there. You don't
need to do any particularly difficult tasks. I will show this in the
next tutorial, the follow-up one, but until then I hope that you have enjoyed
the tutorial, and thank you for watching.