Hacker News Reader

Comment by pilom | Hacker News Reader

Time to invest in a DD-WRT router to be sure there aren't any backdoors for ARP requests to map IP addresses to physical hardware.

View on HN

You should elaborate on that so other people reading the discussion can get an idea what you're talking about.

My understanding is that proprietary router firmware may have unknown vulnerabilities that someone could use to discover the MAC addresses of computers making specific requests. That would allow, for instance, law enforcement to tie internet usage to specific computers.

DD-WRT and other open source firmware should be a little more secure in this regard. The open source firmware out there is definitely more reliable over long periods of time than the stock firmware that comes on most routers, so I assume it's also more secure.

Couldn't have said it better myself.

MAC addresses can be easily spoofed. For example, on some ethernet cards:

    sudo ifconfig eth0 hw ether 00:12:34:56:78:9A

will change your hardware address.

True but if your MAC just happened to match a MAC the litigating attorney had on file due to the exploits which ChuckMcM is referring, it would be much more difficult to claim innocence as you can do with a shared IP.

MAC spoofing would only be relevant if you were regularly using random spoofed MACs on your own network.

> MAC spoofing would only be relevant if you were regularly using random spoofed MACs on your own network.

Or, if for some reason that practice was widespread enough that it provided plausible deniability.

The case for MAC spoofing being common (at least with people "borrowing" your wi-fi) makes sense because some networks have MAC address based white lists, so this defense isn't quite as crazy as it sounds at first. IANAL etc.

Not necessary -- someone could spoof their MAC to match mine. IMO, this is more likely when there is already malicious intent, and it's almost trivial to do.

I've used spoofing frequently on a local college's campus to get around blocks they've put on my system. Apparently some of the student use Ethernet jacks aren't for student use.

Yup. I've actually used this, to work around certain cable modems that only allow the mac address they were set up from.

Just use the DD-WRT feature that lets you have 2 APs, one encrypted and one open. Connect all your kit to the private one, and limit the outgoing bandwidth of the open one. This should surely give both security and plausible deniability?

They still break down your door though.

Reply on news.ycombinator.com