Can i be traced while using a spoofed Mac Addresse?

Hi:)
Can I be traced or found if, I use fake Mac, for a connection over Wifi every time and I compromised the wifi router, so I can delete logs anytime (although I don’t think it is necessary because my Mac is faked in every new connection over wifi anyway). When I check my IP on whois.com or whatever.., it shows router's host IP. If I use live cd for example knoppix or backtrack, there are logs on my machine’s memory only till I restart it.
I don’t use any info about myself and I don’t visit webpages in witch I have accounts.

Wifi cards could be recognized by their dynamic Mac, and if we know the type and
manufacturer so we know more details as signal distance. If we don't know the real Mac, I could be traced only by signal strength of my connection. I use very powerful wifi transmitter, so I could be really far from the access-point (wifi router) and many difficulty’s as buildings and etc. could be in our way. I know there are some programs as Gkismet, witch use gps to find the locations of access-points. Can wifi clients be traced in a similar way? What is the risk of being caught in this way?;)
p.s. sorry for bad English grammar:rolleyes:

I have taken the time to move this single post from this old 2002 thread>

Network Security Misconceptions: Chatper 2: Tracing

Interesting question. How to find that rouge wireless connection.

premise:

Access Point is not secure

Even though the AP is unsecured, you know that only 4 mac addresses are allowed to connect to your AP (Don't argue here - I'm making this up as I go)

You notice that 4, authorized, MAC addresses are currently active on your AP; AND you also know one of your four PC's is turned off.

Yea Yea I know how's someone going to know how to monitor an access point and not secure the thing - but hell, it's Friday afternoon.

So how do you find the fourth, unauthorized PC that is connected to your AP using the MAC address of one of your authorized PC's

Also, Assume the offending PC is not in the same building. Think not in your apartment but in the apartment across the street.

A lot of people knows nothing about monitoring their routers, and about security. So if someone from ISP gets someone's IP, who is doing something real bad, ISP worker gets to "lawbreaker" house and they see that the real lawbreaker connected to the router, what they should do? How to trace where that person is? Is it some kind of technology to do that?:rolleyes:

I am not sure the MAC address is that significant if you are not part of the network.

The first problem would be to find where the computer is and the second would be to establish who was using it at the time.

I know that over here I can walk into a store and buy WiFi kit for cash and they know neither who I am nor what the MAC addresses are.

The danger would be if you used your legitimate address and actually belonged to a legitimate network. Law enforcement just might question all network administrators within range.

EDIT:

You do need to stay focused though. Our police in Scotland caught a member of a pedophile ring who was using someone's unsecured WiFi. They traced the WiFi connection and saw that it was being hijacked.

One of the connections to the e-mail account where this porn was being stored was from the network of a large employer in town. It turned out that there was only one employee of that company who lived in range of the WiFi link.............they seized his computer and found the evidence.

Is it possible to find that person if he is connected on a wifi router and we know no more details about him, if he is using fake Mac and he avoids webpages or anything that might compromise him?
It is possible to trace his place or position just tracking he as a router client?

In answer to your question; Yes with an if... No with a but...

IMO if you do not use anything that can be identified or traced back to you personally, then how can you get caught/be traced?

Consider sitting down in front of a top CEO's computer which is logged in and unlocked, with all passwords "remembered" - you have unrestricted access to everything using the CEO's logon.... providing you leave no video camera footage, or DNA or business cards at the scene, how can you be caught?

I love hypotheticals, especially in philosophy, but I don't see this one going anywhere... If you could explain what your thought process was with this we can discuss further?

Peace
CTO

4Fun, as CTO suggests this is very hypothetical and philosophical.

There are a number of dependencies:

1. Who is trying to trace you?
2. To what lengths are they prepared to go?
3. How much background traffic/"noise" is there?
4. How common is WiFi in your area?

Some ideas of what I am trying to get at:

1. The CIA will fry your butt whilst a private individual does not have a cat in hell's chance.
2. Local law enforcement are restricted as to budgets, equipment and skillsets. Federal Agencies are a different matter:eek: It all depends on how serious they view the activities as being.
3. If you are active at peak traffic periods there is far less chance of detection than if you operate at 03.30hrs when all respectable people are asleep.
4. If there are not many users it is more tempting for law enforcement to investigate, as they have a limited number of suspects/leads.

Incidentally, what you are proposing is a criminal offence in most countries, so I wouldn't recommend it.

Probably I should just ask correctly:)
What are the methods to find person's location who hijacked wifi router's connection and who is still online, without having any more details?
Can You suggest anything?:)

You might find this thread helpful:

http://antionline.com/showthread.php?t=249383

I know its rather old but the principles should apply.

That brings us to the important question of whether this is internal or external. In other words if you knew the "real" MAC address, would you be able to identify the machine and its location?

Do you believe that the machine is static?..............If it is wardriving then I would say you have no chance.

If the machine is external, it should be theoretically possible to track the signal, as it has to communicate with the router, but I don't know just what equipment you would need. Sounds like a FEDS or National Security scenario to me?

Another factor is where this is happening.........inner city, condo, campus and you would have great difficulty............where I live would be much easier as there isn't much WiFi and the buildings are well spaced out.

There is also the possibility that it is going through another compromised machine, or worse a chain of them? That brings us back to the age old problem of determining the identity and location of the actual user.

As I mentioned before, when is this happening. If it is at unusual hours then tracing should be more simple but it is really only going to point you at some buildings. You need to be law enforcement to pursue it further.

Quote:

---

Probably I should just ask correctly:)
What are the methods to find person's location who hijacked wifi router's connection and who is still online, without having any more details?
Can You suggest anything?:)

---

The short answer is no, there is nothing you are able to do in regards to identifying who is connected to a wifi router. If you connect to the router to view details about this "guest" you will be able to reveal the NIC MAC & IP address, but little more.

On a network, the next logical step in order to identify a workstation/user is to connect to and logon to the workstation. You would need valid logon credentials to do this, providing the workstation is not protected by a firewall preventing such access.

Once you have logged on or connected to the workstation you may be able to check things such as computer name, domain, owner details etc. But seeing as the workstation connected to the wifi is unknown to you, having valid credentials is unlikely.

I would suggest trying default logon names such as 'Administrator' or 'User' etc that may not be password protected, but this is morally unsettling and even unlawful as the workstation does not belong to you. Besides, most remote connections require the account to be password protected else connection is denied.

Staying on the subject of what does belong to you - the wifi router - I have two thoughts on the matter.

1) Administration - Do not worry about the unwanted activity on the network/internet as it is expected and typical. Instead, take action preventing the problems caused by the unwanted activity; Antivirus software, firewalls, security, encryption etc... These are all solutions to unwanted problems. Change the network key on the wifi and use a MAC filter, disable DHCP on the wifi router will also stop some users in their tracks.

and

2) How an unwanted guest connected to your wifi in the first place is, sadly, your own fault. So instead of trying to 'track down' the unwanted guest you should be dealing with the problem of security on your wifi and cut the guest off at the source of the issue.

From a different perspective (that I do not think would be true) it almost seems as if you have intentionally allowed unknown workstations to connect to your wifi - which is clearly free from any kind of network key or encryption - with the intention of trying to gleen information about those uneducated people who connect to an unknown and unprotected wifi. The reasons for doing such a thing, well that is nothing good i'm sure.

Anyways - sorry to ramble on.... I forget, why were you asking this question again?


CTO

Quote:

---

Originally Posted by 4Fun

Hi:)
Can I be traced or found if, I use fake Mac, for a connection over Wifi every time and I compromised the wifi router, so I can delete logs anytime (although I don’t think it is necessary because my Mac is faked in every new connection over wifi anyway).

---

Yes you can be found physically, if the owner of a wifi is a real geek and/or really paranoid about who is using hsi stuff.
There are radio direction finders(RDF) that would point in the direction of your physical location so long as your wifi card is active.
RDF is basically highly directional antenna like the parabolic dish, hooked up to a laptop/pc that runs spectrum analyzer or even an airopeek or netstumbler.

http://forums.wi-fiplanet.com/showthread.php?t=2690

Quote:

---

There are radio direction finders(RDF) that would point in the direction of your physical location so long as your wifi card is active.

---

That's the theory, but your mileage will vary depending on:

1. Quality of the equipment
2. Strength of signal and interference.
3. Density of WiFi users

Basically it is very difficult in high density population areas with a lot of WiFi users. You get a direction and maybe even a building, but who and where is a different matter.

Sorry this is 2009. Anyone leaving their access point unsecured should be taught a lesson. Authorities could care less. If you can get an access point to spill out it's ARP entries. they could get the MAC and they address you used. By then it will be too late unless you are dumb enough to sit in the area.

Simple answer, No.

Hey byte...

The ap transmits its location (or availability) and the wireless card transmits its "need for a connection" there must be a way to track that, yes? After all we can find a cell phone within 10 meters of a cell tower.

Quote:

---

The ap transmits its location (or availability) and the wireless card transmits its "need for a connection" there must be a way to track that, yes? After all we can find a cell phone within 10 meters of a cell tower.

---

This is called triangulation, and is only possible when there are 2 AP's (or in this case phone towers).

This is measuring the distance between Phone Tower 1 and the device, then measuring the distance between Phone Tower 2 and the device. Then with the distance between Tower 1 & Tower 2 known, you can work out the location of the device. Simple Triganomotry.

In conclusion, I am sure this is possible when trying to locate a Wifi signal, however you must have 2 recievers at different locations, set apart by a known distance. (even if this is within the same room, a few feet apart)

Simple? Hell I can't even spell Trigonometry.

I was actually thinking; in my own head, how one would identify Type, Gain, and Beamwidth.

I was wondering if anyone would pick that up dinowuff :)

My final judgement on this matter however, is that unless sensitive data is being compromised, the cost/effort of tracing someone greatly outweighs the benefit when simpler solutions are available on the AP alone.


CTO

As far as I am aware this is going to be a one on one connection, so where are you going to get your second point to make your triangle and thus determine the range?

On another note, would it be possible to trace the destination of the rogue user's traffic passing through the AP?

Quote:

---

the cost/effort of tracing someone greatly outweighs the benefit when simpler solutions are available on the AP alone.

---

I agree, you would really need to be a spook or law enforcement, and they generally have suspects to begin with.

Instead of setting up tor entry and exit nodes and leeching off of some kids 'sploits... one of these days im going to have to setup a non-encrypted and non-passworded wireless access point. Wink Wink...

Maybe nab login details from these smelly-ass minoritys that don't want to waste their monthly checks on internet access.

SPEC Setting entry and exit nodes implies that you know someone is going to connect to your ap

Nihil I agree law enforcement / human behavior precludes capture.

Cyber you are correct - less you forgot to use spell check.

What I am asking is this...

No logs, No "Traps", is there any software that one can run to see - direction and distance, from where a connected device is located. and if not, how would you gather such information. i.e. give me a skiddie tool that lets me know the direction, distance and time of connection from all connected devices to my AP

Quote:

---

Originally Posted by ♥The♥Specialist♥

Maybe nab login details from these smelly-ass minoritys that don't want to waste their monthly checks on internet access.

---

http://www.youtube.com/watch?v=BxV3zLucNqk

Quote:

---

No logs, No "Traps", is there any software that one can run to see - direction and distance, from where a connected device is located. and if not, how would you gather such information. i.e. give me a skiddie tool that lets me know the direction, distance and time of connection from all connected devices to my AP

---

I am not aware of any such software, at least not that is available to the general public.

There was a case over here recently where a paedophile was using someone's unsecured AP. The ring was using a "dead letter box" e-mail account to peddle their filth.

This guy had made the mistake of once accessing the e-mail from his place of work. As this was a large organisation and logs were not available, there was no joy there.

The police ran the past and present employee registers against all people living within estimated range of the insecure AP and got one hit.............. job done, but not with sophisticated electronics or software. Given the amount of effort involved, if that solution had been available I am sure that they would have used it.

Quote:

---

SPEC Setting entry and exit nodes implies that you know someone is going to connect to your ap

---

The way Tor is setup, all you have to do is run it and you'll get a terabyte dump of "financial aid" as its called. And as for wireless networks... the first thing people do when they see a wireless network is connect to it.

Quote:

---

give me a skiddie tool that lets me know the direction, distance and time of connection from all connected devices to my AP

---

Most routers just have two small antennas pointing upward. But with something resistant to radio waves wrapped around it you could shape and angle the access point. Then it would be a matter of very slowly pointing it in directions every three to fifteen seconds (enought time for a machine to automaticly detect it and login.)

As silly as it sounds... I bet it would work.

Quote:

---

And as for wireless networks... the first thing people do when they see a wireless network is connect to it.

---

Well, there is not much you can tell about a wireless network unless you are connected. For instance, without connecting to the AP/network - you would not be able to see the IP Traffic, or glean any useable data.

The most you could do without connecting to the AP is analyse the analog wifi signal, but without being able to knowingly and intelligently filter the frequency it is basically useless data.

Please correct me if this is off mark as I am slightly more curious than I was yesterday.

CTO

Hey Dino, I am sorry to respond to this so late. I never bothered to check the thread post replying to it. But the way the situation is put forward, there is no way you can be tracked. Only time you can be tracked is if you are still connected to the AP. This also has limitation's as pointed out by few members. Besides that there is no way you can be tracked, post you logging off. There are lot of variable factors (changing the MAC, machine name, VMware) etc that can be done before logging on that you will never be able to trace back too