Slashdot Mirror

← Back to Stories (view on slashdot.org)

Wi-Fi Fingerprints -- the End of MAC Spoofing?

Posted by ryuzaki0 on from the place-finger-here dept.

judgecorp writes, "Wireless devices can be identified by variations in their radio signaling, known as their 'transceiverprint,' according to research reported in Techworld. The Canadian researcher, Jeyanthi Hall, related the prints to MAC addresses and got a positive ID for devices connecting to a Wi-Fi network, claiming 95% success with no false positives. Once they work out how to do this without a dedicated signal analyzer and neural network processing, it's the end of MAC spoofing on wireless networks."

7 of 176 comments (clear)

  1. Cool hack, but who cares... by nweaver · · Score: 4, Interesting

    Cool hack, but who cares. With proper authentication (eg, WPA), you don't need to worry about MAC spoofing as the packets won't authenticate right to the access point.

    --
    Test your net with Netalyzr
    1. Re:Cool hack, but who cares... by Bender0x7D1 · · Score: 5, Interesting

      You are forgetting the insider threat. I might have the WPA key because I am an employee with my own laptop. However, if I spoof your MAC, then it looks like you are the one surfing /. (or porn sites) all day and not me.

      Encryption is good, but it doesn't solve every security problem.

      --
      Reading code is like reading the dictionary - you have to read half of it before you can go back and understand it.
  2. Old Idea by Detritus · · Score: 5, Interesting

    They were doing this during World War II, using the unique characteristics and variations of transmitters to "fingerprint" them. Similar things were done with the way radio operators send morse code to help detect spies that had been compromised.

    --
    Mea navis aericumbens anguillis abundat
  3. Re:Just spoof the fingerprint by robertjw · · Score: 4, Interesting

    OK, but will the variation on the caps and resistors remain consistent over the life of the WiFi card? Will an allowance be made for ongoing variations in the signal? If so, will it be exploitable?

    --
    Find coupons in Greeley
  4. Seen it before by tsotha · · Score: 5, Interesting
    The Canadian researcher, Jeyanthi Hall, related the prints to MAC addresses and got a positive ID for devices connecting to a Wi-Fi network, claiming 95% success with no false positives.
    I'm sure it works great in her lab, but here in the real world...

    I work for Big Cellphone Company. We tried the same scheme in the mid '90s when analog phone cloning was all the rage (remember when it used to cost $1.50/minute? Ahhhhh, the good old days). It works, kind of.

    The problem is you're not trying to decide whether or not to retry a packet, or what the transmit power should be. You're trying to decide whether or not to provide service, so you really can't afford to be wrong. We were never really able to get an acceptable reliablility in the wild.

    Believe me, we had a huge incentive to roll this out to our network. The marginal bandwidth costs from fraud didn't hurt much, but when someone made a call to, say, Saudi Arabia on a cloned phone we got stuck with all the fees on the other end. A single cloning ring could cost millions, so Big Cellphone Company was willing to break the bank to get this to work.

    Eventually we rolled out digital service, so the project got shut down. Cloning fraud was one of the reasons we were willing to give you a free phone if you switched over to digital. Well, that and the long-term contract.

  5. What's old is new again. by Ancient_Hacker · · Score: 4, Interesting
    waay back at the very start of real "Wireless" communication, the transmitters were these hefty spark-gaps, often modulated by a spinning set of electrodes. And back then most houses had DC power, and unsteady power at that.

    And each transmitter was hand-built, using rather rough tools.

    All these things ensured that each signal had it's own quirks, in time, frequency, and temperature. Radio ops could often identify transmitters by thepaerticular yawps, swooshes, and zaps of the signal. ot to mention, identifing the morse code operator by his particular "fist", i.e. spacing and other personal quirks.

    Then during WW2 our side started using spectrumanalyzers to categorize each model of German and Japanese radar. Here again each transmitter tended to have its own set of quirks.

    Now, surprise, the same thing gets rediscovered. On some low level each wireless card has some (shuddrr) analog controlled oscillators, frequency dividers, duplexers, antennas, and amplifiers, each with it's own slight amplitude, frequency, and phase characteristics.

    So nothing new here. Not by like, almost 100 years.

  6. This idea is more than sixty years old by igb · · Score: 4, Interesting
    As well as analysis of individuals' style of morse, fingerprinting of the characteristics of individual transmitters was done during WW2. By following both equipment and personnel around networks it provided additional data for traffic analysis, which is both useful in its own right and useful as a source of cribs. In the case of U boats, it offered the chance to follow individual U boats from HF/DF fix to fix. Ralph Erskine wrote about this in Cryptologia, January 1999.

    ian