Hacker News Reader

Comment by cupcake-unicorn | Hacker News Reader

This is very interesting.

So I never was much of a network analyst, forgive me - is there any way to guard against this while still leaving your wifi on, without something like cycling MACs? I wasn't aware that when you scan for Networks, that you're actually exchanging some packets with those networks - I thought you were just picking up on a broadcast one way. Shouldn't there be some sort of "stealth mode" where you're not leaking packets everywhere?

It actually seems like if this was the case, I'm surprised it hasn't been used in other ways. Say a burglar breaks into my house with his iPhone in his pocket. Could I later prove it was him by pulling up some log on my router that was picking up MAC addresses going by? And why isn't there some software (to my knowledge) that does the same thing for surveillance - logging all the MAC addresses and creating alerts if a new one comes into the area?

View on HN

> is there any way to guard against this while still leaving your wifi on, without something like cycling MACs?

No -- the adaptor's MAC is an essential part of the transaction, while cycling MACs would be a dead giveaway and would increase attention paid to that system and its travels.

Turning off the adaptor is the only meaningful way to avoid tracking.

> Say a burglar breaks into my house with his iPhone in his pocket. Could I later prove it was him by pulling up some log on my router that was picking up MAC addresses going by?

Yes, but only in a society that would allow this kind of tracking of people, each of whom is presumed to be innocent. Usually a person is first identified as a suspect, after which a technical track can be made. But a person who is not already regarded as a suspect can't be (legally) subjected to this kind of surveillance.

> And why isn't there some software (to my knowledge) that does the same thing for surveillance - logging all the MAC addresses and creating alerts if a new one comes into the area?

Because this is privileged information having to do with privacy, and violating it would confront certain well-established civil rights that vary from country to country.

I get and agree with your last two answers, but if that's the case, why has this kind of thing started popping up on a commercial scale? They certainly would have more to answer for, legally, if privacy laws were violated.

And just because an app like that may violate privacy rights, I mean, you still see things like Firesheep, packet sniffing, network surveillance tools, all published with the caveat to just use for "testing".

It seems to me that the laws are somewhat murky, as evidenced by this article, and I would be surprised if there was any law in the US against me keeping track of MACs that came into the range of my router. With your argument I couldn't set up a surveillance camera outside my house either.

> I get and agree with your last two answers, but if that's the case, why has this kind of thing started popping up on a commercial scale?

It's one thing to monitor MACs flying around a network, it's quite another to defend the monitoring in a court of law or use the results in a legal action.

In the U.S., for a member of law enforcement to search a person, a house, or monitor someone's communications, he must have reasonable cause to suspect that a crime is being or has been committed by that person. Absent "reasonable cause", the law can't monitor our communications. And as I type this, I realize these ideas are probably out of date, inconsistent with current events and rulings.

> It seems to me that the laws are somewhat murky ...

Not really, they're just not enforced until someone complains that his rights have been violated. But it's also true that privacy is being eroded in a major way right now, and the law hasn't really kept up -- there are laws on the books that, once tested in court, will probably be cast out. If that's the sense in which you mean "murky," then you're right.

> I mean, you still see things like Firesheep, packet sniffing, network surveillance tools, all published with the caveat to just use for "testing".

Strictly speaking, there's no problem until and unless it's a third party that's being monitored -- that person can complain that his right to privacy has been violated, even if no use is made of the monitored communications.

In principle. :)

The burglar's phone's MAC address in your router's nicely timestamped log would be evidence, I would think, albeit less iron-clad than surveillance video of him taking your stuff. It would serve to bolster the prosecution's case, should the police manage to find the perp though other means. E.g., the thief might have been found fencing your Vermeer. He might claim to have acquired it innocently from someone. In that case, the jury would find your log interesting as they weigh the evidence.

An interesting question is whether the MAC address alone could be used to trace the perp. The first 24 bits of the 48-bit MAC address identify the company that manufactured the adapter. Then the question would be, did the company that put the adapter into the phone cross-reference its MAC with the phone's serial number and the serial number with the owner.

A smart thief would turn his phone off during a job. Routers logging MAC addresses are probably a much less serious problem than cell carriers keeping logs of which phones were where when.

MAC addresses aren't unique but just nearly unique.

No, they're unique. Each manufacturer is given a block of MAC addresses, and they assign them like serial numbers to each NIC they build. Each cell phone, WiFi access point, and normal NIC, has a unique MAC. If this were not the case, if two devices had the same MAC, the risk of a network collision would exist, and manufacturers, aware of this risk and the damage it would do to their reputation, act to prevent it in their own interest.

Reply on news.ycombinator.com