What is MAC spoofing?

Every device that’s connected to a network possesses a worldwide, unique, and physical iden­ti­fi­ca­tion number: the Media Access Control address, or MAC for short. This burned-in address (BIA) is virtually etched to the hardware by the man­u­fac­tur­er. Users are not able to change or rewrite the MAC address. But it is possible to mask it on the software side. This masking is what’s referred to as MAC spoofing.

• MAC addresses: distinct hardware addresses identify network interface con­trollers (NIC) such as LAN cards or WLAN adapters, and are used to identify devices in local networks. Every MAC address includes 48 bits, or 6 bytes, and is arranged in the following pattern: 00:81:41:fe:ad:7e. The first 24 bits are the man­u­fac­tur­er code assigned by the Institute of Elec­tri­cal and Elec­tron­ics Engineers (IEEE), and the following 24 bits are the device number defined by the man­u­fac­tur­er.

• Spoofing: in the network ter­mi­nol­o­gy, spoofing refers to the various methods which can be used to ma­nip­u­late the fun­da­men­tal address system in computer networks. Hackers use this method of attack to conceal their own identity and imitate another. Other than MAC addresses, other popular targets for spoofing attacks are the internet protocol (IP), domain name system (DNS), and address res­o­lu­tion via Address Res­o­lu­tion Protocol (ARP). Basically, spoofing is a res­o­lu­tion strategy for trou­bleshoot­ing – but in most cases, it’s used for the in­fil­tra­tion of foreign systems and illegal network ac­tiv­i­ties instead.

The­o­ret­i­cal­ly, every network device in the world is iden­ti­fied by a MAC address. But not every user wants this trans­paren­cy on the internet. One reason to mask your MAC address is for the pro­tec­tion of privacy – for example, in public WLAN networks. This le­git­i­mate use of MAC spoofing is in op­po­si­tion to the illegal ac­tiv­i­ties, where users change MAC addresses to cir­cum­vent access re­stric­tions and security measures or imitate the identity of another network device.

Anonymiza­tion

Some users prefer to hide the identity of their device behind a false MAC address in order to protect their privacy. One reason is because MAC addresses sent over public LAN or WLAN networks are usually un­en­crypt­ed. Every user on the network can then track which devices are reg­is­tered in the network, read out the re­spec­tive hardware addresses, and use them for illegal ac­tiv­i­ties. Hackers use this op­por­tu­ni­ty to surf anony­mous­ly. Generally, the MAC address of another network device is imitated to take advantage of its access rights and shift the blame for illegal ac­tiv­i­ties to another user.

Identity theft

To protect IT systems from internal and external dangers, ad­min­is­tra­tors sometimes implement security measures that restrict access to the LAN to au­tho­rized devices. At the network level, linking elements such as Ethernet switches via port security provide the op­por­tu­ni­ty to filter network data traffic on the OSI layer 2. Switches can separate big networks into smaller segments. Once a con­nec­tion has been es­tab­lished from one segment to another, the in­ter­me­di­ate coupling element checks the MAC address of the sender device and matches it with an ad­min­is­tra­tor-created whitelist. If it’s an unknown address, the switch blocks the re­spec­tive port and stops the com­mu­ni­ca­tion attempt. WLAN networks can also restrict access to known network devices using MAC filters. But MAC spoofing enables hackers to get around security measures like this. In reality, MAC whitelists offer very little pro­tec­tion. Masking the hardware addresses of in­di­vid­ual computers behind au­tho­rized network users requires nothing more than a manual con­fig­u­ra­tion of the network settings on the re­spec­tive operating system. Linux, Mac OS X and Microsoft Windows all allows users to establish LAN con­nec­tions without requiring a MAC address. By contrast, hardware addresses from WLAN cards using Windows cannot easily be ma­nip­u­lat­ed.

Licensing terms

Sometimes software ap­pli­ca­tions are re­strict­ed to a certain number of devices. This is only possible on systems whose MAC addresses have been given in the license agreement. If one of the devices has to be replaced due to a hardware issue, then the software can’t be used with the new device. Some users get around this re­stric­tion by rewriting the new hardware address in the software so that it matches the one listed in the license, but this approach isn’t rec­om­mend­ed.

A provider could classify this type of MAC spoofing as a fraud­u­lent use of services and take legal action. Instead, licensees should contact their provider and ask about the pos­si­bil­i­ty of a hardware exchange. If MAC spoofing is used to imitate an au­tho­rized device to gain access to paid software ap­pli­ca­tions or online services, it’s always con­sid­ered a legal offense.

To mask a MAC address, you just need to access the network settings on the Windows control panel and define a new iden­ti­fi­ca­tion number in the software. The operating system will now send data packets with the user-defined MAC address in the local network. The following step-by-step tutorial explains MAC spoofing using Windows 7. The con­fig­u­ra­tion on other Windows versions follows the same general pattern, but the details may vary.

As soon as you confirm your settings by clicking OK, your network card dis­con­nects from the LAN and builds a new con­nec­tion using the custom LAA.

As an al­ter­na­tive to the network settings, Windows users have the option to change the MAC address using the registry. This option is only rec­om­mend­ed for ex­pe­ri­enced users, though.

To access the Windows registry, enter the command regedit into the search list and start the reg­is­tra­tion editor. Then, navigate to the following entry:

HKEY_LOCAL_MACHINE\SYSTEM\Cur­rent­Con­trolSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

Here you’ll find a row of con­sec­u­tive­ly numbered sub­fold­ers (0000, 0001, 0002, etc.). Find the folder whose Dri­verDe­sc entry contains the name of your network card. If the Net­workAd­dress entry is found in this folder, edit it by right-clicking on the entry and selecting the “Change” function from the context menu. Enter the desired MAC address here.

If no cor­re­spond­ing entry is available, you can create one with right-click > “New” > “String”.

Instead of changing the MAC address manually using the network settings or the Windows registry, users can employ free software solutions like Tech­ni­tium MAC Address Changer or Windows 7 MAC Address Changer.

• The Tech­ni­tium MAC Address Changer allows users to easily manage network cards through a clear user interface. The Freeware tool offers an overview of all con­nec­tions, displays the current MAC addresses of the hardware in use, and includes a function that allows you to change it with the push of a button. The original iden­ti­fi­er is stored in the tool as well as the altered MAC address. An in­te­grat­ed generator creates randomly generated sug­ges­tions on request. Tech­ni­tium MAC Address Changer is available for Windows 7, 8, and 10 and runs 32-bit and 64-bit versions. As soon as user settings are made in the software interface, the program writes the cor­re­spond­ing values in the Windows registry. Manual in­ter­ven­tion is elim­i­nat­ed, and so the risk of jeop­ar­diz­ing the stability of the system with incorrect entries is too. All settings can be returned to their initial state by pressing the “Restore Original” button.

• The Win7 MAC Address Changer runs dif­fer­ent­ly on Windows Vista and Windows 8, as the name would suggest. The Freeware software offers a similar range of functions as the Tech­ni­tium MAC Address Changer. The MAC spoofing follows four steps: Selection of the network card, selection of the operating system, selection of the desired MAC address, and con­fir­ma­tion of the settings using the “Change” button. The Win7 MAC Address Changer also supports users with a “Randomize” button. The “Reset to Default” button restores the default settings.

Just like with manual MAC spoofing, use of these programs doesn’t change the physical address. The operating system simply pretends that the user-defined Locally Ad­min­is­tered Address is the Uni­ver­sal­ly Ad­min­is­tered Address.