On Wed, 17 Jun 2009 19:15:13 -0400, "kermit" <(E-Mail Removed)>
wrote:
>Jeff Liebermann wrote:
>> On Tue, 16 Jun 2009 22:38:26 -0400, "kermit" <(E-Mail Removed)>
>> wrote:
>>
>>> You router probably has within its firmware a way to control access
>>> times based on MAC (my Linksys and Zyxel have this feature) You
>>> should be able to set up a schedule that affects only specific PCs,
>>> iTouch, etc as defined by you.
>>>
>>> I do this at my house. I have a specific cutoff time on school
>>> nights and I don't have to worry about it. If one of the kids is
>>> working a school project that's running late and they need more time
>>> then I can temporarily extend access. Works fine.
>>
>> MAC filtering works easily, but is not very good security. There are
>> common methods of spoofing MAC addresses available:
>> <http://www.klcconsulting.net/Change_MAC_w2k.htm>
>> I had one of the neighbors kids borrowing my internet connection via
>> wireless. I eventually kicked him off after about five botnet
>> infections and some massive Bitorrent uploads. He just couldn't keep
>> his machine clean, so I blocked the MAC address of his laptop. It
>> took him about a week to figure out what happened. ARPwatch then
>> started seeing new MAC addresses every evening, which was getting
>> tedious. So, I changed the WPA encryption key and didn't tell him.
>> However, I wanted to see how swift he was, so I made the key a trivial
>> dictionary word and waited. It took another week for him to crack it
>> which I thought was rather impressive. About a month later, he got
>> his own cable modem connection and is living somewhat happily ever
>> after.
>
>I wasn't speaking of MAC filtering as a security measure. I was talking
>about the router's built-in scheduling/access ability which is based on MAC
>addresses. Actually, spoofing your MAC to gain access to a network using
>MAC filtering puts you subject to the access control based on MAC.
Only the honor system is weaker.
|