In the section on security domains, 2
we talked about physical security 3
in terms of a separate device like a secure laptop, 4
or a secure USB, or SD card. 5
Now we’re going to dig a little deeper in relation to privacy and anonymity, 6
and physical security domains. 7
So let’s start with devices and their hardware serial numbers. 8
So devices have hardware serial numbers that can uniquely identify them. 9
These unique identifiers can then possibly trace back to you 10
through a money trail or potentially other methods, 11
if the hardware wasn’t bought anonymously. 12
If you care about non-attribution and staying anonymous, 13
then you need isolation of the unique hardware identifier 14
so it cannot be enumerated by your adversaries. 15
The first unique hardware ID that you need to be aware of, 16
if you’re not already, is the MAC address. 17
An adversary could get your MAC address off your network card, 18
which is always a unique number. 19
This method was used by the NSA to deanonymize TOR users 20
through a Firefox exploit on the TOR browser. 21
And this is a write up here of how that happened, if you’re interested. 22
The MAC address is like an IP address, but for your local network only. 23
If an adversary has access to your machine, 24
they can view the unique MAC. 25
If they know the unique MAC, 26
that can be potentially traced back to you 27
through the purchasing of that device. 28
So in Windows, if you want to look at your Mac address, 29
you simply type in ipconfig/all. 30
I have a lot of adaptors on this because it’s a virtual machine, 31
but let’s scroll up and see if we can find the physical addresses, 32
the Mac address. 33
There’s one of them. 34
So for this network adaptor, that’s the physical address, 35
unique physical address. 36
You may only have one network card, 37
so you may only see one physical address. 38
There you go, there’s the Mac address. 39
And there’s another one. 40
And yours will probably say Ethernet adaptor 41
or wireless adaptor and you'll see it here. 42
On both Mac and Linux, you can use ifconfig. 43
We'll need sudo to run it or root permissions. 44
And there it is, 45
the hardware unique MAC address, on both Linux and Mac OS X. 46
It’s also possible to see it using IP tool. 47
So you can see it there. 48
IP is like the new ifconfig. 49
And now just specify eth0 so you can see the hardware address. 50
It’s the same thing, 51
just another way to find the hardware address. 52
The first three bytes of a MAC address are the manufacturer’s ID. 53
So if you have an Apple laptop, 54
then it'll be the ID of Apple. 55
If you’ve got a Lenovo laptop, then it'll be the ID of Lenovo. 56
And the last three bytes of your MAC address, 57
this is specific and unique to the net, 58
to the network card, to the Wi-Fi card, 59
to the Ethernet card, 60
so it’s this last three that will be unique to your device. 61
If you’re looking for privacy, anonymity, non-attribution, 62
then you need to change your MAC address. 63
It can be potentially got out via malware 64
and it can be seen on local networks as well Ethernet and Wi-Fi. 65
For Windows you can use this tool here to change the Mac address. 66
It’s a pretty good tool, works very well, it’s free. 67
In Linux there’s a tool called MAC Changer. 68
This is available in Kali, 69
but won’t be available in Debian and other distributions straight away, 70
so you'll need to install it. 71
And you can select whether you want to set it up 72
to automatically change the MAC address. 73
I’m going to select No here, but you can select Yes. 74
So we need to change the MAC. 75
To change the MAC we need to down the network interface. 76
The network interface on this one is eth0. 77
That’s taking eth0 down. 78
So we can see there just the local loopback, 79
eth0 isn’t there anymore, so now we can change the MAC address. 80
The -r means random, 81
so it’s randomly changing the eht0 MAC address, 82
and now it’s changing to the new MAC address that you can see now. 83
As you can see, the interface is still not there, 84
so we need to bring it up again. 85
And that will bring it up. And let’s see if it’s up. 86
And there it is with its new hardware address, 87
its new MAC address. 88
On a Mac, you can change your MAC address using a command line as well. 89
And that would be like this. 90
en0 would be the name of the interface, 91
so whatever the name of the interface is. 92
And then you specify at the end there the MAC address 93
and that will change the MAC address on a Mac OS X. 94
But I’m on Debian here, so I’m not going to run that command. 95
If you don’t want to do it on the command line, 96
with Mac OS X you can download MacDaddy X. 97
That will enable you to change the MAC. 98
And there’s actually another tool as well 99
called WiFiSpoof which will enable you to change the MAC address. 100
Virtual machines hide your real MAC 101
and also allow for the setting of the MAC address. 102
Example here, 103
so you can see the MAC address here. 104
And we can generate a new, random one there. 105
That’s VirtualBox. 106
But if you fear a knock at the door, 107
you need to change the virtual MAC through the VM frequently. 108
You don’t want a static MAC that ties you to a virtual machine 109
even if it is just a virtual MAC address. 110
But the best option is to have anonymously purchased hardware 111
like laptops, and network cards, 112
and Wi-Fi, and network dongles; 113
the devices that have MAC addresses. 114
You could purchase a whole bunch of cheap USB network adaptors 115
and use a MAC changer in combination to mitigate the risk. 116
This would be the best way of MAC mitigation: 117
anonymous hardware plus MAC Changer. 118
Tails, another security focused operating systems, 119
use MAC Changers as default. 120
But do check to make sure they don’t show the real MAC 121
of your device’s network card. 122
You know how to check that now, so when you’re not using Tails, 123
check out what the MAC is. 124
Then, when you’re in Tails, 125
run ifconfig or sudo ifconfig 126
and see if the MAC address has changed.