Random MAC address

This Alarm is raised by WiFi Manager when it detects any MAC address which is not in its pre configured MAC list and thereby alerts the administrator of a possible Random MAC address Attack.

MAC Address:

Computer Networking equipment come with an in-built Identifier-address which is unique. This address assigned to the network equipment is called MAC address - Media Access Control Address.  These are managed by IEEE and are globally unique.  The IEEE assigns globally the first three bytes, which will denote the manufacturer of the device, and the manufacturer chooses the last three bytes. The number officially assigned by IEEE are publicly available.

What are the possible scenarios for having a random MAC address ?

IEEE makes the list of prefix allocations and makes this information available to the public. Injecting packets into the WLAN by using a random value for this MAC is simple for an attacker.  He may do this by invoking an appropriate software tool that engages in a dialog with the user and accept the  values.  MAC addresses which appear on the network whose prefix are yet to be allocated by IEEE are known as random MAC.  The following are the possible scenarios for an random MAC to appear on the WLAN -

• WiFi Manager configuration is not updated to reflect the latest MAC revisions by IEEE
  
• An attacker in the process of hiding his identity, may resort to use a random MAC while injecting packets into the WLAN.

Common tools for manipulating MAC address in the WLAN packets -

• MACslot
• MACchanger
• Wellenreiter

What should the Administrators do?

Whenever there is an incidence of Random MAC Address, the administrators should try and trace the reason and take appropriate measures.  If  WiFi Manager is not updated  to the IEEE revisions, the administrator should update it. If the random MAC address is traced as being used by the Attacker, the administrator should block the same.