What is MAC Address Spoofing?

You hear about new types of cyber attacks almost daily. As soon as information security experts have figured out how to deal with one threat, another pops up. One of the latest tricks used by hackers is called MAC address spoofing.

MAC spoofing can be used to steal private data from unsuspecting victims. If you run a large or public network, you should be aware of this cyber attack and what you can do to prevent it from happening.

What is a MAC address?

A MAC address is a series of characters that identifies a particular device on a network. MAC stands for Media Access Control. When a device is produced, the manufacturer assigns it a MAC address. Unlike IP addresses, which can be dynamic, MAC addresses never change. It’s easier to identify a device on a network by looking at the MAC addresses.

The MAC address is hardcoded onto a device so it cannot be changed at the hardware level. It can be changed at the software level, though. You can fake a device’s MAC address so it cannot be seen by public networks. This is known as MAC spoofing.

Is spoofing a MAC address bad?

Spoofing a MAC address is legal and can be used for legitimate purposes, such as avoiding being tracked. You can also do it safely without having to use any external software.

Often, however, MAC address spoofing is used for nefarious purposes. It’s called a MAC spoofing attack.

What is a MAC Spoofing Attack?

A MAC spoofing attack is when a hacker mimics your MAC address to redirect data sent to your device to another device. It allows the attacker to gain unauthorized access to a network to launch a man-in-the-middle attack.

MAC spoofing lets an attacker bypass security measures that you have set up, such as MAC filtering. So if your network is set up to only work with certain MAC addresses (i.e. MAC filtering), an attacker can pretend to be one of those addresses to gain access.

What does spoofing a MAC address do?

Spoofing a MAC address allows you to change how your device’s MAC address appears to a network. It doesn’t actually change the MAC address of your device — this is impossible. But you can make it look like the MAC address has changed.

There are several ways to change a MAC address at the software level, including applications like Windscribe that can do it for you with the click of a button. The main reasons someone might want to spoof a MAC address include:

• Hide the identify of their device
• Avoid being tracked or traced
• Gain access to a network that is limited to certain MAC addresses
• Launch a MAC spoofing attack

How does MAC spoofing work?

An attacker simply takes the MAC address of one of your devices and impersonates it with their device. The network then thinks the hacker’s device is yours, and sends your data to it. By setting up a MAC spoofing attack, a hacker can intercept your private data.

Some other cyber attacks that are related to MAC spoofing are:

• Session hijacking
• Network eavesdropping
• Bypassing authentication
• Man-in-the-middle attack

MAC Spoofing Attack Example

A good example of a MAC spoofing attack that affects real people — and not just network admins — was posted on the Stack Exchange Information Security site.

The owner of a small coffee shop that offers free WiFi noticed spoofed MAC addresses being used on their network. They learned from their Internet Service Provider (ISP) that the spoofers were using the coffee shop’s network to Nmap scans. Nmap scanning is a way to look for open ports on a network to gather information about the devices connected to that network.

So the MAC spoofers at this coffee shop were using the free WiFi to try and spy on other coffee shop patrons. This is a situation where it’d be good to be able to identify the MAC spoofers, so the shop owner can kick them out and ban them from returning. Detecting MAC address spoofing is difficult, however.

Can MAC address spoofing be detected?

Unfortunately, MAC address spoofing is hard to detect. While you may be able to tell if a fake address is accessing your WiFi network (such as 11:22:33:44:55:66), there’s no reliable way to determine which devices are using them.

Until we come up with a better way to find people using fake MAC addresses for nefarious purposes, the best you can do is try to prevent MAC address spoofing attacks on your network.

How to Prevent a MAC Spoofing Attack

If you don’t want your network to be susceptible to a MAC spoofing attack, there are a few things you can do.

1. Encrypt network traffic

You can keep your network more private and secure by encrypting all the traffic that gets sent to and from it. If the data is encrypted, an attacker will have a hard time reading and modifying the data. If they manage to get the data, they won’t be able to know what it is without your encryption key.

2. Configure Access Control Lists (ACLs)

You can tighten up control to your network by allowing only specific MAC addresses to access your network. If it’s limited to certain devices, attackers will have a harder time using a random MAC address to be able to enter your network.

3. Shore up port security

Increase the security of your network by configuring your port switches so they only allow certain MAC addresses through specific ports. This limits an attacker even further from being able to spoof a MAC address to gain access to your network.

Don’t be a victim of MAC address spoofing

Now that you know what MAC spoofing is, you can avoid it on your own network. Take the needed steps to keep your data secure and private and don’t fall victim to a MAC spoofing attack.

Learn about other types of cyber attacks and how to prevent them by reading through our online safety articles.