MAC Address spoofing

by Law Metzler 26. February 2010 04:48

While travelling and visiting a family members home recently, I ran into an issue with their modem not allowing me to connect with my laptop.  Turns out that their provider had MAC filtering on their system.

A MAC Address is a unique number (hexadecimal) that most every network adapter has.  When you plug in a cable to a router and then to your computer, the first communication that occurs is the two devices declaring who they are by stating their MAC address (Ok, this is a big simplification, but no need to digress to far).  MAC addresses are intended to be globally unique, and as such are divided into two: The manufacturer ID and a manufacturer assigned ID.  This  helps guarantee that all MAC addresses are unique.

MAC filtering is a security measure some routers or ISPs use to limit access to the network. By stating that only computers with a certain MAC address are allowed onto the network, you can add an additional layer of security.  Most wireless routers have this feature (a good idea if you're paranoid and already set up a password on your wireless network [WHICH EVERYONE SHOULD DO]). Many non-wireless routers have this feature also.  And occasionally, ISP's enable this feature on their networks.

This is a problem that I rarely (actually, only once before) have run into.  It used to be simple for me to overcome, as I used to take a wireless router with me also, and that would easily allow for overriding of the MAC address though a configuration screen.  However, with the proliferation of wireless routers I stopped bringing my own and instead just jump on the local network.

Luckily, there is a way to spoof your MAC address.

There's a couple programs out there to do it for you (google will help, but I haven't tried any of them so can't recommend them) but I prefer to get my hands dirty, so with no further ado, how to spoof your MAC address:

Windows Vista:

NOTE: This requires modifying your registry.  If you do NOT know what you are doing, DO NOT DO THIS.  If you mess up your registry, your computer may not boot at all.  

First, you'll need to know the adapter you are changing your mac address for.  The easiest way to make sure you have the correct one is to open a command prompt and type:

net config rdr

 

You'll see a line that says "NetBT_Tcpip_{XXXXXXX....}.  This is the GUID of your adapter (A GUID is a Globally Uniqued IDentifier).  Copy this number, (between the curly brackets)  In this example, the GUID is 6F3A69A0-81B8-42B4-A38D-06ECC66485CC

Next you'll need to edit the registry.  In the command prompt, type:

REGEDIT

Once in the registry editor, navigate to the key:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

Underneath this key are lots of sub keys.  To find the one you want (with that key selected) press Ctrl+F and search for the GUID.  You should find it as a value for a key named NetCfgInstanceId.  Inside this key, add a new string value with a name of NetworkAddress and set the value to the MAC Address you want (no dashes).

Once that is done, you can reboot or disable/re-enable  the network device in Device manager.

To revert back, simple delete the key you added (NetworkAddress).

 

Hope that helps

Tags: , , ,

Tutorial

Powered by BlogEngine.NET 1.5.0.7
Theme by Mads Kristensen