Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What types of attacks are made possible or worse by having knowledge of a target computer's MAC address?

I am planning on using a type 1 UUID generator that includes the generating computer's MAC address in the UUID. I've read that you should be aware of the security aspects of using this type of UUID, but haven't found a good resource as to what actual problems exist.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Mostly it is about a users privacy. Generally an interfaces physical addresses never leaves the LAN. There are very few attacks that have anything to do with the MAC address. On the places where you can attack based on the MAC address, it is usually easy to get the address using rarp or a simple packet capture.

But if you include it in the generation of UUIDs then you will be able to say a UUID was created by a particular system. A person with enough knowledge could update the mac address to be something else. Perhaps to create a UUID that looks like it was created by someone else, or perhaps just to hide themselves.

share|improve this answer
    
thanks. since the server will be generating all of the UUIDs, user privacy isn't a concern for me and a user changing their mac address has no effect. –  Ryan Ahearn Nov 20 '09 at 14:50
add comment

Well the first half of a MAC address does identify the vendor. So if they know who makes the NIC card, they might be able to find vulnerabilities particular to that brand. For example '00-06-25' is linksys.

That being said, I wouldn't really worry about it.

share|improve this answer
add comment

Zoredache is correct. Since MAC addresses don't generally leave the local network, and are not reachable from outside the network, knowledge of these MAC addresses really don't help an attacker.

Even having a computers local private IP address is probably not very valuable with today's usage of NAT and firewalls.

If I were an attacker, I'd rather have the public reachable IPs because those will be the points of attack from the outside.

That's my $0.02

Keith

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.