Original subtitles

1

In the section on security domains,

2

we talked about physical security

3

in terms of a separate device like a secure laptop,

4

or a secure USB, or SD card.

5

Now we’re going to dig a little deeper in relation to privacy and anonymity,

6

and physical security domains.

7

So let’s start with devices and their hardware serial numbers.

8

So devices have hardware serial numbers that can uniquely identify them.

9

These unique identifiers can then possibly trace back to you

10

through a money trail or potentially other methods,

11

if the hardware wasn’t bought anonymously.

12

If you care about non-attribution and staying anonymous,

13

then you need isolation of the unique hardware identifier

14

so it cannot be enumerated by your adversaries.

15

The first unique hardware ID that you need to be aware of,

16

if you’re not already, is the MAC address.

17

An adversary could get your MAC address off your network card,

18

which is always a unique number.

19

This method was used by the NSA to deanonymize TOR users

20

through a Firefox exploit on the TOR browser.

21

And this is a write up here of how that happened, if you’re interested.

22

The MAC address is like an IP address, but for your local network only.

23

If an adversary has access to your machine,

24

they can view the unique MAC.

25

If they know the unique MAC,

26

that can be potentially traced back to you

27

through the purchasing of that device.

28

So in Windows, if you want to look at your Mac address,

29

you simply type in ipconfig/all.

30

I have a lot of adaptors on this because it’s a virtual machine,

31

but let’s scroll up and see if we can find the physical addresses,

32

the Mac address.

33

There’s one of them.

34

So for this network adaptor, that’s the physical address,

35

unique physical address.

36

You may only have one network card,

37

so you may only see one physical address.

38

There you go, there’s the Mac address.

39

And there’s another one.

40

And yours will probably say Ethernet adaptor

41

or wireless adaptor and you'll see it here.

42

On both Mac and Linux, you can use ifconfig.

43

We'll need sudo to run it or root permissions.

44

And there it is,

45

the hardware unique MAC address, on both Linux and Mac OS X.

46

It’s also possible to see it using IP tool.

47

So you can see it there.

48

IP is like the new ifconfig.

49

And now just specify eth0 so you can see the hardware address.

50

It’s the same thing,

51

just another way to find the hardware address.

52

The first three bytes of a MAC address are the manufacturer’s ID.

53

So if you have an Apple laptop,

54

then it'll be the ID of Apple.

55

If you’ve got a Lenovo laptop, then it'll be the ID of Lenovo.

56

And the last three bytes of your MAC address,

57

this is specific and unique to the net,

58

to the network card, to the Wi-Fi card,

59

to the Ethernet card,

60

so it’s this last three that will be unique to your device.

61

If you’re looking for privacy, anonymity, non-attribution,

62

then you need to change your MAC address.

63

It can be potentially got out via malware

64

and it can be seen on local networks as well Ethernet and Wi-Fi.

65

For Windows you can use this tool here to change the Mac address.

66

It’s a pretty good tool, works very well, it’s free.

67

In Linux there’s a tool called MAC Changer.

68

This is available in Kali,

69

but won’t be available in Debian and other distributions straight away,

70

so you'll need to install it.

71

And you can select whether you want to set it up

72

to automatically change the MAC address.

73

I’m going to select No here, but you can select Yes.

74

So we need to change the MAC.

75

To change the MAC we need to down the network interface.

76

The network interface on this one is eth0.

77

That’s taking eth0 down.

78

So we can see there just the local loopback,

79

eth0 isn’t there anymore, so now we can change the MAC address.

80

The -r means random,

81

so it’s randomly changing the eht0 MAC address,

82

and now it’s changing to the new MAC address that you can see now.

83

As you can see, the interface is still not there,

84

so we need to bring it up again.

85

And that will bring it up. And let’s see if it’s up.

86

And there it is with its new hardware address,

87

its new MAC address.

88

On a Mac, you can change your MAC address using a command line as well.

89

And that would be like this.

90

en0 would be the name of the interface,

91

so whatever the name of the interface is.

92

And then you specify at the end there the MAC address

93

and that will change the MAC address on a Mac OS X.

94

But I’m on Debian here, so I’m not going to run that command.

95

If you don’t want to do it on the command line,

96

with Mac OS X you can download MacDaddy X.

97

That will enable you to change the MAC.

98

And there’s actually another tool as well

99

called WiFiSpoof which will enable you to change the MAC address.

100

Virtual machines hide your real MAC

101

and also allow for the setting of the MAC address.

102

Example here,

103

so you can see the MAC address here.

104

And we can generate a new, random one there.

105

That’s VirtualBox.

106

But if you fear a knock at the door,

107

you need to change the virtual MAC through the VM frequently.

108

You don’t want a static MAC that ties you to a virtual machine

109

even if it is just a virtual MAC address.

110

But the best option is to have anonymously purchased hardware

111

like laptops, and network cards,

112

and Wi-Fi, and network dongles;

113

the devices that have MAC addresses.

114

You could purchase a whole bunch of cheap USB network adaptors

115

and use a MAC changer in combination to mitigate the risk.

116

This would be the best way of MAC mitigation:

117

anonymous hardware plus MAC Changer.

118

Tails, another security focused operating systems,

119

use MAC Changers as default.

120

But do check to make sure they don’t show the real MAC

121

of your device’s network card.

122

You know how to check that now, so when you’re not using Tails,

123

check out what the MAC is.

124

Then, when you’re in Tails,

125

run ifconfig or sudo ifconfig

126

and see if the MAC address has changed.