R: MAC address spoofing - conflict?

["Sebastian Zdrojewski" <en3py () itvc net>]

Well, at the beginning of the message I thought you were talking of a wired
cable, which could be a lil problematic because of the available per-port
security setting that can be set up.

Talking of wireless I don't think you will have any kind of problems like
being rejected and/or disconnect the other client since there is no other
way to identify the device if not using its own mac address (see CSMA/CA
operational status). I never made a test by myself with this, but once you
spoof your own mac address with a "white listed" one on the AP you should be
able to act as the allowed client.

Best regards

En3pY

-----Messaggio originale-----
Da: penetrationtestmail () gmail com [mailto:penetrationtestmail () gmail com] 
Inviato: lunedì 14 agosto 2006 5.15
A: pen-test () securityfocus com
Oggetto: MAC address spoofing - conflict?

Hi,

Let's say you're wardriving, and you find an open network which has MAC
address filtering enabled. There is one active client on the network. You
insert BackTrack, start Kismet and find out the client's MAC address. Then,
you change your MAC address to mimic the client's, and connect to the
network.

What happens? Do you kick the other client off, or do both clients conflict
with each other because their MAC addresses are the same? Or does something
else happen? I'm sorry I can't check this at the moment, but I do not have a
wireless network to test it on.

Thanks in advance,

Flail

----------------------------------------------------------------------------
--
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to
rise, 
you need to proactively protect your applications from hackers. Cenzic has
the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
----------------------------------------------------------------------------
--



-- 
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.405 / Virus Database: 268.10.9/417 - Release Date: 11/08/2006



------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------