[TOOL] SMAC, Windows MAC Address Modifying Utility

• Previous message: support@securiteam.com: "[NT] Multiple Vulnerabilities Found in PlatinumFTPserver"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: support@securiteam.com
To: list@securiteam.com
Date: 13 Jan 2003 11:13:35 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

Beyond Security would like to welcome Tiscali World Online
to our service provider team.
For more info on their service offering IP-Secure,
please visit http://www.worldonline.co.za/services/work_ip.asp
- - - - - - - - -

  SMAC, Windows MAC Address Modifying Utility
------------------------------------------------------------------------

DETAILS

How SMAC works:
SMAC takes advantage of the NdisReadNetworkAddress function in the
Microsoft Device Driver Development Kit (DDK.)

NdisReadNetworkAddress(...) is called by the network adapter driver to
obtain a user specified MAC address in the registry. After the driver
confirmed that there's a valid MAC address specified in the registry key,
the driver then programs the MAC address to its hardware registers to
override the burn-in MAC address.

Why to use SMAC:
 * Test Security vulnerabilities on authentication and authorization based
on MAC addresses.
 * Test and setup High Availability (Firewall & Application Clustering)
solutions
 * Testing network management tools
 * Testing incident response procedures on simulated network problems
 * Testing Intrusion Detection Systems (IDS), whether they are Host and
Network Based IDS.
 * Some software can ONLY be installed and run on the systems with
pre-defined MAC address in the license file. If you need to install one of
these applications to another system with a different NIC, this will come
handy.
 * Software vendors who assigned licenses based on MAC addresses might
want to know that there is a way to work around their licensing methods.
 * If for whatever reason you need to keep the same MAC address as your
old NIC, but your old NIC failed.
 * Some Cable Modem ISP (i.e. AT&T Broadband) assign IP addresses to
computers base on its MAC addresses. For whatever reason, if you want to
swap 2 PC's regularly to connect to the cable modem, it would be a lot
easier to change the MAC address than to change Network Interface Card (Of
course a cable modem router like Linksys or Netgear would be even easier
for this job, and many cable modem routers have "Change MAC Address"
feature built-in for this purpose).

ADDITIONAL INFORMATION

The tool can be downloaded from:
 <http://www.klcconsulting.net/Change_MAC_w2k.htm>
http://www.klcconsulting.net/Change_MAC_w2k.htm

The information has been provided by <mailto:klai@klcconsulting.net> Kyle
Lai.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Next message: support@securiteam.com: "[EXPL] Security Vulnerability Found in S8Forum"
• Previous message: support@securiteam.com: "[NT] Multiple Vulnerabilities Found in PlatinumFTPserver"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]