[TOOL] SMAC, Windows MAC Address Modifying Utility

From: support@securiteam.com
Date: 01/13/03

  • Next message: support@securiteam.com: "[EXPL] Security Vulnerability Found in S8Forum" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 13 Jan 2003 11:13:35 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      SMAC, Windows MAC Address Modifying Utility
    ------------------------------------------------------------------------

    DETAILS

    How SMAC works:
    SMAC takes advantage of the NdisReadNetworkAddress function in the
    Microsoft Device Driver Development Kit (DDK.)

    NdisReadNetworkAddress(...) is called by the network adapter driver to
    obtain a user specified MAC address in the registry. After the driver
    confirmed that there's a valid MAC address specified in the registry key,
    the driver then programs the MAC address to its hardware registers to
    override the burn-in MAC address.

    Why to use SMAC:
     * Test Security vulnerabilities on authentication and authorization based
    on MAC addresses.
     * Test and setup High Availability (Firewall & Application Clustering)
    solutions
     * Testing network management tools
     * Testing incident response procedures on simulated network problems
     * Testing Intrusion Detection Systems (IDS), whether they are Host and
    Network Based IDS.
     * Some software can ONLY be installed and run on the systems with
    pre-defined MAC address in the license file. If you need to install one of
    these applications to another system with a different NIC, this will come
    handy.
     * Software vendors who assigned licenses based on MAC addresses might
    want to know that there is a way to work around their licensing methods.
     * If for whatever reason you need to keep the same MAC address as your
    old NIC, but your old NIC failed.
     * Some Cable Modem ISP (i.e. AT&T Broadband) assign IP addresses to
    computers base on its MAC addresses. For whatever reason, if you want to
    swap 2 PC's regularly to connect to the cable modem, it would be a lot
    easier to change the MAC address than to change Network Interface Card (Of
    course a cable modem router like Linksys or Netgear would be even easier
    for this job, and many cable modem routers have "Change MAC Address"
    feature built-in for this purpose).

    ADDITIONAL INFORMATION

    The tool can be downloaded from:
     <http://www.klcconsulting.net/Change_MAC_w2k.htm>
    http://www.klcconsulting.net/Change_MAC_w2k.htm

    The information has been provided by <mailto:klai@klcconsulting.net> Kyle
    Lai.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages