How to track down a wireless hacker

I have a new client who was setup with a wireless network a while back
using WPA encryption by another firm.
An 'unauthorized user' broke the encryption and got onto their network.
They've come to me to design a solution so that this doesn't happen
again, which isn't a problem.


However they also asked me if it's possible to track down the attacker
if this happened again.
From what I know, it's not possible is it?

If the attacker didn't change their MAC address, and say the companies
lawyers could get some sort of court order to intel, dell, etc to
release which MAC address went to which computer and who bought said
computer. Does the manufacture even keep that info?

If the attacker did change their MAC address, the real MAC address
will never transverse the wire(AIR) right, or is it still in the
packet somewhere?

Any other thoughts or ideas to track someone down?
Is any other info leaked that I'm not thinking about?





Thanks,
Jon

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: About War Driving ..
    ... However, MAC filtering does not qualify as defense in depth, ... because the attacker can spoof a valid IP address. ... broadcasting the SSID doesn't hide a network, but just makes it show up ... machines in your building that you can control and check the MAC ...
    (Security-Basics)
  • Re: Authentication of a messages using a counter and a MAC
    ... used to do MAC of the message, so when the want to communicate the use ... Because you are taking a random walk, the odds of finding a collision ... the attacker build the data series they want ... forging the MAC for a single malicious packet." ...
    (sci.crypt)
  • Re: Authentication of a messages using a counter and a MAC
    ... I was thinking to have a MAC of size 3 byte, does it mean that i can ... Because you are taking a random walk, the odds of finding a collision ... the attacker build the data series they want ... forging the MAC for a single malicious packet." ...
    (sci.crypt)
  • Re: wireless help
    ... With some Mac and ip list restrict to your user only, ... if the attacker as an ip and a mac but cant use any services ... the victim, the victim, is out, and the attacker can get is connection. ... be encryption like VPN or IPSec, I suspect. ...
    (Security-Basics)
  • Re: Can a program prove its own integrity?
    ... > program he would have to find a way to calculate the right MAC for every ... If the attacker has access to the box, the MAC can be bypassed, ... get and build a simple program that does a SHA-1 hash of a file. ... Modify the program to calculate a hash of itself. ...
    (sci.crypt)