There's a shopping center near where I live. They offer free WiFi for up to two hours or 1GB downloads per day. Once you exceed one of these limits you will be locked out of the WiFi for the rest of the day. I got locked out of it on my iPhone the other day. I'd like to try and find a way around this.
I ran Wireshark before and connected to my home WiFi. The two areas which stood out to me were the MAC address and hostname. MAC addresses can be spoofed but most people don't bother. Hostnames are a lesser known part of your computer but also easy to spoof. There probably is something I missed because I was drunk when I did this :/
MAC addresses are used on the network interface layer to differentiate different devices on the local subnet. On Lunix they can be easily spoofed using the command "sudo macchanger -r <interface>". Phones and tablets need to be hacked to spoof the MAC address.
Hostnames are your computer's name, according to Wireshark, they are collected using DNS. On Linux they can be spoofed by using the command "sudo hostname <new hostname>". They can be permanently changed by editing the files "/etc/hosts" and "/etc/hostname" then rebooting. You can change them on your phone without hacking it, but I don't remember how.
There are other methods they could be using to identify my devices. When I connected to their WiFi I was taken to a webpage which asked for my personal details and to accept their terms of service. They could be using device fingerprinting to identify my phone. I'm not sure how effective this is for mobile devices. Each device of the same model should be exactly the same except for the IMEI number. For example, all iPhone 5s should have the same screen resolution, installed fonts, and so on. They probably do use encryption at the application layer making it very difficult to find out what they are transferring*.
IMEI numbers are used to identify different mobile devices and can only be spoofed with hacks.
The phone I was using can be jailbroken using Checkm8. I haven't tried this yet.
* To find out I'd have to connect to their WiFi using a virtual machine, dump the RAM, extract the encryption keys, input the keys into Wireshark and read the decrypted TCP streams. Alternatively, I'd have to read through all the Javascript code on their login page.
I ran Wireshark before and connected to my home WiFi. The two areas which stood out to me were the MAC address and hostname. MAC addresses can be spoofed but most people don't bother. Hostnames are a lesser known part of your computer but also easy to spoof. There probably is something I missed because I was drunk when I did this :/
MAC addresses are used on the network interface layer to differentiate different devices on the local subnet. On Lunix they can be easily spoofed using the command "sudo macchanger -r <interface>". Phones and tablets need to be hacked to spoof the MAC address.
Hostnames are your computer's name, according to Wireshark, they are collected using DNS. On Linux they can be spoofed by using the command "sudo hostname <new hostname>". They can be permanently changed by editing the files "/etc/hosts" and "/etc/hostname" then rebooting. You can change them on your phone without hacking it, but I don't remember how.
There are other methods they could be using to identify my devices. When I connected to their WiFi I was taken to a webpage which asked for my personal details and to accept their terms of service. They could be using device fingerprinting to identify my phone. I'm not sure how effective this is for mobile devices. Each device of the same model should be exactly the same except for the IMEI number. For example, all iPhone 5s should have the same screen resolution, installed fonts, and so on. They probably do use encryption at the application layer making it very difficult to find out what they are transferring*.
IMEI numbers are used to identify different mobile devices and can only be spoofed with hacks.
The phone I was using can be jailbroken using Checkm8. I haven't tried this yet.
* To find out I'd have to connect to their WiFi using a virtual machine, dump the RAM, extract the encryption keys, input the keys into Wireshark and read the decrypted TCP streams. Alternatively, I'd have to read through all the Javascript code on their login page.
Last edited by thewannacryguy,
