Live data from Hacker News

German police ask for help in identifying a bomber's MAC address

zdnet.com

41–50 of 66 posts

Re: German police ask for help in identifying a bomber's MAC address

#41

I wonder if there are any unintended consequences for this. For example, if you were able to identify the MAC address, and you were unethical, you could just blackmail the "bomber" - whether they are innocent or not. Also, some devices allow you to reprogram the MAC address so you could in theory use this to blackmail someone as well, or at least get them harassed by the police.

[deleted]

Re: German police ask for help in identifying a bomber's MAC address

#42

I wonder if there are any unintended consequences for this. For example, if you were able to identify the MAC address, and you were unethical, you could just blackmail the "bomber" - whether they are innocent or not. Also, some devices allow you to reprogram the MAC address so you could in theory use this to blackmail someone as well, or at least get them harassed by the police.

So what? They'd investigate the victim, find nothing, and leave him be.

Re: German police ask for help in identifying a bomber's MAC address

#43

Earlier quoted context omitted.

I'm certainly no legal expert, but wouldn't the whole "fruit of the poisonous tree" argument apply to any evidence found after and/or as a result of the MAC address connection?

This argument largely does not exist outside English law. Though I very much doubt it would apply, if it did.

IIRC, it's barely a concept in English law, primarily US law.

It has however seen some use in the ECHR , notably against Germany (citing various US court cases):

> the applicant sought a declaration that [...] all items of evidence[...], which had become known to the investigation authorities because of the confession extracted – the so-called “fruit of the poisonous tree” – was prohibited [...] The Chamber considered that there was a strong presumption that the use of items of evidence obtained as the fruit of a confession extracted by means contrary to Article 3 rendered a trial as a whole unfair in the same way as the use of the extracted confession itself.

Gäfgen v. Germany, at 25 and 147 https://hudoc.echr.coe.int/eng#{%22dmdocnumber%22:[%22868977...}

It almost certainly wouldn't apply here though (as there is no illegal act).

Re: German police ask for help in identifying a bomber's MAC address

#44
post #9

Earlier quoted context omitted.

> Also, some devices allow you to reprogram the MAC address I might be mistaken, but don’t changed MAC addresses (at least using macchanger) persist only until the next reboot?

Any volatile setting that can be changed can be made to be persistent.

[deleted]

Re: German police ask for help in identifying a bomber's MAC address

#45

Fun fact: MAC addresses are not unique.

I remember one occasion ~2002 where a new NIC with a duplicate MAC addresses took down our DC - the whole IT team was floundering for hours before the cause was discovered after I noticed it in Snort logs. I have a strong interest in infosec, and I'd fought hard to get that Snort tap installed only a couple of weeks previously :)

Re: German police ask for help in identifying a bomber's MAC address

#46

I wonder if there are any unintended consequences for this. For example, if you were able to identify the MAC address, and you were unethical, you could just blackmail the "bomber" - whether they are innocent or not. Also, some devices allow you to reprogram the MAC address so you could in theory use this to blackmail someone as well, or at least get them harassed by the police.

>For example, if you were able to identify the MAC address, and you were unethical, you could just blackmail the "bomber" - whether they are innocent or not. Didn't something along the lines of this happen with this with the Boston bombing and /r/, where they named the wrong - and innocent - person? >Also, some devices allow you to reprogram the MAC address so you could in theory use this to blackmail someone as well…

If anyone had a device in the F8E079 family, they would be - rightfully - shitting bricks, right now, for being correlated with it.

Only if one normally shits bricks about something that's a 1 in 16 million chance of happening. But if someone does know that their MAC OUI is F8E079, they almost certainly know the rest of the MAC so they can rest easily unless it happens to match the published one.

Also, it's a family included in macchanger, so that makes it ever-more probable that the mac address has - at some point - been used by someone else.

macchanger -l just dumps the list of ~18,000 OUI's known to macchanger, so it doesn't really mean that it's more likely to have been set by someone using macchanger.

Re: German police ask for help in identifying a bomber's MAC address

#48

Earlier quoted context omitted.

> Also, some devices allow you to reprogram the MAC address I might be mistaken, but don’t changed MAC addresses (at least using macchanger) persist only until the next reboot?

Any operating system worth its salt will save the changed address and reload it before/while bringing up the network drivers. It's often necessary to do this in order to connect to certain networks, so it'd be super annoying if you'd have to remember the address and type it in every time.

If you're going through the trouble of changing your MAC address, why would you want it to persist across reboots? If anything you'd want to change it with every reboot, and if you're really trying to hide something, you'd want to change it more often.

Re: German police ask for help in identifying a bomber's MAC address

#50
post #13

I wonder if there are any unintended consequences for this. For example, if you were able to identify the MAC address, and you were unethical, you could just blackmail the "bomber" - whether they are innocent or not. Also, some devices allow you to reprogram the MAC address so you could in theory use this to blackmail someone as well, or at least get them harassed by the police.

I'm no expert, but "blackmailing a bomber" does not sound like a particularly solid business plan...

Sounds like the "brilliant" idea that a Coen Brothers character would have...
Post reply on HN