Would you like to inspect the original subtitles? These are the user uploaded subtitles that are being translated: 1 00:00:00,677 --> 00:00:02,541 In the section on security domains, 2 00:00:02,575 --> 00:00:04,746 we talked about physical security 3 00:00:04,856 --> 00:00:08,797 in terms of a separate device like a secure laptop, 4 00:00:08,867 --> 00:00:11,397 or a secure USB, or SD card. 5 00:00:11,490 --> 00:00:15,287 Now we’re going to dig a little deeper in relation to privacy and anonymity, 6 00:00:15,423 --> 00:00:17,860 and physical security domains. 7 00:00:18,039 --> 00:00:21,954 So let’s start with devices and their hardware serial numbers. 8 00:00:22,084 --> 00:00:27,956 So devices have hardware serial numbers that can uniquely identify them. 9 00:00:28,055 --> 00:00:32,447 These unique identifiers can then possibly trace back to you 10 00:00:32,547 --> 00:00:35,411 through a money trail or potentially other methods, 11 00:00:35,521 --> 00:00:38,287 if the hardware wasn’t bought anonymously. 12 00:00:38,361 --> 00:00:41,807 If you care about non-attribution and staying anonymous, 13 00:00:42,010 --> 00:00:46,387 then you need isolation of the unique hardware identifier 14 00:00:46,464 --> 00:00:49,638 so it cannot be enumerated by your adversaries. 15 00:00:49,696 --> 00:00:53,432 The first unique hardware ID that you need to be aware of, 16 00:00:53,434 --> 00:00:55,717 if you’re not already, is the MAC address. 17 00:00:55,756 --> 00:00:59,666 An adversary could get your MAC address off your network card, 18 00:00:59,695 --> 00:01:01,702 which is always a unique number. 19 00:01:01,842 --> 00:01:05,687 This method was used by the NSA to deanonymize TOR users 20 00:01:05,777 --> 00:01:09,061 through a Firefox exploit on the TOR browser. 21 00:01:09,101 --> 00:01:12,540 And this is a write up here of how that happened, if you’re interested. 22 00:01:13,234 --> 00:01:18,399 The MAC address is like an IP address, but for your local network only. 23 00:01:18,451 --> 00:01:20,995 If an adversary has access to your machine, 24 00:01:21,125 --> 00:01:23,495 they can view the unique MAC. 25 00:01:23,520 --> 00:01:24,998 If they know the unique MAC, 26 00:01:25,058 --> 00:01:27,243 that can be potentially traced back to you 27 00:01:27,325 --> 00:01:29,331 through the purchasing of that device. 28 00:01:29,431 --> 00:01:32,446 So in Windows, if you want to look at your Mac address, 29 00:01:32,594 --> 00:01:37,010 you simply type in ipconfig/all. 30 00:01:38,352 --> 00:01:41,463 I have a lot of adaptors on this because it’s a virtual machine, 31 00:01:41,512 --> 00:01:44,763 but let’s scroll up and see if we can find the physical addresses, 32 00:01:44,803 --> 00:01:45,586 the Mac address. 33 00:01:45,636 --> 00:01:47,148 There’s one of them. 34 00:01:47,419 --> 00:01:51,244 So for this network adaptor, that’s the physical address, 35 00:01:51,296 --> 00:01:52,932 unique physical address. 36 00:01:53,614 --> 00:01:55,409 You may only have one network card, 37 00:01:55,459 --> 00:01:58,935 so you may only see one physical address. 38 00:01:59,015 --> 00:02:01,402 There you go, there’s the Mac address. 39 00:02:04,412 --> 00:02:05,821 And there’s another one. 40 00:02:05,871 --> 00:02:08,452 And yours will probably say Ethernet adaptor 41 00:02:08,752 --> 00:02:11,743 or wireless adaptor and you'll see it here. 42 00:02:12,096 --> 00:02:15,355 On both Mac and Linux, you can use ifconfig. 43 00:02:15,537 --> 00:02:19,670 We'll need sudo to run it or root permissions. 44 00:02:24,160 --> 00:02:25,435 And there it is, 45 00:02:25,732 --> 00:02:31,554 the hardware unique MAC address, on both Linux and Mac OS X. 46 00:02:32,402 --> 00:02:35,137 It’s also possible to see it using IP tool. 47 00:02:36,928 --> 00:02:38,555 So you can see it there. 48 00:02:40,042 --> 00:02:42,843 IP is like the new ifconfig. 49 00:02:45,006 --> 00:02:49,432 And now just specify eth0 so you can see the hardware address. 50 00:02:49,735 --> 00:02:50,590 It’s the same thing, 51 00:02:50,650 --> 00:02:53,338 just another way to find the hardware address. 52 00:02:54,303 --> 00:02:59,303 The first three bytes of a MAC address are the manufacturer’s ID. 53 00:02:59,361 --> 00:03:01,355 So if you have an Apple laptop, 54 00:03:01,415 --> 00:03:04,034 then it'll be the ID of Apple. 55 00:03:04,134 --> 00:03:07,730 If you’ve got a Lenovo laptop, then it'll be the ID of Lenovo. 56 00:03:07,860 --> 00:03:10,825 And the last three bytes of your MAC address, 57 00:03:10,947 --> 00:03:13,665 this is specific and unique to the net, 58 00:03:13,715 --> 00:03:15,977 to the network card, to the Wi-Fi card, 59 00:03:16,087 --> 00:03:17,040 to the Ethernet card, 60 00:03:17,090 --> 00:03:21,068 so it’s this last three that will be unique to your device. 61 00:03:21,208 --> 00:03:25,436 If you’re looking for privacy, anonymity, non-attribution, 62 00:03:25,556 --> 00:03:27,814 then you need to change your MAC address. 63 00:03:27,866 --> 00:03:30,403 It can be potentially got out via malware 64 00:03:30,485 --> 00:03:35,036 and it can be seen on local networks as well Ethernet and Wi-Fi. 65 00:03:35,993 --> 00:03:39,633 For Windows you can use this tool here to change the Mac address. 66 00:03:39,798 --> 00:03:42,653 It’s a pretty good tool, works very well, it’s free. 67 00:03:43,796 --> 00:03:45,834 In Linux there’s a tool called MAC Changer. 68 00:03:45,879 --> 00:03:47,025 This is available in Kali, 69 00:03:47,085 --> 00:03:50,552 but won’t be available in Debian and other distributions straight away, 70 00:03:50,632 --> 00:03:52,358 so you'll need to install it. 71 00:03:57,919 --> 00:04:00,288 And you can select whether you want to set it up 72 00:04:00,398 --> 00:04:02,667 to automatically change the MAC address. 73 00:04:02,817 --> 00:04:05,228 I’m going to select No here, but you can select Yes. 74 00:04:07,548 --> 00:04:09,090 So we need to change the MAC. 75 00:04:09,243 --> 00:04:12,581 To change the MAC we need to down the network interface. 76 00:04:12,708 --> 00:04:15,497 The network interface on this one is eth0. 77 00:04:19,170 --> 00:04:21,373 That’s taking eth0 down. 78 00:04:24,166 --> 00:04:26,501 So we can see there just the local loopback, 79 00:04:26,651 --> 00:04:30,548 eth0 isn’t there anymore, so now we can change the MAC address. 80 00:04:33,677 --> 00:04:35,639 The -r means random, 81 00:04:35,699 --> 00:04:39,374 so it’s randomly changing the eht0 MAC address, 82 00:04:39,499 --> 00:04:42,503 and now it’s changing to the new MAC address that you can see now. 83 00:04:45,510 --> 00:04:47,916 As you can see, the interface is still not there, 84 00:04:47,976 --> 00:04:50,070 so we need to bring it up again. 85 00:04:52,603 --> 00:04:56,094 And that will bring it up. And let’s see if it’s up. 86 00:04:57,611 --> 00:05:02,050 And there it is with its new hardware address, 87 00:05:02,200 --> 00:05:03,935 its new MAC address. 88 00:05:05,370 --> 00:05:09,487 On a Mac, you can change your MAC address using a command line as well. 89 00:05:09,661 --> 00:05:11,516 And that would be like this. 90 00:05:13,632 --> 00:05:15,554 en0 would be the name of the interface, 91 00:05:15,714 --> 00:05:17,874 so whatever the name of the interface is. 92 00:05:20,978 --> 00:05:23,407 And then you specify at the end there the MAC address 93 00:05:23,573 --> 00:05:27,795 and that will change the MAC address on a Mac OS X. 94 00:05:28,156 --> 00:05:31,516 But I’m on Debian here, so I’m not going to run that command. 95 00:05:31,797 --> 00:05:33,328 If you don’t want to do it on the command line, 96 00:05:33,352 --> 00:05:36,748 with Mac OS X you can download MacDaddy X. 97 00:05:36,954 --> 00:05:39,448 That will enable you to change the MAC. 98 00:05:40,188 --> 00:05:42,157 And there’s actually another tool as well 99 00:05:42,430 --> 00:05:46,562 called WiFiSpoof which will enable you to change the MAC address. 100 00:05:48,926 --> 00:05:51,415 Virtual machines hide your real MAC 101 00:05:51,475 --> 00:05:55,640 and also allow for the setting of the MAC address. 102 00:05:56,605 --> 00:05:58,454 Example here, 103 00:06:00,429 --> 00:06:02,548 so you can see the MAC address here. 104 00:06:02,891 --> 00:06:05,093 And we can generate a new, random one there. 105 00:06:05,336 --> 00:06:06,908 That’s VirtualBox. 106 00:06:07,065 --> 00:06:09,227 But if you fear a knock at the door, 107 00:06:09,297 --> 00:06:13,368 you need to change the virtual MAC through the VM frequently. 108 00:06:13,450 --> 00:06:17,283 You don’t want a static MAC that ties you to a virtual machine 109 00:06:17,333 --> 00:06:20,471 even if it is just a virtual MAC address. 110 00:06:20,655 --> 00:06:23,861 But the best option is to have anonymously purchased hardware 111 00:06:23,921 --> 00:06:26,173 like laptops, and network cards, 112 00:06:26,253 --> 00:06:28,413 and Wi-Fi, and network dongles; 113 00:06:28,726 --> 00:06:31,135 the devices that have MAC addresses. 114 00:06:31,264 --> 00:06:36,203 You could purchase a whole bunch of cheap USB network adaptors 115 00:06:36,324 --> 00:06:40,459 and use a MAC changer in combination to mitigate the risk. 116 00:06:40,589 --> 00:06:43,177 This would be the best way of MAC mitigation: 117 00:06:43,284 --> 00:06:46,095 anonymous hardware plus MAC Changer. 118 00:06:46,753 --> 00:06:49,492 Tails, another security focused operating systems, 119 00:06:49,503 --> 00:06:52,601 use MAC Changers as default. 120 00:06:52,671 --> 00:06:56,008 But do check to make sure they don’t show the real MAC 121 00:06:56,128 --> 00:06:58,366 of your device’s network card. 122 00:06:58,552 --> 00:07:01,606 You know how to check that now, so when you’re not using Tails, 123 00:07:01,686 --> 00:07:03,148 check out what the MAC is. 124 00:07:03,320 --> 00:07:04,688 Then, when you’re in Tails, 125 00:07:04,768 --> 00:07:07,820 run ifconfig or sudo ifconfig 126 00:07:07,930 --> 00:07:10,459 and see if the MAC address has changed. 11159