petkoa   1005 pts.  |   Jul 27 2007  8:04AM GMT

Hi, DonBlake

Like Bob, I don’t think YOU can protect your MAC against spoofing. And, in fact, I think it isn’t your job.

Your ISP can do this implementing PPPoE (outdated, I believe) or 802.1x (expensive) authentication and thus stop relying on MACs for verifying who is who. Another perspective is that eventually, DHCP authentication (RFC 2485, and recently IETF draft-pruss-dhcp-auth-dsl-01) will be accepted and implemented - but I’d underscore again - it is ISP responsibility to use this options.

BR,

Petko

Mrdenny   46735 pts.  |   Dec 7 2007  11:56PM GMT

I agree with the other posters. There isn’t any way to protect your MAC address. For said hacker to appear to be comming from your machine they would need to be physically local to you, probably one of your neighbors (or thier kids).

If your PC was connected directly to the cable model it would be entirly possible that someone had simply hacked into your PC while you were online and was using your computer without your knowledge to serve movies on the internet. Did you leave your PC on while you were at work? The reason that I bring this up would be that for them to be using your IP address while at the same time you are using your IP address they would need to be using your internet connection.

Papp   310 pts.  |   Dec 9 2007  1:49PM GMT

Cheers to the comments above. All good answers based on the information given. Unfortunately a fragment that is missing I feel is the information comming from the ISP. Your not likely to get without going to trial. Cable technology being one of the hardest technologies to secure due to the push to keep it affordable means that in all likelyhood the “perp” is in your main branch.
Spoofing ARP is nothing new. This introduces the evolution of national threat by perps moving to hardened groups. Something I have a hardtime convincing the most ardent, tried and true network engineers of is cross-branch seeders. This can and does happen in all current network topologies based on end-point comprimises. The end of the 90s has seen the change in strategic progression away from outside in penetrations to clientside outbound requests (zombies and bots). P2P threw a flame on this fire making it the prime choice of zero-day hack groups. This thread could go on forever (and probablt will).
Allow me to get to the point, things you do online increase the “probability” you could be standing on a ferite hill in a lightning storm. Linux, WindowsXP, and other operating choices determine your options. Linux and XP do not use “protected memory” technologies. To get to that level you need to move to “a large cat” (tiger, lepard), or FreeBSD (which lepard is based on) or Solaris10. This is likely to meet oposition from your ISP but will move you to beyond the current ISP traces working in reloc and memloc in the unix derivatives. The palephera of tasties and fun things on the internet typically bait ppl back into the sheep pen. To which, your options are limited by the resources it taked to harden perimeters and end-points. Which brings us to the conclusion, is your ISP concerned about social justice and personal responsibility? or is it a public company legaly bound to turn a profit?

Ysrd   430 pts.  |   May 25 2008  2:51AM GMT

Hi,
Yes all good answers but they fall into one set of answers, that the story as told is the complete story.
The ISP states that the IP and MAC at that time was this mans system. And he states he is on a Cable modem.
Now unless he shut his modem off everyday when he went to work then no-one was able to spoof his MAC because it was connected. Unless someone disconnected the modem and then reconnected it when he was done the connection to the isp would have sent all of the traffic to his system and not the spoofed one. Arp spoofing is possible but it has to be done before the systems are connected. If his modem is on (and it’s the modems conection that has to be spoofed) that connection is already created.
If the modem was shut off then restarted this may not have been a deliberate attack (look up the counterfeit Cisco router problem) as the other guy may actually have the same MAC address as his.
If the system was not shut off then this is another story.
In this scenario the story has to include the possibility that the file was served up by that computer.
Now this doesn not mean the man did it. Obviously he didn’t because he was at work. But there are two ways this could happen. He mentions adding his daughters laptop with wifi. Before he added her (assuming in only a year she graduated from using his computer to her own laptop she is teen age or so) she used his computer. And well he wasn’t home but she may have been or her boyfreind or girlfreinds were.
The other possibility is that his system was compromised and someone put the files there for others to get. (He would not be the first to have this happen.)
So start close to home, make sure you have all the precautions in place, firewalls, AV and the like and some type of IDS.
Apart from that talk to your kids make them aware of the issues and how to be safe on the net and what to and not to do.

Hope this helps.