Zamezení změny MAC adresy na HOTSPOTu

littlecake

Našel jsem zajímyvý skript na řešení situace kdy se mi do sítě připojovali opakovaně ti samí lidé , měnili si MAC adresu a využívali volného přístupu který jem v naši síťi nastavil na 30 minut za den zdarma .

Problém je jen v tom, že nevím jek tento skript přeložit na Routeros V3 , nevíte někdo jek na to ?

http://forum.mikrotik.com/viewtopic.php?f=2&t=18815

As requested, here is the "extended version", copied from my other post:

We had similar MAC cloning on our hotspots, especially because we also use/offer the TRIAL feature ('free' for a few minutes per day). It is impossible to see a difference between real and fake MACs, however each time they change the MAC, they get a new IP from our DHCP, and a new entry in our DHCP table with their hostname.

So, the hacker most likely is about to produce multiple, hostname-identical DHCP traces.

I made two scripts. Script-A is COUNTING same-hostnames in the DHCP table.

Given the fact that maybe 2 people have same hostname and connect at the same time, we set the 'possible-hack-limit' to >2 same-hostnames.

The script write a global variable of list type ("hacklist"), which hold the identified hostnames. Schedule updates the list (run the script) every 2 minutes.

Scripts-B (runs every 20 seconds), uses the global hacklist, get the IP per host from DHCP tabble, scans the hotspot active users and kicks out those IPs.

after 2 times changing the MAC address, the hacker get a 20sec access at most.

I know that the hostname can be changed easily... however, it usually requires a PC-restart. Our hackers are all gone.

===================

script-A: (run every few minutes)

hosts

pcname "X"

pcnum 0

hacklist ""

h in $hosts do={

host

( >0) do {

pcname ($pcname . "," . $host)

pcnum ($pcnum + 1)

} }

h in $pcname do={

hh 0

(!(>=0)) do={

k in $pcname do={ ($k=$h) do={ hh ($hh + 1) } }

($hh>2) do={

( >0) do { hacklist ($hacklist . "," . $h)} else={ hacklist $h}

} } }

# monitor results in logfile once an hour

timer [

(($switch > 0) || ($timer >= "58")) do={

warning ("New Hacklist: " . $hacklist)

}

=======================

script-B (runs every 20 second)

# use global hacklist variable

# info ($hacklist)

host in $hacklist do={

i in= do={

ipnum

unum

( >0) do {

usr

warning ($host . " " . $ipnum . " " . $usr)

#next line kick them out right now, could also check pppoe

/ip hotspot active remove $unum

#other stuff can do now with the identified IP and USER

} } }

================

PS: it is advisable to force people to DHCP and disable the universalPnP in hotspot

hope it helps. it does in our case.

golismen

Mno tak , jestli je to profik tak flitrem podle hostnamu si na něj taky nepřídeš :) Jestli si dokáže změnit mac , tak taky hostname :)

littlecake

Na drtivou vetsinu to zabere , hlavne kdyz na obyc wydlich chces zmenit hostname tak musis udelat restart ....

Kazdopadne to takovym "lidem" skomplikuje zivot ...

andreas4all

a vela ludi to ani nenapadne, takze to moze byt dost ucinne.

littlecake

Problem je jen v tom ze ten skript nefachci na Routeros V3 :(

Atále nemohu najítnekoho kdo by ho měl přeložit :(

george_tu

tak to by se mi taky hodilo pro ver. 3.X

buchar

Tez by se me to hodne hodilo pro MikroTik RouterOS ver 3.10 . Nasel by se nekdo, kdo by to prosim predelal a nebo mate to uz nekdo hotove?

jirinesejt

no na programovani nejsem tak je to mozna blbost ale asi tak

1, prihlasovaci stranku hotspotu s verejnym prihlasenim treba free, free

2, doplnit ji o susenku ktera se mu nahraje do pc a naopak se bude kontrolovat

to ho minimalne nas..., a nejspis to nebude cekat... pac mac si umi dneska zmenit kazdy dite ale cookies se pro ne hleda blbe...

jinak dhcp a kombinace zmeny mac adresy v takto otevrenem systemu je neresitelne a dost lidi si dneska taha nejakou tu live distribuci linuxu a ten resi i ten hostname a dokonce v kombina s bashem velice efektivne :-D

skrebon

Najde pocet opakujucich hostname podla zadaneho poctu

/system/script

add name=hotspot_search_hack policy=ftp,read,write,policy,test,winbox source=":local lease\r\

\n:local hostname\r\

\n:local pcname\r\

\n:local timer\r\

\n:global hacklist \"\"\r\

\n \r\

\n# zapise do pola vsetky dhcp lease\r\

\n:set lease [/ip dhcp-server lease find dynamic]\r\

\n\r\

\n:foreach h in=\$lease do={\r\

\n# zisti a zapise premennu do hostname\r\

\n:set hostname [/ip dhcp-server lease get \$h host-name] \r\

\n# porovna ci hostname nie je prazdne a zapise do pola pcname vsetky hostname okrem iPhone apod...\r\

\n:if (([:len \$hostname] >0) && (\$hostname!=\"iPhone\") && (\$hostname!=\"iPhone-2\")) do {\r\

\n:set pcname ( [:toarray \$pcname] + \$hostname)\r\

\n}\r\

\n\r\

\n# prejde cele pole pcname\r\

\n:foreach h in=\$pcname do={\r\

\n# nastavi v kazdom prejdeni pola pcname hodnotu hh-pocet opakujucich sa hostname na 0\r\

\n:local hh 0\r\

\n# kontroluje ci hacklist obsahuje premennu z pcname H\r\

\n:if ([:find \$hacklist \$h]>=0) do={} else={\r\

\n:foreach k in=\$pcname do={ :if (\$k=\$h) do={ :set hh (\$hh + 1) } }\r\

\n# kontroluje pocet rovnakych hostname a aplikuje az od poctu 3 a viac\r\

\n:if (\$hh>2) do={ \r\

\n:set hacklist ( [:toarray \$hacklist] + \$h)\r\

\n}\r\

\n\r\

\n# zapise raz za hodinu stav premennej hacklist \r\

\n:set timer [:pick [/system clock get time] 3 5]\r\

\n:if (([:len \$hacklist] > 0) && (\$timer >= \"45\")) do={\r\

\n:log warning \$hacklist\r\

\n}"

Odstrani najdene rovnake hostname i cookie

/system/script

add name=hotspot_remove_hack policy=ftp,read,write,test,winbox source="# pouziva globalnu premennu hacklist\r\

\n:global hacklist\r\

\n\r\

\n:foreach hostname in=\$hacklist do={\r\

\n:foreach i in=[/ip dhcp-server lease find host-name=\$hostname] do={\r\

\n:local dhcpip [/ip dhcp-server lease get \$i address]\r\

\n:local hotspotip [/ip hotspot active find address=\$dhcpip]\r\

\n\r\

\n:if ([:len \$hotspotip] >0) do {\r\

\n:local usr [/ip hotspot active get \$hotspotip user] \r\

\n:log warning (\$hostname . \" \" . \$hotspotip . \" \" . \$usr)\r\

\n/ip hotspot active remove \$hotspotip\r\

\n/ip hotspot cookie remove [find user=\"\$usr\"]\r\

\n}\r\

\n}"

Neviem, ako velmi je to odlisne od povodnej verzie z forum.mikrotik.com . Az teraz vidim, ze by sa to tu niekomu hodilo. 8)