2

Can a MAC address be altered, or is it like a computer's fingerprint and remains unique to that computer only?

If a person has the computer's MAC address, can it be used to identify that computer proving ownership?

I'm asking this because I had two laptops stolen and I'm going to go with the police to retrieve them. However, I'm sure the person who stole them will try to say they belong to him. I still have access to the antivirus programs, which also shows the Mac address for all devices registered.

That's why it's important that I'm able to somehow prove ownership.

Ramhound
  • 41,734
  • 35
  • 103
  • 130
Mark
  • 21
  • 1
  • 2
  • A MAC address doesn’t ID a computer, but a networking port. You buy a Wi-Fi dongle? It has it’s own MAC address. You have an Ethernet port built it? It has it’s own MAC address. But it can be used to claim a device is yours. Just be aware there are software methods to spoof a MAC address which would effectively change it temporarily. If the system were rebooted from a a CD/DVD or a USB live OS then you can see the real MAC address. – Giacomo1968 Apr 07 '18 at 14:21
  • Similarly, there is often a sticker near a physical networking port that has the MAC address on it. Unless someone went out of their way to remove it, chances are good it will still be there if a machine is opened up. – Giacomo1968 Apr 07 '18 at 14:21
  • Its often stuck *internally* in the pc - on wireless cards too – Journeyman Geek Apr 07 '18 at 14:24
  • 1
    It is reasonably unique. However, a proof of purchase will probably be of much more weight in this case. – Daniel B Apr 07 '18 at 14:25
  • @DanielB Also, signs of physical wear that can be visually confirmed. Such as a missing or damaged key, port or anything. – Giacomo1968 Apr 07 '18 at 14:56

2 Answers2

1

Can a MAC address be altered or is it like a computers fingerprint and remains unique to that computer only.

A MAC address is a 48 bit ID which used to be stored in a NICs ROM. That is, for some (old) network cards you would have one MAC per network card and those cannot be changed without replacing the network card.

On a laptop the network card probably is part of the motherboard, so you cannot change that.

These values are supposed to be unqiue per card. (Supposed since some manufacturers messed up).

However many drivers allow you to change used MAC temporarily. They read the fixed MAC from the [P]ROM on the NIC, and store it in RAM. This feature wwas temporarily in most Linux, BSD and Windows drivers. Windows is phasing it out though, most new drivers no longer offer that functionality.

If a person has the computers MAC address can it be used to identify that computer

It can be used to identify a network card.
That on its own will not proof ownership.

I’m asking this because I had two laptops stolen and I’m going to be going
with the police to retrieve them. However I’m sure the person who stole them
will try to say they belong to him. I still have access to the antivirus
programs which also shows the MAC adress for all devices registered.

That still does not proof anything.

You could have changed the MAC on a device, connected it to your own network and it would show up in your logs. Basically any data which you could have changed is not hard proof.

Now if you bought those laptops new in a shop and filled out a warranty card then you probably have the laptops serial number. That might work a lot better.

Of if you installed windows 10 on it and activated it then the hardware profile of your laptop might be stored somewhere. Still no hard proof. But better than going by MAC.

Hennes
  • 64,768
  • 7
  • 111
  • 168
  • You mean Serial number? – Moab Apr 07 '18 at 15:56
  • I do. Interesting typo. Not even keys next to each other. – Hennes Apr 07 '18 at 18:43
  • As for the case, I don't think the MAC address would help much for the police. Because the thief is more likely to connects to the ISP via a router. Then the ISP(police) can only detect his router's MAC address, which is useless. As for serial number, are they contained in the packets? No I don't think so :) – Rick Jul 13 '19 at 23:35
  • Indeed. MAC is only visible locally. So to find a device on the Internet it is mostly useless. I could ramble on about spyware in many webpages which fingerprints hardware etc. but thaty would distract from the main point. It ain't proof, no matter how you see or do not see the MAC. – Hennes Jul 16 '19 at 15:30
0

The hardware MAC address is unique to the network card, and can not be changed. However, you can in software easily change the MAC, but if the value is deleted it reverts back to the hardware MAC.

00:00:00:11:11:11

The first three represent the manufacturer that made the card. The second three are supposed to make it unique. Typically it is increment by 1 for each NIC that rolls of the assembly line.

Also note that some network cards are part of the motherboard, and some are add-in cards. The network cards that are add-in cards can easily be swapped.

It it important to know what kind it is because if I was a thief I would throw away the add-in card and use another one. However, most are not that smart, but any lawyer could argue that point.

Change your MAC

Almost, if not all, laptops have serial numbers and having that would help your case. If you went through the tedious process of registering the laptop when you bought it then the manufacturer or retailer may have this number on file.

cybernard
  • 13,380
  • 3
  • 29
  • 33
  • You can absolutely change the hardware MAC address if many/most cards - the MAC address is programmed in the cards firmware after its produced - you just need to find the software to reprogram it. For example The "eeuodate" and "lanconf" utilities do this for most current Intel nics. – davidgo Apr 07 '18 at 18:46
  • Kindly to remind that the image you are referring to is a **locally administered addresses**. "A locally administered MAC address is similar to a LAN IP address (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16). You can make up your own locally administered address and can be sure that it will not collide with any hardware on your network that use a factory burned-in MAC address." From Wikipedia [MAC address](https://www.wikiwand.com/en/MAC_address), it also says: "the local or U/L bit (b1) distinguishes universal and locally administered addressing.". – Rick Jul 14 '19 at 00:00