PDA

View Full Version : FBI Agent: Connection Logs Show Suspect's MAC Address, So Look For Apple Hardware




tangent4ronpaul
12-22-2013, 05:08 AM
http://static3.wikia.nocookie.net/__cb20130815124009/transformers-legends/images/c/c4/Triple-facepalm.jpg

http://www.techdirt.com/articles/20131220/07264325650/fbi-agent-connection-logs-show-suspects-mac-address-so-look-apple-hardware.shtml

from the this-is-where-he-keeps-his-creative-work...-note-the-'IP'-address dept
The Smoking Gun recently covered the arrest of a 19-year-old college student for allegedly sending threats to a 14-year-old ask.fm user. The arrestee apparently sent a string of horrific messages filled with sexually violent imagery back in October, prompting her parents to contact authorities.

A routine investigation soon commenced, culminating in the student's (Rishi Ragsdale) arrest.
Investigators tracked the threatening posts back to Ragsdale through an IP address provided by Ask.fm. An analysis of subpoenaed University of Wisconsin records indicated that the IP address was assigned to Ragsdale’s student account, and that the “rragsdale” account accessed the girl’s Ask.fm profile page on the evening the threats were sent...

The affidavit sworn by FBI Agent Malia Pereira alleges that Ragsdale sent the teen a series of violent and sexually graphic messages. The victim’s parents, Pereira added, were particularly concerned since the girl’s Ask.fm account was linked to her Facebook and Twitter profiles, leaving her identifiable.
Reading through the affidavit isn't much fun, especially once you get to the messages Ragsdale allegedly sent. But eagle-eyed Techdirt reader Justin Johnson spotted something on page 5 of the sworn document that would move even the most ardent FBI defender's palm towards their face… or their head towards their desk.
Prior to executing the search warrant, FBI SA Nicol told me that, during execution of the warrant, I should look for a Mac computer, because the network connection logs provided by Jeffrey Savoy showed a Mac address, indicating some type of Mac/Apple computer or hardware was used.
This immediately follows a paragraph detailing the seizure of Ragsdale's Mac laptop (and cellphone). Case closed!

No one expects every agent in the FBI to be thoroughly versed in network terminology but a MAC address is one of the basics any agent seeking to extract personal info using nothing but IP addresses and subpoenas should know. If these basics aren't nailed down, agents lacking this crucial knowledge will be stymied by their own ignorance. They won't know what they're looking for or how to get it. Their subpoena and warrant requests risk being laughed out of the judge's chambers. The worst case scenario is that someone dangerous eludes arrest because the pursuing agent(s) is tangled in terminology he or she doesn't understand. Actually, the real worst case scenario is someone innocent being tossed into the gears of the judicial system because an agent had no idea what he or she was looking at -- or looking for.

Kudos, I guess, to Agent Pereira for getting her man, despite the "help" offered by SA Nicol, whose name is all over this affidavit. But one wonders what would have happened if Ragsdale's computer happened to be a PC. My guess? Additional charges under the CFAA for "spoofing a 'Mac' address."

-t

MRK
12-22-2013, 05:54 AM
Interesting. Technically, a MAC address could specifically show an Apple product. I didn't read the police report though.

If you haven't done so before, try playing around with this: http://www.technitium.com/tmac/

MAC addresses are typically only visible by your router (and the owner of your network if your router keeps logs), although they can also be leaked in certain situations. I think perhaps you can also see the MAC address in a IPv6 IP address but I'm not sure about this one (someone who knows about this might want to chime in)

FunkBuddha
12-22-2013, 06:19 AM
Ummm. The first 3 bytes of the MAC address identifies the vendor of the NIC unless it was spoofed. Its called the OUI. I track devices (not just Apple products) on a daily basis using the MAC.

Am I missing something?
http://standards.ieee.org/develop/regauth/oui/public.html

RPtotheWH
12-22-2013, 09:12 AM
Federal Bureau of Idiots

CPUd
12-22-2013, 09:58 AM
Interesting. Technically, a MAC address could specifically show an Apple product. I didn't read the police report though.

If you haven't done so before, try playing around with this: http://www.technitium.com/tmac/

MAC addresses are typically only visible by your router (and the owner of your network if your router keeps logs), although they can also be leaked in certain situations. I think perhaps you can also see the MAC address in a IPv6 IP address but I'm not sure about this one (someone who knows about this might want to chime in)

Yes, IPv6 unicast addresses have an 'interface identifier' segment, based on the MAC address.

If you have linux, you don't need any special software to change (technically rename) a MAC, you can do it with ifconfig in a startup script before bringing up the interface.