How do they track you?

Hello guys,
Last week, I go to visit my friend, he told me he doesn't have a WIFI,but how he lives without WIFI?
He lives just beside the community library, the signal is so strong that all the people around never need BELL.
And more interesting thing is user name and pass is the same for all the readers, yes, the same for all.
I am wondering how does the library control the security of access internet or they do have some tech to track all the visiters?
How do they track without username control?
oh, another thing, dont like starbugs, there are no surveillance cameras, not even one inside the library.

if its the same username no control

MAC Address, because you're within their LAN.

as roamer said mac address, but then they would need to go and knock on everydoor and check your wireless cards mac...

michael8t6 said:

... and check your wireless cards mac...

Click to expand...

now they don't track you

michael8t6 said:

as roamer said mac address, but then they would need to go and knock on everydoor and check your wireless cards mac...

Click to expand...

Or you can filter the offending computer' traffic by MAC Address and find out who that person is. Or access the shared files the user forgot about (as he's on a LAN, and they're accessible to everyone else). Or just block it. It all depends on the setup and sys admin's skills and/or motivation.

ijof9 said:

now they don't track you

Click to expand...

You can enforce certain policies as a sysadmin once abuse is detected. Besides, you can play man-in-the-middle, ie. for all after-hours traffic, and pinpoint the offenders' ids.

So use a "cheap-usb-wifi-adapter" only for the library, then no track?
Is it possible for the admin of library track the serial number of hard disk or of the other Hardware, or some serial number of the Operating system???

h2u5vv said:

So use a "cheap-usb-wifi-adapter" only for the library, then no track?
Is it possible for the admin of library track the serial number of hard disk or of the other Hardware, or some serial number of the Operating system???

Click to expand...

Lol. They can't track you (or your friend). Yes, they can figure out your MAC...but no, unless you are sharing any files on your PC that identify you, there is no way they could find you without some high tech CIA shit. If they find any abuse, then the admin will just block your MAC address (In which case you could then just get a USB adapter and carry on). So don't bother buying one until then...you're fine. Such is the price of insecure systems.

Thanks, A deep look!
So if somebody want to, he can use of this kind of "open system" anonymously if he change MAC, and don't access some accounts which he enters at home-ip.
Is that all?

roamer said:

Or you can filter the offending computer' traffic by MAC Address and find out who that person is. Or access the shared files the user forgot about (as he's on a LAN, and they're accessible to everyone else). Or just block it. It all depends on the setup and sys admin's skills and/or motivation.



You can enforce certain policies as a sysadmin once abuse is detected. Besides, you can play man-in-the-middle, ie. for all after-hours traffic, and pinpoint the offenders' ids.

Click to expand...

Ppl saying they "can't track you" are taking into account the very best scenario: one in which they won't care and won't have any specific reason to track you. OK, it's very possible a public library won't give a shit about who uses their internet, agreed... But it's not guaranteed at all. Of course there's a legal side to what I'm about to say, but unless you're using a vpn 24/7 and encrypt ALL your traffic a SIMPLE sniffing session any skid can do with readily available tools is more than enough to passively obtain your usernames on a fair number of websites requested by the machine with your MAC address. That might super quickly yield to your real identity considering how "social" the world is these days... And with the ssl vulnerabilities recently discovered if you find the right nut, maybe he'll try to track a recurring MAC out of boredom, for fun or.. profit.. It wouldn't be the first case

h2u5vv said:

Thanks, A deep look!
So if somebody want to, he can use of this kind of "open system" anonymously if he change MAC, and don't access some accounts which he enters at home-ip.
Is that all?

Click to expand...

The point is, if a sysadmin wants to, he can 'sniff' your usage. It's not as simple as "you're untraceable, and they can't find you if you don't share files". The average user will fill out forms with his email and other info more often than not. If said user isn't forcing everything over HTTP Secure (https), there's a lot of info to gather.

Then again, to the average user this is like magic. I had a neighbor disrupt my wlan way too often with his scripted wi-fi intrusion approach, until I switched my AP with a 'middleman' pc using conectify (same id, same password). Once the culprit connected as usual, I let pcap do it's job... suffice to say, you'll get so much info on the offenders, you won't really need a MAC address, or any crazy hacker's movie stuff to nab them.

Same thing happens with 'open' proxies. This explains why so many people posting with public proxies get their account's details changed. Many of those open proxies are ran by double black-hatters, ie. they aren't just BH because of their IM tactics. That's why you use public proxies to scrape, and private ones to post, else you'll end up creating accounts for a third party.

Also someone has the right motivation, even if you change your MAC it doesn't take kevin mitnick to determine someone is always requesting the same cookies with the same content (your own user) let's say... on some website that even some home router might have flagged as potentially harmful like BHW.. maybe the mail you check is the same you also used for your PERSONAL fb... Case in point it made recent news on ars technica this is a method stores are using to determine the identity of ppl entering their lists supposedly anonymously... With that being said your scenario is certainly unlikely, but definitely not impossible from a practical standpoint in any shape or form.

@roamer is right. If the library guys are nerd enough, they can do craziest shit.

But you can always throw a HTTP tunneling server on an SSL secured cheap server ($60/year, certificate $11/year) and without the private key it'll take them years to sniff into your traffic data.