MITM attack?

sHine · October 13

Hi!
A few weeks ago i discovered a device whos name was the same as the one on my iphone: "shine". But it had the ip address of the router 192.168.1.1 out of the regular IP 33, 41, 43, etc. and I guess a fake mac address 02:00:00:00:00:00.
My wifi password is generated by 1password, a really long and strong pass. the router uses WPA2-PSK+AES encription. i just realized that i had WPS enabled since the last time i changed the wifi password.
i'm quite a noob in this, but It looks bad, right? How can I know for real what happened?
Thanks!

Image: https://us.v-cdn.net/6031733/uploads/editor/4q/el967cjht7fi.png

Image: https://us.v-cdn.net/6031733/uploads/editor/8v/p1hwh9ogd866.jpg

Marc · October 14

@sHine, there was a change as of iOS 14 that adds virtual private Mac addresses and that might be causing this. See this article for detail... https://www.fing.com/news/private-mac-address-on-ios-14

sHine · October 14

Marc said:

@sHine, there was a change as of iOS 14 that adds virtual private Mac addresses and that might be causing this. See this article for detail... https://www.fing.com/news/private-mac-address-on-ios-14

oh, wow! didn't know that, so the device could actually be my own iphone? But why it had 192.168.1.1 IP address?

Lee_Bo · October 14

Yeah, if you turn off private IP addressing on your device for your network, that should.....SHOULD.....fix the issue. My iPad is still being detected several times even though I have PIPA turned off.

Marc · October 14

It could be dependent on the network hardware you have Lee_Bo. On my network kit, Linksys Velops, Turing it off on the clients cleared it up. Clients being iPhone 6, Xr and 11, iPad Pro.

Next time someone posts that the issue persists, I’ll ask what brand of network kit their using.

@sHine , did the issue clear up?

MITM attack?

Answers