Bypassing validation checks

We’ve seen how NAC systems can employ simple MAC address filtering and captive portal authentication to control network access. Now, suppose that you’re coming away from the ARP poisoning attack just described, excited that you scored yourself some legitimate credentials. You try to log in with your Kali box and you’re slapped down by a validation check that you hadn’t foreseen. You have the correct username and password – how does the NAC know it isn’t the legitimate user?

NAC vendors quickly figured out that it was a simple matter for anyone to spoof a MAC address, so some systems perform additional verification to match the hardware address to other characteristics of the system. Imagine the difference between authenticating someone by fingerprint alone and authenticating someone by fingerprint, clothing style, vocal patterns, and so on. The latter prevents simple spoof attacks. In this context, the NAC...