MAC Address - stolen iPad question

[Atlant3an]

Hi there,

I have been investigating for a friend regarding an iPad that he believes was stolen by a close friend or should I say no ex friend. I got the MAC address from the router and confirmed that it dissociated the time that the person left with an error code 4 which I simulated by walking out of the house with my own iPad which resulted in the same code on the router.

Now, I'm a systems infrastructure engineer, so I know a fair bit about networking However I wanted to so the following questions. This friend bought supposedly his own new iPad round my friends house and connected to the WIFI. The MAC address was exactly the same. He countered this by saying he had to choose this an existing Mac address that was in the router as he could not get it to work properly. It was just a coincidence that he chose my friends lost/stolen iPad.

Now firstly, in my own research, it appears that using a jail break and then changing the MAC address does not really work correctly and seems to screw up the device in numerous ways, so I don't think he did this?

He has sent a subsequent email stating that his real MAC address starts with the following:

00:16:3E - This belongs to Xen source inc - Citrix Xen server and not Apple.

Is this proof that he has chosen a random MAC address saying that this is the real one? Or is it possible that Xen source for some reason has assigned the MAC to the iPad. My 2 iPhones and iPad shows different MAC addresses (initial 3 octets) but they still all belong to Apple Inc.

I just want to help my friend get some closure on this, I don't know if it was or was not stolen.

Kind regards

ATLANT3AN

 

[saudor]

Or you know you can just compare the serial number of that iPad and the box. Or check under the support profile area of your Apple id and it should have the serial number listed

 

[maflynn]

Or you know you can just compare the serial number of that iPad and the box. Or check under the support profile area of your Apple id and it should have the serial number listed

This seems simpler then going the MAC address route. What's the endgame of this work? Calling the police, bring this info to the thief?

 

[Atlant3an]

The ipad was never connected to iTunes on a PC. And the original box is not present plus we are not able to get the iPad back from his friend to cross check. This is why my MAC address question is all I have to go on.

The end game is simply proving that the iPad has been stolen by the friend beyond reasonable doubt. The MAC address question about Xen source and whether you can even change a MAC address and have a functional device is then my main points as this is all I have to go on.

ATLANT3AN

 

[deeddawg]

The MAC address story sounds very fishy. How exactly did the person get the MAC addr off the router, do they have admin credentials to it too?

If the iPad was purchased from Apple online look up the order, it should display the serial number. May be true for other vendors.

I'm guessing find-my-iphone/ipod was never set up?

 

[RCRod83]

Cloning the MAC Address is one way to gain access to a network. My questions are:

1) Does he have access to your friends router to view the MAC addresses that are connected? How would he know what the MAC address of the iPad is?

2) Did your friend have his iPad password protected with Find My iPad enabled?

 

[Atlant3an]

Thanks for the replies so far. Find my ipad was not setup, this was bought from an Apple Store in the states on launch day and he no longer has the receipt. Yes this friend would have been able to login to router and look at previous history which would have shown the MAC address.

This is why I keep coming back to the MAC address and whether he has chosen a random MAC which has come out as Xen source which itself could prove that's not a legit Apple iPad MAC address and he just made it up.

I also keep finding stories of iPads not working correctly if you change the MAC.

 

[jamesie79]

The MAC address story sounds very fishy. How exactly did the person get the MAC addr off the router, do they have admin credentials to it too?

If the iPad was purchased from Apple online look up the order, it should display the serial number. May be true for other vendors.

I'm guessing find-my-iphone/ipod was never set up?

Can you even spoof a MAC on this device. It aint Windows.

 

[Atlant3an]

Can you even spoof a MAC on this device. It aint Windows.

Yes you can on a jail broken device. It's rather easy as its done the same way as it is in Unix as that underlies the OS. It's just on researching this, many people complain that it bricks their devices, does not fully work, stops itunes, etc.. So it's not exactly a fully functional MAC spoof.

 

[jsf721]

SInce it is an ex friend, call police to report stolen iPad, give your serial number. Have police check serial number.

Quick, fast and to the point.

 

[maflynn]

SInce it is an ex friend, call police to report stolen iPad, give your serial number. Have police check serial number.

Quick, fast and to the point.

The OP doesn't have the receipt or the serial number presumably - or least any documentation that shows that he was the owner. Its his word against his ex-friend's at this point.

 

[NoBoMac]

supportprofile.apple.com

MAYBE the iPad s/n is still listed there under OP friend's AppleID.

 

[scaredpoet]

00:16:3E - This belongs to Xen source inc - Citrix Xen server and not Apple.

Is this proof that he has chosen a random MAC address saying that this is the real one?

Yes. He found a random MAC address and gave you that as "his" iPad's MAC address.

A Complete listing of Apple's MAC address prefixes can be found here:

http://standards.ieee.org/cgi-bin/ouisearch?infinite loop

00-16-3E is not one of them, and would not appear on any Apple device.

Or is it possible that Xen source for some reason has assigned the MAC to the iPad.

No, this is not plausible.

I just want to help my friend get some closure on this, I don't know if it was or was not stolen.

The evidence is still all circumstantial, but all of these events are amazingly coincidental. The MAC address thing is a very strong indicator. Unless this ex-friend knew the admin login credentials for the router, it's extremely doubtful that he could've obtained the MAC address of the stolen iPad to then jailbreak and spoof the same address on his own, newly-purchased iPad.

At the very least, it's kinda thumbing the theft in the victim's face to buy one's own iPad and then go waving it around on the victim's house. And at worst, that dude has a serious pair of meatballs to flaunt the stolen iPad immediately after it went missing.

While you don't have the serial number of the device, it might be worth contacting the police with the MAC address information, and informing them of all the other coincidences you've observed. They might go with it, or they might not. It depends on how tech savvy and/or motivated (or lazy) your local police are.

In any case, this is an important lesson about tracking your stuff. Find My iPhone and Activation Lock are useful tools that should be turned on. And even if you happen to be really paradoxical in owning iDevices but being distrustful of the cloud, you should at least keep copies of all your device serial numbers. having to replace $500+ devices isn't fun.

 

[Lady Dahlia]

AtlantJan

Atlantis …. apropos Never to be found.

 

[vexorg]

Slightly off topic. I have always thought that apple could keep a note of serial number vs applied for devices. That way if iTunes finds a new device then it would be easy for them to inform the original owner of who has it. As far as I know, the serial number is not easy to change.

No doubt all the free speech and data protection people would go off the deep end, but it's one of those where the only people against it would be the criminals with something to hide.