There are other possible unique hardware IDs
other than the MAC address that you need to be aware of
and mitigate the risks associated with them if you need
anonymity and non-attribution.
So let’s start with the CPUs. Almost all modern CPUs
do not have a software readable serial number.
Intel started to try to add them in the 1990s with the Pentium 3,
but because of the massive public upset,
they discontinued the serial numbers, which is good.
So with most CPUs,
you can only identify a particular model and that’s all,
because there’s no serial numbers.
Now, if you want to examine your CPU
and see what sort of information you can get from it,
then on Windows you can use CPU-Zed,
or CPU-Z, which you can download from here.
This will show you what information is available in your CPU,
but as I said, there shouldn’t be anything unique
if you have a modern processor.
And on Linux, there’s a very similar tool
to view CPU information called I-Nex,
which you can download from here.
And that looks like this, pretty similar to CPU-Zed.
And on Mac, if you want to see the CPU information,
download this tool here.
So that’s CPU. Should be nothing much
to worry about with CPUs in terms of hardware serial numbers.
Now, the next thing is the motherboard.
Motherboards often, but not always,
contain unique identifiers in the system management BiOS,
SMBiOS memory.
And major OEMs typically have these serial numbers in the SMBiOS,
which means an adversary could get access to this
and tie it back to the purchaser or you.
In Windows, you can view the hardware information
using the Windows Management Instrumentation tool, WMI.
So malware could pretty much do exactly the same.
From the command prompt,
check out if your device has a unique identifier.
You can run a command similar to this.
This will tell you the name of your BiOS current version
and its serial number if there is any.
And this command tells you the system motherboard name,
number, and its UUID.
I’m currently using VMware so you can see the UUID
for this virtual machine.
So that tool’s unique to Windows.
There is another tool for determining hardware information
that you can use on Linux, Mac OSX, and Windows,
and that’s this: DmiDecode.
This is the Windows version that you can just download and install.
This is the version you can download and install for both Linux and Mac.
But on Linux, you’ll be able to get it from your repository quite easily
if you're on Debian or Debian based systems,
with just simply the apt-get tool.
To install DmiDecode on Mac OSX,
I recommend you use Brew because it’s the easiest way to install it
and it can keep you updated. Just use this command here: brew install.
There we are; DmiDecode installed.
So let me show you how to use DmiDecode.
It’s the same switches and options for Windows, Linux, and Mac.
So, if you see there, it says we can’t find it,
well that’s just because you don’t have admin right.
So you need admin rights to run it.
Typing “-t” will give us a list of all the options that we can run.
So let’s start with system.
So there you can see the UUID of the system.
It has zero for serial number here. You may or may not get zero.
I’m in a virtual machine
so you may get less information on a virtual machine.
System, then you’ve got baseboard, which is the motherboard.
And you may find a serial number there.
You can also find information on the BiOS.
There you go.
So use DmiDecode,
check out the hardware serial numbers on your machine.
Now we’re going to look at hard drive serial numbers
and unique IDs as these can exist as well.
So first we’re in Windows. We can just simply do a dir.
And you can see here we’ve got a serial number for the drive.
You can also try this command as well.
And you see there, you’ve got lots of information about the disk drive.
If we want to separate out the serial number, then we need to type
and that would give us the serial number.
Again, I’m in a vm so this is reducing the number of serial numbers
that it’s producing, but check that out on your own system.
That’s for Window; that’s how you do it in Windows.
On Linux, there’s a couple of ways of doing it,
but LSHW is the tool that I tend to use,
so you need to install that if it doesn’t already exist.
So that’s installed.
And if we go up,
there you go.
See the hard drive serial number,
at least the hard drive serial number for this virtual hard drive.
It’s not showing my actual hard drive
because I've got isolation within the virtual machine.
So that’s how you do it in Linux.
Find out your hard drive serial number.
And then in Mac, you can go through the about Mac GUI,
but you can also put in this command as well.
And there we go. We can see a bunch of volume unique IDs here,
here,
and serial number here. I blurred these out
as these are the actual serial numbers on this machine for the hard drive.
Let’s consider these unique hardware identifiers
in the context of the operating systems that you use.
Any operating system that is licensed to a machine
has to identify the machine uniquely.
This is to control and track product key use and abuse.
This means if you're using, say, Windows or Mac OSX,
Microsoft and Apple are aware of your unique hardware IDs,
and specifically, usually the motherboard ID
is tied to the license in some way.
So if you're using Windows or Mac OSX
or other operating systems you have purchased
and are attempting to be anonymous
and your hardware ID is compromised,
whoever you purchased it from could link the device back to you.
Your adversary may have the power
to get this information from the seller.
And it’s not just operating systems.
Also applications can be aware
of your hardware serial numbers,
which again, through a money trail can be tied back to you.
Another consideration:
if you're using a live CD operating system like Tails,
or maybe you're dual booting on the same hardware
that you are running Windows, or OSX,
or a paid operating system,
you are sharing the hardware IDs with every operating system.
So you're not completely unique even though you're dual booting
or you're using a live operating system.
If Tails is compromised, if the dual boot system is compromised,
and your hardware ID is recorded,
the seller, again, could link this back to you.
Your adversary could link it back to you.
This is the problem of hardware serial numbers
for privacy and anonymity.
So, if we care about non-attribution and being anonymous,
how do we mitigate the hardware serial number issue
and the leaking of these hardware serial numbers?
Well, it’s potentially possible to alter
the unique identifiers with special proprietary tools.
Much like we did with the Mac address,
you can find tools to change some of these hardware serial numbers.
If you look here, you can see an old post for some tools
that can enable you to change the hardware serial IDs.
Check out this post. A couple of the main ones
is VolumeID that it shows on this post,
which you can get from Sysinternals,
which works for Windows.
And there’s also Chameleon.
Chameleon can change the hard-coded serial numbers
of hard drives and network adapters on Windows.
So these might be useful for you.
The next mitigation is to have anonymously purchased
the devices that you use.
This will mitigate the risk of an adversary deanonymizing you
as there is no money trail.
Another strong mitigation is using virtual machines
for isolation and compartmentalization.
Virtual machines have different physical machine IDs
and there is no traceable connection
to the real physical machine’s unique hardware IDs
unless there is a breakout to the host, which is unlikely.
Check out what the unique IDs are within the virtual machines you have
and compare them to your host operating system.
They should be different.
So when in a virtual machine, you don’t need to worry
about these hardware serial numbers.
Moving on from hardware serial numbers,
let’s explore some other isolation and compartmentalization methods
that are implemented physically.
You can use a separate phone or Burner phone,
which we talk about later.
You can store your files, emails, and data physically separate,
maybe on an external USB drive, a DVD, or in the Cloud,
out of the sphere of influence of your adversary.
Law enforcement agencies are having particular problems
getting access physically to remote content out of their jurisdiction.
You can use security tokens, hardware security modules,
and store encryption keys separately.
Nitrokey is an example of something you can use to do that.
YubiKey is also an example. We’ll discuss more on these later.
You can store backups offsite for physical isolation.
You can do network isolation,
separating trusted devices and untrusted devices
using LANs, VLANs, utilizing routers, switches and firewalls.
We cover this in its own section later.
And you can even use a separate physical location to operate,
such as using an internet café for separate aliases.
And we discuss more on these topics later
as we go through the course.
Isolation and compartmentalization can extend to anything physical
to create layers of defenses.
Consider using physical isolation for your security,
and make sure that your physical devices
are properly isolated by unique IDs
in order that you can stay anonymous and have non-attribution.