This is true you can spoof a MAC and that in some cases this could be a defense in court. It really depends on the situation and who is defending or prosecuting. But I agree with you that a MAC is not a guarantee you have the right person or a good case. There have been a few legal cases dropped in the courts where the person says a Virus made me do it and claims that the content on there computer was not downloaded by them or the attach was a zombie. So I guess if your collecting evidence you need to get all you can and if your on the other side and defending yourself make sure to bring up the fact there are is a lot of 0-day code that can do some bad stuff where the virus software will not alarm on it.

Brian

The Mac address would not be the key evidence used in a prosecution. IP addresses are usually the target.  Something has to lead law enforcement to the attacker and that’s usually the IP address. If an attacker’s main form of hiding is to spoof his Mac address, he is wasting his time.  Once law enforcement confiscates the computer, they will begin forensics. If the Mac address is the one hard coded in the card, that’s helpful, especially if there might be a house hold with several internet connections.  If its not, they will look for things like software that changes Mac addresses. If that’s found, even though you might have spoofed your Mac ID, you are not off the hook.  One thing I have noticed with sloppy attackers is they forget they have a lot of “hacking” programs on their box and that’s even more incriminating when they get caught than having an identified Mac address. Maybe the card had a different Mac ID than what was logged, but they find 3 programs for changing Mac addresses, that’s going to look bad. The best attackers remove their hard drive and hide it after their attack.  If there box is taken away to be inspected, more than likely all they would see is a hard drive full of Disney movies. Movies legally downloaded of course, lol.

Nmap has the ability to spoof both IP addresses with the -S flag and MAC addresses with --spoof-mac, and I have it on my workstation at work, on my laptop and on my home pc. I use it (Nmap) for legitimate troubleshooting of network issues related to our customers networks and network devices, and it is an invaluable tool. Just because I have it on my systems doesn't mean that I should be incriminated.

If I realy wanted to change the MAC address, I could just change it in the NICs driver setting and clear the events in the system logs afterwards - much easier.