T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/auto-register.md:21- Finding
Collection and External Transmission of a Persistent Hardware Fingerprint
- Content
View full analysis
continue to Step 1. Before consent, do not execute collection commands or send a registration request. mac_hash · Linux: iface=$(ls /sys/class/net | grep -vE '^(lo|docker|veth|br-|tun|tap)' | sort | head -n1) cat "/sys/class/net/$iface/address" 2>/dev/null \ | tr -d ':-' | tr 'A-Z' 'a-z' \ | sha256sum | awk '{print $1}' POST https://ai.zhiliaobiaoxun.com/web-api/internal/auto-register Content-Type: application/json { "device_features": { "hostname": "", "platform": "darwin", "arch": "arm64", "username": "", "home_path": "", "mac_hash": "abc123..." }, "agent_kind": "claude-code", "agent_version": "...", "skill_version": "tender-search-2.5.0", "ch": "s57" } ``` ### Technical Analysis The registration workflow instructs the agent to inspect physical network interfaces, read a MAC address, normalize it, calculate an unkeyed SHA-256 digest, and transmit that digest with operating-system and processor-architecture information to an external registration service. Hashing a MAC address does not anonymize it effectively. MAC addresses have limited entropy and structured vendor prefixes, making offline enumeration and correlation practical. The resulting stable digest remains a persistent pseudonymous device identifier that can correlate registrations or activity across sessions. The workflow does include an important consent gate and prohibits collection before approval. It also avoids transmitting the raw MAC address, hostname, username, home path, or file contents. These safeguards reduce the risk, but they do not eliminate it: - The description characterizes the fingerprint as having no identi ...[truncated 2347 chars]- Remediation
View remediation