search

feross / SpoofMAC

:briefcase: Change your MAC address for debugging
https://feross.org/spoofmac/
3.02k stars 271 forks source link

Cannot change MAC address on Macbook Pro 2018 and newer #87

Closed blaesus closed 4 years ago

blaesus commented 6 years ago

Solution: Update to macOS 10.15 Catalina

Updating to macOS 10.15 Catalina appears to fix the issue.

Original report

I cannot randomize any MAC address with spoof-mac. The program returns fine, but the MAC addresses are not changed. I tried changing en0 and en1 and neither took effect. The Node.js spoof doesn't work either.

I tried rebooting or signing in as another user; neither worked.

By the way, sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff doesn't work either.

spoof-mac version: 2.1.1

untitled untitled 2

This is a new machine. I have another Macbook which runs on 10.12, where spoof-mac works just fine.

Thanks for making the tool! It is really helpful.

danipolo commented 5 years ago

changing last chars worked for me

please expand this, thanks

dduerin commented 5 years ago

changing last chars worked for me

Doesn't work for me

joshm91 commented 5 years ago

I'm on a mid-2015 15inch mbp on 10.13.6 and can confirm that sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff no longer successfully changes the mac address for me either.

infracritical commented 5 years ago

I have a MBP 15 as well, and that too, does not work. I am running Mojave 10.14.2.

joachimtingvold commented 5 years ago

Did anyone try using older ifconfig binaries? (from MacOS releases known to work). Would be interesting to see if it would work, and if it does, if it works on both 2018 and pre-2018 MBPs.

jonluca commented 5 years ago

@jallakim

The issue is not the macOS version - it's the new MBPs. I thought there might be a difference in binaries but unfortunately they are the same.

I just tried changing the mac address on a 2016 MBP on 10.14.2 (18C54) and it works.

screen shot 2019-01-21 at 3 13 54 pm

The hash matches that of the 2018 MBP, which means that it's a driver difference. Now we need to find out if it's an intentional change or accidental regression by Apple.

joachimtingvold commented 5 years ago

@joshm91 stated a few comments above that it did not work on his mid-2015 MBP.

jonluca commented 5 years ago

@joshm91 can you post your System Information Hardware and Wifi pages and the output of the same commands I ran above?

sudo ifconfig en0
sudo ifconfig en0 ether 78:4f:43:95:47:2e
sudo ifconfig en0

If I had to guess he has a different issue. They are on 1) a confirmed working version of the hardware and on 2) 10.13, which is the older version of macos, which also worked.

slangava commented 5 years ago

Updated to 10.14.3 on a MBP 13 2018 and still doesn't work

jdraths commented 5 years ago

I have an early 2015 MBP, recently updated to OS 10.14.1 I have the same problem as described above... cannot change my mac address.

chipset info here

MiroFurtado commented 5 years ago

Also have this issue! 2017 MBP got this issue after updating to Mojave

joachimtingvold commented 5 years ago

I have an on-going case towards Apple Support regarding this matter. Will post info if/when I hear something. If I don't get any definitive answer, or if it takes forever to get an answer, I'll provide you with a case number, so that you can create cases for yourself, referring to the same case, possibly giving the issue more attention.

total3dx commented 5 years ago

I bought one 13" mid 2018 till it died, it was replaced. I can tell you that on the exactly same os they behave sometimes differently, case was with touch id. Finder was crashing even on an empty machine. Couldn't and still can't change MAC, it's just ridiculous. It couldn't remember my apple id.

Nice work Apple, :applause:, way to go to communism!

bruhadze commented 5 years ago

I also have same issue. Running Mojave 10.4.4 on 2018 MacBook Pro 15”

StewGoin commented 5 years ago

10.14.2 on 2018 MBP 15" -- also can't change the MAC.

Same OS on a mac mini late 2012 -- worked fine.

RoesWibowo commented 5 years ago

MBP 2017 OS Version 10.14.2 (18C54) roes@MacBook-Pro ~/> spoof-mac list --wifi - "Wi-Fi" on device "en0" with MAC address (ORIGINAL) currently set to (CHANGED)

It's working for me. I give star this repo. Thanks!

davkap92 commented 5 years ago

Seems to be working for me on 10.14 older mbp 2012 though, it didn't change in wifi advanced -> hardware but I see the change in ifconfig. thanks :)

RamboRogers commented 5 years ago

Doesn't work on MB Air 2018.

adib commented 5 years ago

I've posted Bug Report 48549933 to Apple on this.

jgtoriginal commented 5 years ago

Following @jonluca I installed a Linux VM. It turns out that changing the MAC Address is OK there. Then I went back to couple of old mac -both on Mojave, but from previous years- and checked that they all have the same version of ifconfig. At this point, I'd assume there's something different on the driver that receives ifconfig's instructions. But since that goes completely under the hood on OSX, I don't think there's an easy way of amending it.

joachimtingvold commented 5 years ago

Following @jonluca I installed a Linux VM. It turns out that changing the MAC Address is OK there.

Does the change also reflect in Mac OS? (i.e. change the MAC via the Linux VM, and then check if Mac OS registers/uses that new MAC?).

jgtoriginal commented 5 years ago

No, it doesn't @jallakim probably because the linux OS is wrapped on the VM container. Maybe with a bootable Linux USB, one might be able to override that permanently.

joachimtingvold commented 5 years ago

I'm guessing you're just changing the MAC for the virtual interface within the VM then, not really doing anything at all with the actual "physical" network card. Not really relevant, to be honest. You'd have to actually boot the machine into Linux if the test is to be relevant.

jgtoriginal commented 5 years ago

That's what I meant by, Maybe with a bootable Linux USB, one might be able to override that permanently. @jallakim Which I will probably do, but I'm not sure I'm going to update you with such an encouraging comment. Not really relevant, to be honest =) Tbh, you should mind your manners. But I'll keep you posted anyway. Have a good one!

zoonderkins commented 5 years ago

Note: I have a 2015 Macbook Air running Mojave 10.14.2 - with this device I am able to change my MAC address no problem.

My 2018 Macbook Pro running Mojave 10.14.2 - no such luck.

Has anyone tried disabling SIP and does that help?

Tried disable SIP Mbpr 2018 15inch latest version... not working

RamboRogers commented 5 years ago

Doesn't seem to work for me.

Thanks,

Matthew Rogers

On Sun, Mar 10, 2019 at 8:57 PM edoo notifications@github.com wrote:

Note: I have a 2015 Macbook Air running Mojave 10.14.2 - with this device I am able to change my MAC address no problem.

My 2018 Macbook Pro running Mojave 10.14.2 - no such luck.

Has anyone tried disabling SIP and does that help?

Tried disable SIP Mbpr 2018 15inch latest version... not working

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/feross/SpoofMAC/issues/87#issuecomment-471372525, or mute the thread https://github.com/notifications/unsubscribe-auth/AHZ3XZBkzuIAz1t7JXwBr1aJHj96qjugks5vVanlgaJpZM4VV04r .

jgtoriginal commented 5 years ago

I just tried booting on Linux with a live usb stick. It was basically impossible, I can get pass all security settings, but once loading the USB stick it get's blocked with err -14. It turns out that new macs have a new T2 security chip, which basically disallows you from booting on Linux. You can find more details on the following links further down. So I assume from now onwards bypassing this barriers would be just like jailbraking iOS. In this case we'd need to gain full access first, then load linux, finally change the mac address.

jonluca commented 5 years ago

@jgtoriginal You can still boot linux if you disable some of the secure boot settings, following this guide by Apple here.

However, some of the drivers for the new MBP are missing/not fixed yet so it won't work. You can follow that discussion on this alternate issue.. I was able to get Arch halfway working in single user mode - only issue is the keyboard doesn't work.

I also highly doubt that booting linux live usb you'd be able to override it permanently. The issue is that the mac address is permanently flashed to the WiFi card. AFAIK you can't overwrite that on MBPs. Any time you spoof your mac address on Linux/macOS/Windows you're just changing the kernel/in memory value, not the actual hardware data.

When it gets read into the OS during the initialization of the network stack it's then part of memory, and can just be freely changed (or at least you used to be able to).

I think we've isolated the issue to the driver or kernel. Since Bootcamp windows is able to change it, it's not a hardware issue.

Anyone know someone particularly proficient with the Apple networking stack or their hardware drivers? I've tried tracing the syscalls but they always end up at ioctl and I'm stuck.

jgtoriginal commented 5 years ago

@jonluca Thanks for your update, you are right: you can barely boot linux, I just got to your very same case scenario following those very same steps by then.

I just don't think this is a driver or kernel issue, it looks to me like very inline with apple ways of profiling, where the MAC address is a key value.

Anyway, thanks for your update!

joshhunte commented 5 years ago

Still the same in MacOS Mojave 10.14.5 update on a 15" MacBook Pro 2018.

Has anyone had success running MacOS but using an external WiFi adapter?

zoonderkins commented 5 years ago

Still the same in MacOS Mojave 10.14.5 update on a 15" MacBook Pro 2018.

Has anyone had success running MacOS but using an external WiFi adapter?

Im using https://www.gl-inet.com/products/gl-usb150/ USB Router to spoof my MAC address I plugged it into my powerbank as power source. Then do wifi-Repeater mode to my school / office /coffee shop public wifi

danielehrhardt commented 5 years ago

Same Issue with MacOS 10.15 :(

joshhunte commented 5 years ago

Still the same in MacOS Mojave 10.14.5 update on a 15" MacBook Pro 2018. Has anyone had success running MacOS but using an external WiFi adapter?

Im using https://www.gl-inet.com/products/gl-usb150/ USB Router to spoof my MAC address I plugged it into my powerbank as power source. Then do wifi-Repeater mode to my school / office /coffee shop public wifi

I need to be able to spoof WiFI Network Adapter Address and for it to appear in MacOS. Will that USB Router work? Thanks

Swang007 commented 5 years ago

Ditto, 10.14 & 10.15 Beta (19A487m). It's a shame Apple hasn't brought this to light.

joshhunte commented 5 years ago

"MacBook Pro" Apparently this does not even work for external USB NICs. Soon you will have to Jailbreak MacOS. Thanks Apple!

caglorithm commented 5 years ago

Macbook Pro 2019 13 inch, same issue. My guess is Apple seems to have removed the functionality on purpose (which is outragous).

lbarthon commented 5 years ago

MBP 2018 15 inch, the issue is still here. What's Apple's response on the bug report 48549933 ?

joshhunte commented 5 years ago

MBP 2018 15 inch, the issue is still here. What's Apple's response on the bug report 48549933 ?

From what I can gather, so far it appears Apple is not considering this as a bug rather a security feature.

jgtoriginal commented 5 years ago

MBP 2018 15 inch, the issue is still here. What's Apple's response on the bug report 48549933 ?

From what I can gather, so far it appears Apple is not considering this as a bug rather a security feature.

Is that how they call profiling now? =D Anyway, do you have any quote you can point us to for that @joshhunte ?

joshhunte commented 5 years ago

MBP 2018 15 inch, the issue is still here. What's Apple's response on the bug report 48549933 ?

From what I can gather, so far it appears Apple is not considering this as a bug rather a security feature.

Is that how they call profiling now? =D Anyway, do you have any quote you can point us to for that @joshhunte ?

Sure. Although an unconfirmed source, it sounds 100% plausible... This is Apple we are talking about...

https://forums.developer.apple.com/thread/106768

_Alright everyone. My ticket has been closed and I pinged a bunch of friends I have that work at Apple HQ. Final result. This is not a bug. Apple is removing this feature for security reasons. This makes no sense since doing this does not put the individual doing it at a security risk. But I don't. Im so done with the platform. You can't just remove ifconfig functionality. Thats not how any of this works.__

feross commented 5 years ago

This is the relevant post:

Screen Shot 2019-07-10 at 4 03 00 PM
RamboRogers commented 5 years ago

Privacy, FILE NOT FOUND.

Thanks,

Matthew Rogers

On Wed, Jul 10, 2019 at 7:04 PM Feross Aboukhadijeh < notifications@github.com> wrote:

This is the relevant post:

[image: Screen Shot 2019-07-10 at 4 03 00 PM] https://user-images.githubusercontent.com/121766/61010700-3a173a00-a32c-11e9-863e-4e0b5a887a8b.png

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/feross/SpoofMAC/issues/87?email_source=notifications&email_token=AB3HOXMEIPL5LZAH6S4M6ODP6ZTG5A5CNFSM4FKXJYV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODZU74YI#issuecomment-510262881, or mute the thread https://github.com/notifications/unsubscribe-auth/AB3HOXPCDDRQI5RMXQLLD7DP6ZTG5ANCNFSM4FKXJYVQ .

halo commented 5 years ago

To be fair, since iOS 8, MAC addresses are still randomly changing every 15 minutes on mobile devices.

That's clearly a privacy feature and Apple would not put this much effort into privacy protection, to then entirely throw it over board only on macOS. I would grant Apple the benefit of doubt until more details surface.

Apple is removing this feature for security reasons

I must admit, though, that I cannot come up with a reason related to security for disabling this on macOS entirely.

Just on a side note, if MAC address privacy were a top priority, iOS 10 would not have caused MAC randomization to be effectively useless since 2016 (page 11):

In June 2016, midway through our research, iOS 10 was released. Inexplicably the addition of an Apple vendor specific IE was added to all transmitted probe requests. This made identification of iOS 10 Apple devices trivial regardless of the use of MAC address

That research has been confirmed in 2019 (page 9)

Finally, the client device transmits an 802.11 authentication frame, in which the source address is the global public MAC address of the device. Strangely, we observe that probe request frames also use the global public MAC address of the device; this is unusual because iOS devices generally randomize MAC addresses in probe requests when in an un-associated state.

total3dx commented 5 years ago

So now, if I need to change a MAC I need to have a dongle pack? do you sell 100 for $20? Don't you think it's ridiculous? This message 100% wasn't from a security guy at Apple. Just customer service. If they think they think it's ok (which I think is a violation of privacy) so bootcamp and linux then

jgtoriginal commented 5 years ago

Not possible either I'm afraid...

PaulRBerg commented 5 years ago

I confirm this issue on MBP Late 2016 with Mojave 10.14.6. I sent Apple my feedback on this using the template above.

It's particularly annoying because the city I'm stuck in for the next 2 weeks has many WiFi spots that limit users' download size and time allowance. As a digital nomad, it is an awful situation to be in.

feross commented 5 years ago

So now, if I need to change a MAC I need to have a dongle pack?

Hah, this is actually a workaround that would probably work. There are tiny USB wifi dongles:

And you would need to combine that with a USB-A to USB-C dongle since you're presumably using a Mac with USB-C only if you've run into this issue. Here's a tiny one:

You'd want to ensure that the dongle you buy has a MAC address that can be modified. Or, for maximum hilarity, you can buy 5-10 wifi dongles and swap them out whenever your WiFi time limit is up.

Welcome to Apple Life™️

2ix8htA

deuscielo commented 5 years ago

Yes I can confirm this usb WiFi dongle works on a 2018 MacBook Pro

On Sat, Aug 3, 2019 at 8:39 PM Feross Aboukhadijeh notifications@github.com wrote:

So now, if I need to change a MAC I need to have a dongle pack?

Hah, this is actually a workaround that would probably work. There are tiny USB wifi dongles https://amzn.to/2ZuowNt:

https://amzn.to/2ZuowNt

And you would need to combine that with a USB-A to USB-C dongle since you're presumably using a Mac with USB-C only if you've run into this issue. Here's a tiny one https://amzn.to/2KpZU1L:

https://amzn.to/2KpZU1L

You'd want to ensure that the dongle you buy has a MAC address that can be modified, or else you can buy 5-10 dongles and swap them out one at a time when your WiFi time limit is up.

Welcome to Apple Life™️

[image: 2ix8htA] https://user-images.githubusercontent.com/121766/62418082-a298c480-b615-11e9-8641-bc8cb54b4e8f.jpg

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/feross/SpoofMAC/issues/87?email_source=notifications&email_token=ALDPAH3XEAWTF5Y5EQFMA3DQCYQM5A5CNFSM4FKXJYV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3PYFKQ#issuecomment-517964458, or mute the thread https://github.com/notifications/unsubscribe-auth/ALDPAH2JO6SVORNCCEE3EALQCYQM5ANCNFSM4FKXJYVQ .

nelsonjchen commented 5 years ago

@deuscielo can you confirm if you can change the MAC address on it?

cromatikap commented 5 years ago

:laughing: