Spoofing your MAC-address in Snow Leopard

This might not be the most useful hack, but in some scenarios it might be good to know.  And it does show those who believe that blacklisting MAC-addresses on their access point is a good security feature that they are mistaken.

For example the system they used at the college I lived in at the University of Newcastle, where you had to send in a paper form to register your mac-address to the ethernet outlet in your room, and weren’t able to use the internet on your laptop when visiting friends on the campus.

Be aware that using these commands to work around such a policy is probably illegal, though.
In snow leopard, spoofing your ethernet MAC-address is as easy as opening a terminal, and type sudo ifconfig en0 lladdr aa:bb:cc:dd:ee:ff

The address can of course be anything you want it to be.

For spoofing the address of your airport card you first have to disconnect from the network you are currently on, this can be done by clicking the airport-symbol in the menu bar, select join other network, type some random name, hit connect and then cancel. Now type

sudo ifconfig en1 lladdr aa:bb:cc:dd:ee:ff

And then you can reconnect, with your new address.

Update:

Captain Future has created an applescript for spoofing the mac address that looks very nice.  It can be found here. Thanks!

Related posts:

  1. Installing Wireshark on Mac OS X 10.6 Snow Leopard
  2. Useful BASH-command: !!
This entry was posted in IT, Security and tagged , , , , . Bookmark the permalink. Post a comment or leave a trackback: Trackback URL.

14 Comments

  1. Friend
    Posted December 3, 2009 at 04:15 | Permalink

    Just to put it out there, for anyone that still has trouble with Snow Leopard’s spoofing MAC address, type in airport -z, then spam the command (ifconfig en1 lladdr xxxxxxxxxxx).

  2. m
    Posted January 12, 2010 at 03:05 | Permalink

    Airport -z is giving me a “command not found” ??

  3. Posted January 12, 2010 at 09:04 | Permalink

    The command he means is not on the path by default, but the program can be run by entering the path /System/Library/PrivateFrameworks/Apple80211.framework/Versions/
    Current/Resources/airport
    or by symlinking that path to /usr/bin I guess.
    Some formatting problems here… remove the space in front of “Current”.

  4. captain future
    Posted January 25, 2010 at 14:55 | Permalink

    I made a small applescript application for this: here.

  5. Apolo
    Posted January 30, 2010 at 11:43 | Permalink

    Hello guys,
    I’ve done exactly what you say in the post. I’ve even try the “airport -z” method but the airport keeps trying to connect with no result.
    Can anyone help me?

    Thanks

  6. Posted January 30, 2010 at 14:23 | Permalink

    Have you verified that the address have been changed to the correct one for the right interface (en1 for airport) with “ifconfig” ?

  7. Posted February 12, 2010 at 17:27 | Permalink

    I think I’m having a problem similar to Apolo.
    ifconfig en1 | grep ether
    shows my mac has been successfully changed, however I am unable to connect to my router.
    (my router has no mac exclusion rules). Basically wifi stops working with a spoofed mac.
    If I then change it back to the original address, everything works again!

    This has only started happening since upgrade to 10.6
    I’m on a macbookpro, with airport extreme card, firmware Atheros 5416

  8. Viapple
    Posted March 1, 2010 at 03:21 | Permalink

    I’ve encountered similar difficulties Boomer is mentioning as recently as today, 28 Feb 2010. Seems I have a configuration similar to his…late ’07 MacBook Pro, OS X 10.6.2 Snow Leopard and same Airport card. I’d thought I’d cracked the nut with the hint suggesting disconnecting from an AP, but leaving Airport turned “On”, when attempting the mac spoof, but so far I’ve been unsuccessful.

    Has there since been a resolution to the problem Boomer and I are mentioning? Any assistance would be greatly appreciated as I’m eager to be able to surf the web, d/l music, etc. with my own laptop at work. I do have a corporate laptop in my office connected to the corporate secured network, but it’s to be used for work, only, and our corporate wireless signal is too weak in my corner of the building. It’d be great to be able to access any one of the other APs that are in the area without a full-on advertising of my mac address in case someone gets really bent about it.

    Any suggestions?

  9. admin
    Posted March 2, 2010 at 08:04 | Permalink

    This is probably an issue with the card in the MacBook Pro then… I’m running a regular MacBook with Broadcom BCM43xx 1.0 (5.10.91.26) firmware. Not sure whether it exist an optional solution for the Atheros chipset… I can’t really test that here at the moment. Would be nice if anyone who figures it out let me know though

  10. Trakix
    Posted March 7, 2010 at 03:38 | Permalink

    Same issue as Boomer here. Same computer/Airport Card. I’ve tried both lladdr and ether. After the successful change of MAC address it just won’t connect to any networks.

  11. Posted March 17, 2010 at 01:03 | Permalink

    well, at least its not just me!
    helf ?

  12. Posted May 30, 2010 at 21:15 | Permalink

    anyone had any advances on this one?

  13. Mick
    Posted June 18, 2010 at 17:46 | Permalink

    I’m in the same boat. If I do:

    ifconfig en1 | grep ether

    then I see the changed address. But if I then look in the Networking preferences I see my original address.

  14. Posted June 18, 2010 at 19:09 | Permalink

    @Mick
    what mac are you on?
    I’m on a macbookpro, with airport extreme card, firmware Atheros 5416

Post a Comment

Your email is never published nor shared. Required fields are marked *

*
*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>