This might not be the most useful hack, but in some scenarios it might be good to know. And it does show those who believe that blacklisting MAC-addresses on their access point is a good security feature that they are mistaken.
For example the system they used at the college I lived in at the University of Newcastle, where you had to send in a paper form to register your mac-address to the ethernet outlet in your room, and weren’t able to use the internet on your laptop when visiting friends on the campus.
Be aware that using these commands to work around such a policy is probably illegal, though.
In snow leopard, spoofing your ethernet MAC-address is as easy as opening a terminal, and type sudo ifconfig en0 lladdr aa:bb:cc:dd:ee:ff
The address can of course be anything you want it to be.
For spoofing the address of your airport card you first have to disconnect from the network you are currently on, this can be done by clicking the airport-symbol in the menu bar, select join other network, type some random name, hit connect and then cancel. Now type
sudo ifconfig en1 lladdr aa:bb:cc:dd:ee:ff
And then you can reconnect, with your new address.
Update:
Captain Future has created an applescript for spoofing the mac address that looks very nice. It can be found here. Thanks!
Related posts:
26 Comments
Just to put it out there, for anyone that still has trouble with Snow Leopard’s spoofing MAC address, type in airport -z, then spam the command (ifconfig en1 lladdr xxxxxxxxxxx).
Airport -z is giving me a “command not found” ??
The command he means is not on the path by default, but the program can be run by entering the path /System/Library/PrivateFrameworks/Apple80211.framework/Versions/
Current/Resources/airport
or by symlinking that path to /usr/bin I guess.
Some formatting problems here… remove the space in front of “Current”.
I made a small applescript application for this: here.
Hello guys,
I’ve done exactly what you say in the post. I’ve even try the “airport -z” method but the airport keeps trying to connect with no result.
Can anyone help me?
Thanks
Have you verified that the address have been changed to the correct one for the right interface (en1 for airport) with “ifconfig” ?
I think I’m having a problem similar to Apolo.
ifconfig en1 | grep ether
shows my mac has been successfully changed, however I am unable to connect to my router.
(my router has no mac exclusion rules). Basically wifi stops working with a spoofed mac.
If I then change it back to the original address, everything works again!
This has only started happening since upgrade to 10.6
I’m on a macbookpro, with airport extreme card, firmware Atheros 5416
I’ve encountered similar difficulties Boomer is mentioning as recently as today, 28 Feb 2010. Seems I have a configuration similar to his…late ’07 MacBook Pro, OS X 10.6.2 Snow Leopard and same Airport card. I’d thought I’d cracked the nut with the hint suggesting disconnecting from an AP, but leaving Airport turned “On”, when attempting the mac spoof, but so far I’ve been unsuccessful.
Has there since been a resolution to the problem Boomer and I are mentioning? Any assistance would be greatly appreciated as I’m eager to be able to surf the web, d/l music, etc. with my own laptop at work. I do have a corporate laptop in my office connected to the corporate secured network, but it’s to be used for work, only, and our corporate wireless signal is too weak in my corner of the building. It’d be great to be able to access any one of the other APs that are in the area without a full-on advertising of my mac address in case someone gets really bent about it.
Any suggestions?
This is probably an issue with the card in the MacBook Pro then… I’m running a regular MacBook with Broadcom BCM43xx 1.0 (5.10.91.26) firmware. Not sure whether it exist an optional solution for the Atheros chipset… I can’t really test that here at the moment. Would be nice if anyone who figures it out let me know though
Same issue as Boomer here. Same computer/Airport Card. I’ve tried both lladdr and ether. After the successful change of MAC address it just won’t connect to any networks.
well, at least its not just me!
helf ?
anyone had any advances on this one?
I’m in the same boat. If I do:
ifconfig en1 | grep ether
then I see the changed address. But if I then look in the Networking preferences I see my original address.
@Mick
what mac are you on?
I’m on a macbookpro, with airport extreme card, firmware Atheros 5416
There’s a program called MacSpoofer you can try… Haven’t tried it myself, but it is free and seems to work for some.
thanks admin, will check it out
no…didnt work.
I think its just with my macbook pro hardware:
airport extreme card, firmware Atheros 5416
Well, after I changed my AirPort MAC address via ifconfig, it is true that I can still see the original AirPort ID in my Network Preferences. But when I wireshark my connection, I can see that the actual MAC address used is the one which I defined manually via ifconfig.
Thus, my conclusion is that the AirPort advanced preferences show the hardware MAC address – regardless of which address is actually being used right now.
What I do not understand, however, is that you cannot have Internet or a connection to your router after you guys changed it. I believe that it is a network-level problem. Such as an outdated ARP cache and that’s why you don’t receive any packets. Could that be the case?
Anyway, I also made yet another Cocoa application that conveniently runs the ifconfig command for you and you can also choose a vendor prefix from a nice search list. Here: http://blog.funkensturm.de/2010/01/22/airportclown-simple-mac-address-spoof-for-snow-leopard and here is the source code: http://github.com/funkensturm/AirPortClown
PS: MacSpoofer can change the en1 MAC address *while* I’m connected to a WLAN. That’s quite impressive – even though I naturally loose my connection to any server
But MacSpoofer is not open-source as I understand it.
no joy…your app had no problem changing the mac once an acceptable vendor was found, but then (same problem) I’m unable to connect to anything.
when mac is changed back to original, everything works again.
How would I test your outdated ARP cache theory?
Well, try something really dummy-save like:
1. Disconnect all cables / WLANs
2. Clear the ARP cache with: sudo arp -d -a
3. Change your MAC address
4. Maybe clear the ARP cache again
5. Reconnect
thanks captain but no joy… still can’t connect
It struck me last night, that actually it is not *your* ARP cache that needs to be cleared, it is the ARP cache of the WLAN you’re connected to. That can only be done by timeout.
May I ask some simple questions?
1. Where are you? At home, or in e.g. a library that uses some sort of authentication web site? Authentication is often based on the MAC address.
2. You say “when mac is changed back to original, everything works again”. Does all of this testing happen within 5 minutes?
What you also could do, is download Wireshark and have a look at the traffic on interface en1 (or whatever your airport is). You should be able to get a pretty clear picture of which MAC address is used to send the packages and whether there are any error messages. I say “should be able to”, because it is some work to interpret all these bunches of packets floating through your interface
1. at home, connected to a wireless router, connected to internet. no authentication website, no mac filters.
I’m using the same equip (router, modem) that worked with leopard 10.5. Now with snow leopard, no joy.
2. yep! 5min or less usually…. will look into fireshark and more thorough testing
Same for me, im on a 27″ Imac with a Atheros Airport Extreme. I can change the address, but then the connetion just keeps on timing out. Has anybody figured this out yet? Any help would be appreciated
looks like we’re stuck with our old mac address…
Time for new OS, like window xp or Linuxes