Cannot change MAC address on Macbook Pro 2018 and newer

[blaesus]

Solution: Update to macOS 10.15 Catalina

Updating to macOS 10.15 Catalina appears to fix the issue.

Original report

I cannot randomize any MAC address with spoof-mac. The program returns fine, but the MAC addresses are not changed. I tried changing en0 and en1 and neither took effect. The Node.js spoof doesn't work either.

I tried rebooting or signing in as another user; neither worked.

By the way, sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff doesn't work either.

spoof-mac version: 2.1.1

This is a new machine. I have another Macbook which runs on 10.12, where spoof-mac works just fine.

Thanks for making the tool! It is really helpful.

[eric8810]

Same problem，i tried many tools like python version, wifi-spoof etc.
Even the cmdline "if en0 ether xx:xx:xx" has been confirmed failed.
Seems like the new machine blocks up the spoof interface.

2018 new mbp 15

[jonluca]

Confirming the same issue.

Edit: Problem discussed previously was unrelated

[TkTech]

@jonluca your problem probably isn't the same. Can you try turning off System Integrity Protection temporarily and try again?

[jonluca]

Issue seems to just be with new 2018 MBPs

SIP is turned off.

I believe it is the same problem. I’m running ‘sudo ifconfig en0 ether xx:xx:xx:xx:xx:xx’ and it A) fails silently and B) returns a 0 exit code.

The console just shows what system events are happening right after. Does your console not show those events?

[TkTech]

No, the error message you're getting is because the code signature database (DetachedSignatures) can't be opened. Either it's really gone, or SIP is blocking it from being opened (which happens). Either way that message usually means your permssions are messed up somewhere.

You also can't change the MAC, but that's the same for everyone at the moment. Two different problems.

[jonluca]

Ah gotcha.

The DetachedSignatures file actually doesn’t exist - is that an issue?

I’m running 10.14 beta by the way.

[TkTech]

Really hard for me to debug, I know users are having lots of trouble with OSX but with only one machine available to me with the real NIC I'm stuck on an older version of OS X. Pretty much turns into a game of 20 questions.

If you download an unsigned app, you know the prompt to confirm/deny running it? If you hit accept, close the app, and run it again, does the prompt reappear or does it remember it? If it remembers it, that means 10.14 has moved the signatures from DetachedSignatures to somewhere new. If it keeps asking you, then OS X can't create the database file and that usually means either the permissions are messed up, or something moved the /private/var -> /var symlink

One important question; is this a fresh install of the beta, or installed over an older version?

[jonluca]

Removed so as to not clog up conversation. This problem is unrelated to lack of ability to spoof mac address.

[TkTech]

Well, try to get rid of one problem. If you turn off the OS X firewall under preferences and restart you should get rid of the socketfilterfw errors. Try that and see what you get.

[jonluca]

Removed so as to not clog up conversation. This problem is unrelated to lack of ability to spoof mac address.

[TkTech]

-67062 from taskgated is "code object is not signed at all", so it's still a code signing issue.

My guess at the moment:

It doesn't look like it's intentional, since in that case they would have just return 0; in the framework, or only allowed an internal signature to make the change. Instead, something somewhere, probably part of the networking daemon, doesn't seem to be signed properly in the beta, and OS X won't allow the change from an unsigned app.

[eric8810]

MacOS error: -67062
same return
I tried with internal term console, still the same

[jonluca]

Now I feel quite dumb.

I use zsh, and my terminal prompt has a cwd git status indicator. Git is installed through brew, and as such is not signed. After every command, zsh runs git status in the current directory, and that's what the error is.

If I run in it raw bash with no prompt, taskgated disappears.

[feross]

Confirmed that this has stopped working on 2018 MBPs. The web has no answers either.

If anyone has information about how to fix this, please share.

[ben-richardson]

Having the same issue on a MacBook Pro 13-inch (2018).

Is there any further sense of whether this is Apple-intentional, a hardware issue, or a bug?

[phaberest]

I'm on the same boat...did any of you find a solution or workaround to this issue?

[Cfretz244]

I can also confirm this isn't working on the 2018 MacBooks. Unfortunate. It's not like I'm spoofing my MAC all the time, but it can be very situationally useful.

[TkTech]

Can anyone with one of the new macbooks try changing their address to anything with the OUI 88:E9:FE? Ex, 88:E9:FE:AA:AA:AA.

[ben-richardson]

@TkTech Doesn't work. MAC is not changed. Tested on MacBook Pro (13-inch, 2018, Four Thunderbolt 3 Ports).

[TkTech]

@ben-richardson thank you for trying it out, it's very hard to test hardware problems without access to the hardware!

Were the first 3 octets of the interface you tried to change 88:E9:FE originally?

[ben-richardson]

@TkTech Nope. Originally F0:XX:XX…

[TkTech]

@ben-richardson F0:76:6F, F0:24:75, F0:79:60, F0:18:98? (You guys don't need to censor the first 3 octets, they just tell you the manufacturer and are not sensitive, called an OUI)

[ben-richardson]

@TkTech Ha, OK. F0:18:98

[TkTech]

@ben-richardson perfect, can you try changing the address to F0:18:98:AA:AA:AA?

[ben-richardson]

@TkTech Tried, no change. Does not change MAC.

[blaesus]

Same here. My OUI starts with 88:E9:FE. I tried to change only the last byte of MAC and it doesn't work: the same way it failed before, returning without error but the MAC is not changed.

[jonluca]

Could someone on Mojave but with a pre 2018 MBP upload their ifconfig binary?

I doubt there’ll be a difference but it’s best to double check.

[yspreen]

Additional info: I tried changing my (2018) mac address in the last byte only, still does not work. This is not about manufacturer protection.

[halo]

I found a suggestion to determine whether this is a software or a hardware issue:

You could find out by booting from USB other OS, which has MBP2018 LAN card driver.
I would be really suprised to see if hardware chip would not allow to send packet with MAC address other than factory assigned

Could anybody with a 2018 MBP try that? I.e. boot with Tails or Ubuntu or even Windows via Bootcamp and try to change the MAC address there.

[gcpmusic]

No shouldnt be closed as with wired ethernet adapter doesnt work. Please specify on which interface you are commenting. On Wi-Fi always worked on all release. Thank you.

[fborges]

Running MacOS 10.15 on a 15" MBP 2019, not working for me :/

[adudek16]

I was not able to change my MAC with my belkin usb-c ethernet adapter but worked on my hub.

[feross]

I can confirm that changing the Wi-Fi interface MAC address works on a MacBook 13" 2018 with Catalina 10.15.1 (19B88).

[Muhamed-Hamid]

Not working on catalina 10.15.1, was working before the upgrade

[jgtoriginal]

@Muhamed-Hamid it does work on Catalina 10.15.2

[Muhamed-Hamid]

@jgtoriginal This is only on spoof list, if you checked your advanced wifi settings from network you will find the shown mac address, this spoof doesn't change a thing if you really want to be hidden. If something little advanced firewall will detect the real mac address.

I think It needs to be set with ifconfig so it would change the real hardware address.

[gcpmusic]

ifconfig only read or set a fake address. The real hardware address can't be changed and can be read with networksetup -listallhardwareports. If you really want to be hidden, all macaddress must be blocked in the router and to connect, you must use a fake macaddress !!

[Muhamed-Hamid]

ifconfig was able to change the appearing mac address in network settings which reflects over any communications, but now it's not. just masking it out and not reflect over any firewall inspection

[gcpmusic]

Not here on my MacBook, ifconfig still works fine and mask correctly all my macaddress!

[jgtoriginal]

@Muhamed-Hamid It does work, just go to your router or do an nmap on any other device connected to the same network and you will see that the mac address for your computer does change. When you spoof you don't change your physical address, you rather mask it and show a different one.

[gcpmusic]

That's correct.

[total3dx]

@Muhamed-Hamid It does work, just go to your router or do an nmap on any other device connected to the same network and you will see that the mac address for your computer does change. When you spoof you don't change your physical address, you rather mask it and show a different one.

I'm a bit confused, ok, physical MAC won't change. Then what's the point to change MAC in ifconfig at all? Does it mean that whatever I change MAC or not, all routers around still will use my hardware MAC for communications?

[gcpmusic]

No all the call just see ifconfig response. However as I did mention many time early you have to block the real address in your router otherwise it will pass true at boot before you change it !!!
Basically at boot you shouldnt connect at all to the net as your macaddress is blocked in the router and only when you change it you will be able to connect !! both ethernet and wi-fi.

Note: you see your real address just because you own the machine where the macaddress is written on the hardware, that's the reason why cant be changed but everyone outside your computer can only read it by ifconfig or other methods but will only see the fake one!!!

In fact after you spoof it correctly, check your router and you will see the fake one. If not . . you did something wrong!

[joshhunte]

Hello, as you all know this issue was fixed on MBP 2018 with macOS Catalina. However I have now upgraded to MacBook 16 inch and and although I see the value reflected in terminal, it is not being reflected in the software. Note - I see the Mac change reflected on previous MacBook.

[dionhouston]

Apologize in advance if this doesn't apply to this case, but I found this thread when googling my problem. I found on my 2019 mbp that "ifconfig en0 ether ..." didn't work as expected for changing the mac address. Looking into it a bit further, it seems to be a problem with the change of the default shell from bash to zsh. When I went to bash ("sudo /bin/bash") and did the same command it changed the mac as expected...

[harshanand120]

I guess that is because u ran the command without sudo. But when u changed the shell using “sudo bin/bash” all commands after that run as sudo.
Try doing “sudo ifconfig en0 ”.
I have tried doing so on a 16 inch mbp and can confirm it works.

[yusufk]

What's the latest on this?

Doesn't seem to work on 10.15.2..

[onpaws]

I found I had to change ifconfig en0 ether ... to ifconfig en0 lladdr ... to get it working.
Also I had to have the WiFi interface on, which seems wrong but was necessary apparently.

macOS 10.15.3
MBP 16"

[allyoucaneattogo]

again we should open again this issue on Catalina 10.15.4 it doesn't work again

[harshanand120]

I am on MacBook Pro 2018 13 inch. Mac address spoofing still works using "sudo ifconfig en0 ether mac" or "sudo ifconfig en0 lladdr mac" on my machine as well as MacBook Pro 16 inch.

[onpaws]

again we should open again this issue on Catalina 10.15.4 it doesn't work again

Without more specific info and repro steps, "it doesn't work again" is not a productive or helpful comment to anyone on this thread except you.

Next time can you please make the effort to provide a meaningful bug report with specifics? Consider reviewing guides online, for example
https://developer.mozilla.org/en-US/docs/Mozilla/QA/Bug_writing_guidelines

[allyoucaneattogo]

@onpaws Im sorry ill try @harshanand120 solution and if it won't work ill give an bug report

[onpaws]

@onpaws Im sorry ill try @harshanand120 solution and if it won't work ill give an bug report

Good luck! :)

[robbhaker]

Solution: Update to macOS 10.15 Catalina

Updating to macOS 10.15 Catalina appears to fix the issue.

Original report

I cannot randomize any MAC address with spoof-mac. The program returns fine, but the MAC addresses are not changed. I tried changing en0 and en1 and neither took effect. The Node.js spoof doesn't work either.

I tried rebooting or signing in as another user; neither worked.

By the way, sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff doesn't work either.

spoof-mac version: 2.1.1

This is a new machine. I have another Macbook which runs on 10.12, where spoof-mac works just fine.

Thanks for making the tool! It is really helpful.

this is a eye opener.

[Danny-Z]

兄弟们， 我发现这样是可以的
sudo ifconfig en3 ether 9A-44-B4-04-4E-49,
酱紫是不行的 9A:44:B4:04:4E:49

[jorpilo]

I manage to make it work on my Macbook M1...
1- disconnect from the wifi (don't turn the adapter off)
2- generate a mac address like mac_address="$(networksetup -listallhardwareports | awk -v RS= '/en0/{print $NF}' | head -c 8):$(openssl rand -hex 3 | sed 's/\(..\)/\1:/g; s/.$//')"
3- sudo ifconfig en0 ether "$mac_address"
4- networksetup -detectnewhardware
5- Check the spoofed mac with ifconfig en0 | grep ether | awk '{print $2}' and networksetup -listallhardwareports | awk -v RS= '/en0/{print $NF}'