Problems of not doing MAC spoofing on sys-net:
The ISP could collect your real MAC, sell it, or use it for malicious purposes!
The original MAC is associated with whoever bought the PC with the original MAC; therefore, on any network, even when using Qubes OS, without MAC spoofing they will be able to discover who owns that MAC by checking invoices from suppliers, stores, etc… that’s why you need to do MAC spoofing in everything!
Using macchanger on sys-net?
You will have to install macchanger in the standard template that is associated with the disposable vm default-dvm.
Or create a new template (cloning the default), install macchanger in it, add it to sys-net via settings, and create a script in /rw of sys-net to do MAC spoofing every boot!
The problem is having to create more templates, wasting more space, and doing more updates; sys-net already has more programs installed and it increases the attack surface!
Solution: sys-net with MAC spoofing using the standard openssl found on generally every Linux system, and standard in the sys-net template
- Check the MAC of the interface, and this can be either WiFi or Ethernet
nmcli;
echo;
ip a;
Assume enk2s0 is your interface!
In the case of WiFi, sys-net already randomizes the MAC by default! Ethernet does not!
In the script below, replace enk2s0 with your actual interface, whether it’s Ethernet or WiFi if you want to use this as a fallback!
The use of sleep in the script helped sys-net run the MAC spoofing; without it it failed, and with this time interval it started working! Probably because sys-net has only 300 MB of RAM by default!
- In /rw/config/rc.local of sys-net, add
sudo nano /rw/config/rc.local
# Generate a random MAC address
#replace enk2s0 for your interface name
mac=$(openssl rand -hex 6 | sed 's/\(..\)/\1:/g; s/.$//')
echo "Random mac generated: $mac"
sleep 4
sudo ip link set enk2s0 down
sleep 4
sudo ip link set enk2s0 address "$mac"
sleep 6
sudo ip link set enk2s0 up
- If sys-net uses the default-dvm as a disposable VM, because sys-net is a named disposable of it, then you need to modify the /rw/config/rc.local of the disposable VM default-dvm. This can be chosen during installation or done manually!
In default-dvm, modify:
sudo nano /rw/config/rc.local
# Generate a random MAC address
#replace enk2s0 for your interface name
mac=$(openssl rand -hex 6 | sed 's/\(..\)/\1:/g; s/.$//')
echo "Random mac generated: $mac"
sleep 4
sudo ip link set enk2s0 down
sleep 4
sudo ip link set enk2s0 address "$mac"
sleep 6
sudo ip link set enk2s0 up
Restart sys-net and check whether the MAC actually randomized!
Other named disposables that use default-dvm will not be affected, because they use eth0 as the default interface and the script will fail silently and will not perform MAC spoofing in that VM that doesn’t have the enk2s0 MAC. The named disposable will work normally!
But in sys-net that recognizes the enk2s0 interface, it will receive random MAC spoofing on every boot!
Fingerprint in Qubes: hostname is unset (empty), and that can be a problem! Manual solution for certain contexts!
This is a Qubes fingerprint, because by default it doesn’t display the hostname. This is metadata that allows a forensic attacker who has access to your personal router’s logs: if you connect directly to your ISP router or any other external/public network, all devices may have hostnames probably, but with Qubes you won’t — so it becomes inferable that you’re using Qubes, since it’s characteristic of Qubes to use an empty hostname, while most devices have some hostname set by default on the network!
Tails also has a default hostname unset. This is metadata that can be inferred as being Tails or Qubes (or another anonymity OS with the same characteristic)!
This is metadata that can help investigators in researching and correlating certain of your activities in your network or other!
The ideal is to look like the other devices in the network. One solution is:
Qubes with hostname unset, and all other devices in the network also have hostname unset (empty) too, and then you’ll need to configure this manually on all of them (I mean your home network).
Change hostname manually in Qubes to blend in with other devices and look like them!
Alternatively, you can set a hostname in sys-net on each login with:
- Disconnect the Ethernet cable or don’t connect to WiFi. Stay offline, make the hostname change first, then connect!
sudo ip link set enk2s0 down
sudo hostnamectl set-hostname YOUR-CUSTOM-HOSTNAME
sudo hostnamectl status
sudo ip link set enk2s0 up
When using the ip link commands to bring the interface up and down, you may get some command output errors, but in tests it always disconnects and reconnects, and the hostname change still takes effect.
Connect to the internet!
Random MAC + custom hostname in sys-net!
Now the Qubes will also have a hostname that resembles the other devices in the network, avoiding those metadata leaks!
In this case, the ideal is to use the sys-net named disposable, which you can choose during installation, so it will always return to hostname unset when needed again. You’ll just have to restart and you’re done!
Manual Mac Spoofing Using a False Vendor MAC
You need another tool to generate this false vendor MAC using its OUI prefix.
- Create a false vendor mac using other tools
- Use ip link commands to modify
replace by false vendor mac you generate!
sudo ip link set enk2s0 down
sleep 4
sudo ip link set enk2s0 address <FALSE-VENDOR-MAC>
sleep 6
sudo ip link set enk2s0 up
Hostname Randomization on every Random MAC Spoofing
Use a hostname randomization script that follows certain patterns.
However, all computers on the network must follow the same pattern for Qubes camouflaging by using the same hostname randomization algorithm in Qubes!
You need to program/configure every device (smartphones, other PCs with different operating systems, and other Linux machines on the same network as the Qubes) to follow the same pattern of how Qubes does hostname and MAC spoofing!
Use the model hostname-randomization-qubes.sh and set up systemd services, hotplug hooks, etc. to enable it together with the random MAC spoofing.
This is advanced; it may require advanced configuration, and even coding - and it’s up to each person to set it up!
- Create a script called hostname-randomization-qubes.sh and copy it to /home/user/.
This is assuming your /home user is named user.
But if your user is different—e.g., /home/your_username—then change the user variable in the script from /rw/config/rc.local from user to your your_username: - Copy the script to /home/your_username/ and it will be located at /home/your_username/hostname-randomization-qubes.sh
- In /rw/config/rc.local, in the part:
bash /home/user/hostname-randomization-qubes.sh
replace it with:
bash /home/your_username/hostname-randomization-qubes.sh
Script hostname-randomization-qubes.sh for ~/ in your sys-net appvm or default-dvm
#"/bin/bash
#hostname randomization
USED_HOSTNAMES_FILE="/tmp/used_hostnames.txt"
touch "$USED_HOSTNAMES_FILE" 2>/dev/null
# -----------------------------------------
# Function: Generate random character
# -----------------------------------------
rand_char() {
CHARS="$1"
LEN=$(printf '%s' "$CHARS" | wc -c)
[ "$LEN" -eq 0 ] && LEN=1
POS=$((RANDOM % LEN))
printf '%s' "$CHARS" | cut -c$((POS + 1))
}
# -----------------------------------------
# Function: Generate Unique Hostname
# Format: prefix-XXX (e.g., device-aB3, gw-pIZ)
# -----------------------------------------
generate_unique_hostname() {
# Pick random prefix
SELECT=$(( (RANDOM % 4) + 1 ))
case $SELECT in
1) PREFIX="device-" ;;
2) PREFIX="my-dev-" ;;
3) PREFIX="rt-" ;;
4) PREFIX="gw-" ;;
esac
# Generate 3-char suffix
SUFFIX=""
i=1
while [ $i -le 3 ]; do
CASE=$(( RANDOM % 3 ))
case $CASE in
0) CHAR=$(rand_char "abcdefghijklmnopqrstuvwxyz") ;;
1) CHAR=$(rand_char "ABCDEFGHIJKLMNOPQRSTUVWXYZ") ;;
2) CHAR=$(rand_char "0123456789") ;;
esac
SUFFIX="${SUFFIX}${CHAR}"
i=$((i + 1))
done
ANON_HOSTNAME="${PREFIX}${SUFFIX}"
# Check uniqueness (max 50 attempts)
ATTEMPT=0
while grep -qxF "$ANON_HOSTNAME" "$USED_HOSTNAMES_FILE" 2>/dev/null; do
SUFFIX=""
i=1
while [ $i -le 3 ]; do
CASE=$(( RANDOM % 3 ))
case $CASE in
0) CHAR=$(rand_char "abcdefghijklmnopqrstuvwxyz") ;;
1) CHAR=$(rand_char "ABCDEFGHIJKLMNOPQRSTUVWXYZ") ;;
2) CHAR=$(rand_char "0123456789") ;;
esac
SUFFIX="${SUFFIX}${CHAR}"
i=$((i + 1))
done
ANON_HOSTNAME="${PREFIX}${SUFFIX}"
ATTEMPT=$((ATTEMPT + 1))
[ $ATTEMPT -gt 50 ] && break
done
echo "$ANON_HOSTNAME" >> "$USED_HOSTNAMES_FILE" 2>/dev/null
}
# ==========================================
# MAIN EXECUTION FOR DEBIAN
# ==========================================
echo "[*] Generating new random hostname..."
generate_unique_hostname
OLD_HOSTNAME=$(hostname)
NEW_HOSTNAME="$ANON_HOSTNAME"
echo "[+] New hostname generated: $NEW_HOSTNAME"
# -----------------------------------------
# 1. Edit /etc/hostname
# -----------------------------------------
echo "[*] Updating /etc/hostname..."
echo "$NEW_HOSTNAME" | sudo tee /etc/hostname > /dev/null
# -----------------------------------------
# 2. Edit /etc/hosts (only 127.0.1.1 line)
# -----------------------------------------
echo "[*] Updating /etc/hosts..."
sudo sed -i "s/^127\.0\.1\.1\s*$OLD_HOSTNAME/127.0.1.1\t$NEW_HOSTNAME/" /etc/hosts
# -----------------------------------------
# 3. Apply hostname via hostnamectl
# -----------------------------------------
echo "[*] Applying new configuration..."
sudo hostnamectl set-hostname "$NEW_HOSTNAME"
# -----------------------------------------
# 4. Final verification
# -----------------------------------------
sleep 1
echo ""
echo "==================================="
echo "✅ Configuration completed!"
echo "==================================="
echo "Old hostname: $OLD_HOSTNAME"
echo "New hostname: $(hostname)"
echo ""
echo "/etc/hostname:"
cat /etc/hostname
echo ""
echo "/etc/hosts (relevant line):"
grep "127\.0\." /etc/hosts
echo ""
echo "Username (UNCHANGED): $USER"
echo "==================================="
sleep 6
sudo ip link set enk2s0 up
sleep 6
#restarting interface to confirm hostname in the network
#without it, hostname randomization failure sometimes!
sudo ip link set enk2s0 down
sleep 6
sudo ip link set enk2s0 up
Setting /rw/config/rc.local
- em /rw/config/rc.local adicione
sudo nano /rw/config/rc.local
# Generate a random MAC address
#replace enk2s0 for your interface name
mac=$(openssl rand -hex 6 | sed 's/\(..\)/\1:/g; s/.$//')
echo "Random mac generated: $mac"
sleep 4
sudo ip link set enk2s0 down
sleep 4
sudo ip link set enk2s0 address "$mac"
sleep 6
#hostname randomization
bash /home/user/hostname-randomization-qubes.sh
#restarting interface again to confirm hostname in the network
#without it, sometimes hostname randomization failure!
sudo ip link set enk2s0 down
sleep 6
sudo ip link set enk2s0 up
Using only native tools from the default template, default-dvm, and in sys-net, we can do this using configuration only
