VMs' Virtual MAC Address

General Discussion
1

All VMs (qvm-prefs) in Qubes use the same MAC address, 00:16:3E:5E:6C:05, with eth0! Is that a risk, a fingerprint, or neither?

If all the Qubes systems being used around the world use the default MAC address 00:16:3E:5E:6C:05 and do not randomise the MAC address for each internal AppVM in Qubes, then there is no issue with that. But imagine that you were the only person using the MAC address 00:16:3E:5E:6C:05: in certain contexts, you could potentially be deanonymised because of the MAC address, even though it is a fake, random MAC address!

See:

You use an AppVM where you used your real, public email address — the one that identifies you, which you use for shopping, your social media accounts, and so on — and that AppVM with the MAC address 00:16:3E:5E:6C:05 was compromised.

If the same attacker — advanced government hackers — compromises the anonymous appvm Anon-whonix where you are using an anonymous forum profile, and it has the MAC address 00:16:3E:5E:6C:05, this does not deanonymise you because all Qubes systems around the world use 00:16:3E:5E:6C:05 by default!

But what if everyone using Qubes is randomising the MAC address of each AppVM?

They could do this when creating each VM or template:

qvm-prefs appvm1 -s mac AC:4B:F0:33:D1:80
qvm-prefs appvm2 -s mac 70:2C:9E:DF:0C:C3
qvm-prefs appvm3 -s mac 4C:47:DD:79:99:10
qvm-prefs appvm4 -s mac D0:60:4F:4C:61:B3
qvm-prefs template1 -s mac 74:D2:A7:6D:DD:AB
qvm-prefs template2 -s mac A8:BC:AB:94:A4:7C
qvm-prefs template3 -s mac 70:5F:87:7C:CA:C5

The question is: if all Qubes users are doing this, would anyone who does not do it stand out and be deanonymised in the context explained above? It is an advanced attack, but it is feasible for intelligence agencies, sophisticated spyware companies, and even Big Tech companies!

Would it be better hardening to change the MAC address of each VM and template so that they are different? Or would that make things worse and cause you to stand out?

It seems better to look like the majority. Presumably, most Qubes users will use this same MAC address for all the AppVMs and templates they use with eth0, which by default uses the MAC address 00:16:3E:5E:6C:05. That is what it appears to be, because most people do not know how to use Qubes properly and have no idea about what I am discussing here!

Joanna wrote this document, and she shows this MAC address as well:

See this section:

[joanna@dom0 ~]$ qvm-prefs my-new-vm-copy -s mac 00:16:3E:5E:6C:05
[joanna@dom0 ~]$ qvm-prefs my-new-vm-copy

This MAC address, 00:16:3E:5E:6C:05, appears to have been the default in Qubes OS for a long time!

What do people think?

1 Like
2

Well, eth0 - is just the interface a qube uses when having no own physical interface and using the network provided by another qube.

In that regard, the mac is only available internally.

The mac seems to be relative similar for each qubes install.

→ no issue

3 Likes
3

It will not de-anonymize you, common mac, plus stays internal.

1 Like
4

It’s 00:16:3E:5E:6C:00.

Sure, but almost all people aren’t randomizing this internal MAC address. So…

The latter. You’d be trying to prevent standing out from a hypothetical user base due to a canonical 00:16:3E:5E:6C:00 MAC address, but end up standing out from the actual user base due to a custom MAC address. (Even if it’s a different one in each of your VMs, they nevertheless share the commonality of not being the canonical one.)

2 Likes