I know that Tor is used for anonymity while browsing in the Internet. I heard that by using Tor, it is possible to hide my IP. But is it possible to hide my MAC address also?
The MAC address is only visible on your local network. You don't need to hide it.
With Tor or without Tor, as soon as the packet reaches your default gateway, that computer sitting between you and the next network segment, your MAC cannot be seen anymore.
But if someone tries very hard to trace you, a special crafted website can get your MAC by exploiting your browser, executing some commands on your computer and get all kinds of information from the computer.
But this does not have anything to do with Tor nor no-Tor nor MAC address.
If you want to add another layer of security, try using Whonix Linux. It's a two-server solution running on virtual machines: the gateway and the workstation. The gateway connects to Tor, and creates a local network routing everything over Tor. The workstation only have access to the gateway, so even if someone exploits the workstation, he will see a local IP address, a virtual MAC, a virtual HDD, and no information on your physical hardware.
TLDR; It's possible to mask your MAC address, but it's still broadcast in plain text to anyone local to your network
It's not really possible to "hide" a MAC address. The MAC address is used to determine where to deliver the actual packets, if you remove it from the packet, the router has no way of knowing where to deliver the packet.
Think of it like a paper letter. If you remove or "hide" the address, how does the postman know where to deliver the letter?
Similarly, it's not really possible to hide an IP address. The way tor accomplishes this is to forward the request and reply through several layers of encrypted communications. The gamble is that any attacker won't control enough tor relays to be able to decrypt the entire message. If you, as an attacker, controlled the whole tor network, you would be able to read any message passed between relays.
The same concept will protect your MAC address from anyone on the Tor network, or the website administrator. It will not protect you from anyone on your local network.
Actually even without tor, your MAC address will not be leaked beyond your local network. Your local router will perform NAT on any requests which will have the effect of not leaking your MAC address to the greater internet. In TCP/IP, the MAC continually changes as it is rewritten by every hop it goes through.
It is not impossible. Theoretically it should not, but in practice it can:
3. The XSS obtains the MAC address of the router via AJAX. 4. The MAC address is then sent to the malicious person. In the test case below, it's sent to me (not that I'm malicious!)
this works with the Verizon FiOS routers, but it may be possible to find ways to do it with other routers.