Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

[Carbon Black Cloud] New macOS sensor file paths beginning in 3.5.1.19

[Carbon Black Cloud] New macOS sensor file paths beginning in 3.5.1.19

Environment

Supported sensor versions: 3.5.1.19 and later
Supported OS versions: macOS 10.12 and later

 

Overview

In the 3.5.1.19 macOS Carbon Black Cloud sensor release, we’ve updated the sensor’s file structure to align with additional notarization guidelines recommended by Apple. 

Pre-3.5.1.19 sensors kept all executables and resources at: /Applications/Confer.app/

3.5.1.19 introduces two main directories for where files are stored:

Sensor resources: /Library/Application Support/com.vmware.carbonblack.cloud/

Sensor executables: /Applications/VMware Carbon Black Cloud/

 

File path changes

Below is a table on where important sensor resources have been moved:

Old Location

New Location

/Applications/Confer.app/uninstall

/Applications/VMware Carbon Black Cloud/uninstall.bundle/Contents/MacOS/uninstall

/Applications/Confer.app/Contents/MacOS/repmgr

/Applications/VMware Carbon Black Cloud/repmgr.bundle/Contents/MacOS/repmgr

/Applications/Confer.app/Contents/MacOS/CbDefense

/Applications/VMware Carbon Black Cloud/CBCloudUI.bundle/Contents/MacOS/CBCloudUI

/Applications/Confer.app/Contents/MacOS/UnInstaller

/Applications/VMware Carbon Black Cloud/UnInstaller.bundle/Contents/MacOS/UnInstaller

/Applications/Confer.app/Contents/MacOS/UpgradeHelper

/Applications/VMware Carbon Black Cloud/UpgradeHelper.bundle/Contents/MacOS/UpgradeHelper

/Applications/Confer.app/version

/Library/Application\ Support/com.vmware.carbonblack.cloud/

/Applications/VMware\ Carbon\ Black\ Cloud/version

 

Labels (1)
Comments

Thanks for this, 

Question : Is there a way to Abstract (go back to Confer.app) the Sensor executables path, or move it out of the Applications root folder?

 

 

Article Information
Author:
Creation Date:
‎12-14-2020
Views:
2320
Contributors