Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Cb Defense: Why do I Need to Re-approve Kext After Upgrading to Mac Sensor 3.1.x.x and Higher?

Cb Defense: Why do I Need to Re-approve Kext After Upgrading to Mac Sensor 3.1.x.x and Higher?

Environment

  • Cb Defense Sensor: Mac Version 3.1 and Higher
  • Mac OS 10.08 - 10.14
  • Installed Mac Sensor 3.0 and approved KEXT
  • Upgrading to Mac Sensor 3.1 and Higher and receiving prompt to re-approve KEXT

Question

Why does upgrade of Cb Defense Sensor from version 3.0.x.x to 3.1.x.x and higher require re-approval of the Cb Defense KEXT?

Answer

The Developer ID used to code sign the 3.1 Sensor was updated from the Developer ID used to code sign the 3.0 Sensor.

3.0.x.x and lower:
Team ID: JA7945SK43
Kext Bundle ID: com.confer.sensor.kext
3.1.x.x and higher:
Team ID: 7AGZNQ2S2T
Kext Bundle ID: com.carbonblack.defense.kext

 

Additional Notes

  • For apps that are downloaded from places other than the Mac App Store, developers can get a unique Developer ID from Apple and use it to digitally code sign their apps
  • The Mac 3.0 Sensor is signed by a Confer subsidiary, Scargo Inc. (Confer is likewise a subsidiary of Carbon Black)
  • The MAC 3.1 Sensor is signed by Carbon Black

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-28-2018
Views:
998
Contributors