4

I received a notification on Big Sur that an extension was updated and this must be authorised in System Preferences. It is 'System software from developer "Apple Inc."'. I find this odd:

  1. I didn't receive any such notification in the past about Apple's own software (although I have occasionally received similar notifications about third party software). I would expect kernel extension updates to only occur via official software updates, which presumably do not require such warnings (or, if anything has changed there, then Software Update process is at least clearly happening rather than silently taking places in the background).

  2. I had not performed an update of any kind immediately preceding this (that I know of).

  3. FortiClient had just run. I believe it does some self-updating. I have a dim view of the software; it is always trying to be invasive and is regularly refused rights for various unnecessary installations of its own.

I see the situation as potentially risky: it is possible that either someone is pretending to be Apple who isn't, or that someone is trying to modify an Apple extension.

How can I find out which extension is being updated and which process initiated this? I did not have much luck looking in Console logs or kext command-line utilities. None of the files in /Library/Extensions or /System/Library/Extensions appear to have been modified recently.

Improve this question

1 Answer 1

Reset to default
2

The name of the software developer and the contents of the kernel extension is cryptographically signed to ensure that it cannot be tampered with. Therefore I do not think it is likely that someone is pretending to be Apple, or that they're trying to modify an Apple extension.

However, I do think it is likely that some software you've installed (presumably FortiClient) has attempted to install an Apple kernel extension. I.e. an authentic Apple kernel extension that either wasn't installed before, or was installed in a version that the software wasn't compatible with - and so that developer has made the software so that it attempts to install the right version of Apple's kernel extension that they want to use.

I wouldn't exactly say that's a good way of doing things - and certainly not without informing the user - but it does sounds like a thing that could happen in practice without it being nefarious.

Improve this answer
2
  • 1
    And is there some way to find out which one, what changed etc.? Commented Feb 8, 2021 at 10:45
  • I too am curious of how to find out what changed. I got an alert and that then took me to the System Preferences "Security & Privacy" with this message "System software from developer Apple Inc. has been updated" at the bottom with an Allow button beside it. I allowed it. But now I'm concerned. How do I know what was installed and if it was actually legit? Why would I have to authorized an Apple extension? Happened after I installed aws's amplify cli using npm which I installed just before. Uncertain if it is related or not. Commented Nov 24, 2021 at 9:45

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.