0

This morning i received this warning from BlockBlock about a new kernel extension being installed. I'm running OS X 10.11.4.

enter image description here I looked up on google and found out that it could be related to a blacklisted ethernet driver. I decided to allow but then i turned off the machine. Could this be some malware or it just an update from Apple?

Improve this question

1 Answer 1

Reset to default
1

Without knowing anything about your machine (i.e. what OS are you on? possibly not El Capitan (OS 10.11.x), but that's an educated guess...) it is difficult to say, BUT Apple would update your computer through the Apple Store, and it would not just dump a Kernel Extension like that. About your Kext there, I would not have a clue, but a quick google does not come up with exctitingly good news. I trust you have a backup of your data.

Improve this answer
4
  • Forgot to mention: I'm on 10.11.4 The article you posted the exact same scenario, in fact i also remember some softwareupdated activity. So, do you think it's safe?
    – Matteo
    Apr 6, 2016 at 10:12
  • I mean, the fact that the update (should) come from Apple is a bit reassuring, however, inside that kext i see a lot of blacklisted kexts from security software like sophos little snitch, hands off, karspersky, maybe they blocked older versions.
    – Matteo
    Apr 6, 2016 at 10:25
  • Did you disable the System Integrity Protection? Assuming you have NOT is should stop the installation of unsigned Kexts. Which does not mean that trusted certificates cannot be stolen and malware pushed on that way...
    – user1256923
    Apr 6, 2016 at 15:37
  • I kept it enabled. By the way, I've just found put that it shouldn't be malicious: twitter.com/objective_see/status/717491496971153409
    – Matteo
    Apr 6, 2016 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .