1

I received a notification on Big Sur that an extension was updated and this must be authorised in System Preferences. It is 'System software from developer "Apple Inc."'. I find this odd:

  1. I didn't receive any such notification in the past about Apple's own software (although I have occasionally received similar notifications about third party software). I would expect kernel extension updates to only occur via official software updates, which presumably do not require such warnings (or, if anything has changed there, then Software Update process is at least clearly happening rather than silently taking places in the background).

  2. I had not performed an update of any kind immediately preceding this (that I know of).

  3. FortiClient had just run. I believe it does some self-updating. I have a dim view of the software; it is always trying to be invasive and is regularly refused rights for various unnecessary installations of its own.

I see the situation as potentially risky: it is possible that either someone is pretending to be Apple who isn't, or that someone is trying to modify an Apple extension.

How can I find out which extension is being updated and which process initiated this? I did not have much luck looking in Console logs or kext command-line utilities. None of the files in /Library/Extensions or /System/Library/Extensions appear to have been modified recently.

1

The name of the software developer and the contents of the kernel extension is cryptographically signed to ensure that it cannot be tampered with. Therefore I do not think it is likely that someone is pretending to be Apple, or that they're trying to modify an Apple extension.

However, I do think it is likely that some software you've installed (presumably FortiClient) has attempted to install an Apple kernel extension. I.e. an authentic Apple kernel extension that either wasn't installed before, or was installed in a version that the software wasn't compatible with - and so that developer has made the software so that it attempts to install the right version of Apple's kernel extension that they want to use.

I wouldn't exactly say that's a good way of doing things - and certainly not without informing the user - but it does sounds like a thing that could happen in practice without it being nefarious.

1
  • And is there some way to find out which one, what changed etc.? Feb 8 at 10:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .