However, the timing of the last XProtect update didn’t line up with the very sudden and widespread emergence of the issue.
#Hp mac printer drivers software#
(XProtect is a basic form of anti-malware protection built into macOS, which aims to prevent malicious software from running.) The thought was that this was a false positive in other words, XProtect was erroneously detecting legitimate files as malicious. Initially, there was a lot of finger pointing at a recent XProtect update. Samples of the software that we obtained appeared to be legitimate, with no signs of malicious behavior. The messages generally appeared when people were trying to print to their HP printers. However, we noticed that this “malware” was all (mostly*) related to HP printing drivers. The “malware” was being reported by the built-in anti-malware features in macOS, and there were a dozen or more different processes that macOS claimed “will damage your computer,” with a check box reading “Report malware to Apple to protect other users.” Sounds pretty scary, right? As we dug into the issue, however, we saw that there was a pattern in the screenshots we were seeing.
Last Thursday evening (October 22), we started seeing an influx of support requests from people complaining about some new malware that we weren’t detecting. The certificates used by HP are no exception. The certificates used to sign software on macOS (and iOS, for that matter) are provided and managed by Apple.
#Hp mac printer drivers drivers#
HP makes printers, and thus makes print drivers, and of course those drivers are signed, as they should be.
This obviously applies to apps you download from the Internet or the App Store, but it also applies to more prosaic software, such as print drivers. Your software will also probably just get deleted by many people. As a developer, if you don’t sign your Mac software, your users will have trouble running it, and you (or your support staff) will get countless help inquiries. In recent years, Apple has done more than just support code signing… it’s come as close as is reasonably possible to requiring code signing. This allows the system, and the user, to verify which developer created the software, and check that it hasn’t been modified since it was created. Code signing involves using a certificate to cryptographically sign a piece of software. For quite a few years now, Apple has supported what is called “code signing” on macOS. How does this relate to Apple and HP, you ask? Good question. Not many people actually look at these certificates, of course, but doing so is a sure-fire way to avoid a phishing site. For example, when you try to connect to your bank site, the site’s certificate will verify that the site really does belong to your bank. With web traffic, these certificates are used to encrypt the data, but they support more than just encryption.Ĭertificates also allow for validation. Code signing and certificatesįirst, it’s important to understand that when I say “keys,” what I really mean is “certificates.” These certificates are similar to the ones that are the basis for secure communication between a web server and your browser. This is a story of those keys, and how a Hewlett Packard (HP) error caused problems for a lot of people. Apple holds the keys to nearly all recent Mac software.
0 kommentar(er)
