hoakley March 19, 2024 Macs, Technology, Updates

Apple has just released updates to XProtect and XProtect Remediator

Apple has just released updates to XProtect Remediator security software (Catalina or later), bringing it to version 129, and to XProtect (for all macOS from El Capitan or so) bringing it to version 2190.

Apple doesn’t release information about what security issues these updates might add or change. However, XProtect’s Yara definitions include amendments to the signatures for MACOS.SOMA.D and MACOS.SOMA.F, although there are no new rules added. No new scanning modules are added to XProtect Remediator, nor are there any changes to Bastion rules for the behavioural version of XProtect (Ventura and Sonoma only).

You can check whether these updates have been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan to Sonoma available from their product page. If your Mac has not yet installed these updates, you can force them using SilentKnight, LockRattler, or at the command line.

If you want to install these as named updates in SilentKnight, their labels are XProtectPayloads_10_15-129 and XProtectPlistConfigData_10_15-2190.

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

I maintain lists of the current versions of security data files for Sonoma on this page, Ventura on this page, Monterey on this page, Big Sur on this page, Catalina on this page, Mojave on this page, High Sierra on this page, Sierra on this page, and El Capitan on this page.

24Comments

Add yours

1

artiste212 on March 19, 2024 at 8:01 pm
Reply

I believe there was a bug in the security software as I’d been having reports of NO XProtect Remediator scans since the last update. After installing the new software just now, I see “46 scans, 0 alerts, 0 warnings.” I don’t think those scans were all performed in the previous 15 seconds.

LikeLiked by 1 person
- 2
  
  hoakley on March 19, 2024 at 8:09 pm
  Reply
  
  XPR scans can all be completed in less than 5 seconds. 46 scans is 2 sets of 23, that’s one set run as user, and one as root. So I don’t see any reason to doubt what you see.
  Howard.
  
  LikeLike
  - 3
    
    artiste212 on March 19, 2024 at 8:23 pm
    Reply
    
    So if they were run immediately after the XP Remediator and XProtect were intalled, I’d suspect they were all run because no scans had been run for a few days. Not running any scans for a few days is a rarity in recent weeks, so perhaps Apple updated their software because scans weren’t being run regularly.
    
    Of course, I’m probably in a situation analogous to men in ancient times, observing the heavens and ascribing events they saw to all sorts of causes unrelated to reality. LOL
    
    LikeLiked by 1 person
    - 4
      
      hoakley on March 19, 2024 at 8:43 pm
      
      The way that XPR normally runs is to pick a moment when your Mac’s not busy, not asleep, but running idle, and run its scans then. It will try to run them again in around 24 hours. If your Mac’s not available at that time, then it will postpone its scans, and it can easily end up leaving them for well over 24 hours if the conditions aren’t right. That’s nothing to worry about – the frequency and timing aren’t critical.
      Sometimes, when XPR is updated, it retimes is daily scans, and that can throw its previous schedule out. Eventually it will settle back to catching your Mac at the right time of day, and scanning fairly regularly then.
      Howard.
      
      LikeLiked by 1 person
5

Harold on March 19, 2024 at 8:20 pm
Reply

Does it matter to the security of say, Mojave, if the Xprotect update is installed and if the use of Mojave is basicallly limited to internal applications and not much with any internet activity per browsers?

LikeLiked by 1 person
- 6
  
  hoakley on March 19, 2024 at 8:39 pm
  Reply
  
  Good question, and not an easy answer.
  XProtect updates remain valuable to you, as macOS will use those to provide better protection when your Mac runs apps, even if they’re old and familiar. So it’s still worth keeping up to date with them.
  I think you have to accept that a Mac running Mojave will never be as secure as one running Sonoma. But the greatest risk isn’t so much in macOS, it’s what you do. If you do risky things online, then Mojave isn’t a good idea because of its weaknesses. However, if you’re cautious, as you say, there’s no reason why you should have any problems. So more of the burden is on you – but I’m sure you’ll be wise and careful.
  Howard.
  
  LikeLiked by 1 person
7

dafoxe1 on March 19, 2024 at 8:24 pm
Reply

Curiously, SilverKnight v1.21 running on High Sierra on my 11″ MacBook Air states “no updates” despite showing XProtect 2189 with a red X and the main dialog box saying “XProtect 2189 should be 2190”

LikeLiked by 1 person
- 8
  
  hoakley on March 19, 2024 at 8:47 pm
  Reply
  
  Remember that it gets its version info from the database that I maintain independently of Apple. So it will see that version change once I update the database.
  Your local software update server may not have those updates yet, or they may be too busy to accept another connection. So I’d leave it an hour or two before trying again.
  If you get an error, or can’t find the update after a day, then I recommend you contact Apple Support. I’m aware of some running older macOS who seem to have been having problems getting these updates recently. Apple Support is the only way to take that further, if your Mac is so affected.
  Howard.
  
  LikeLike
  - 9
    
    dafoxe1 on March 19, 2024 at 9:20 pm
    Reply
    
    Yes, thanks. All my other Macs running Monterey and Sonoma updated just fine prior to trying my old 11″ MacBook Air. I’ll wait another day in case its a priority issue or possibly tied to also updating XPR which High Sierra doesn’t have.
    
    LikeLiked by 1 person
  - 10
    
    dafoxe1 on March 20, 2024 at 3:23 pm
    Reply
    
    SilientKnight 1.21 still says “no updates” and the command “softwareupdate -l” with or without “sudo” in Terminal returns “No new software available.” Perhaps Xprotect 2190 contains something that can’t run on High Sierra. I’ll check with Apple Support.
    
    LikeLiked by 1 person
    - 11
      
      hoakley on March 20, 2024 at 8:11 pm
      
      I’m sorry. I wish you success with Apple Support.
      Howard.
      
      LikeLike
- 12
  
  Christian on March 19, 2024 at 8:47 pm
  Reply
  
  Same thing here in Mojave. Maybe we have to wait till tomorrow? 🤔
  
  LikeLiked by 1 person
13

cruzer3115 on March 20, 2024 at 3:12 am
Reply

Howard, like artiste212, SkintM has been reporting XPR scans not running (fixed by using XProCheck). This happens every couple of days. My M1 MacBook Pro is always left plugged in and running overnight. All software is up to date as reported by SilentKnight. I there anything I can do to get XPR to run normally?

LikeLiked by 1 person
- 14
  
  hoakley on March 20, 2024 at 7:52 am
  Reply
  
  Leave it alone. XPR is designed to run at approximately 24-hour intervals. It will be despatched when your Mac is ready. If it doesn’t, then you need to look at the DAS-CTS scheduling and despatch system, which is complicated, but Mints provides a readymade log feature to do so.
  Howard.
  
  LikeLiked by 1 person
  - 15
    
    cruzer3115 on March 20, 2024 at 6:20 pm
    Reply
    
    Thanks, Howard. OK, I’ll leave it for a while longer then, if nothing changes, explore using Mints.
    
    I truly value the information in your blog posts. Without this and the tools you provide I would be totally out of my depth with all this stuff.
    
    LikeLiked by 1 person
    - 16
      
      hoakley on March 20, 2024 at 8:15 pm
      
      Thank you. I wish you success.
      Howard.
      
      LikeLiked by 1 person
17

David Ryeburn on March 20, 2024 at 3:51 am
Reply

For some time my old iMac (incapable of running operating systems more recent than 10.13 High Sierra because of video circuitry limitations) has refused under 10.13 to download or install the latest versions of XProtect even though both SilentKnight and LockRattler tell me a newer version is available. To get around this I have re-booted into 10.12 Sierra where either one of these is willing to download the latest XProtect version. The installer files wind up inside Library/Updates and I then run XProtectPlistConfigData_10_14.pkg repeatedly to install the latest XProtect software for both my 10.12 and 10.13 partitions. All this has worked smoothly for the last half year or so ever since SilentKnight and LockRattler both failed to do the job under 10.13, up until and including XProtect 2189. After doing this, SilentKnight and LockRattler indicate that the version of XProtect is current. So today I tried to get 2190 this way and both SilentKnight and LockRattler failed to do so under 10.12, telling me no update was available (having already told me that 2189 should be 2190). Can you look inside your copy of the 2190 software and tell me if it will not work under 10.12 (which would perhaps explain this)?

LikeLiked by 1 person
- 18
  
  hoakley on March 20, 2024 at 8:03 am
  Reply
  
  XProtect updates don’t include any executable code, so they aren’t limited by macOS version at all. All the installer does is install the new bundle containing property lists, and the Yara file, in the right place.
  I’m not clear by what you write as to what is going wrong here.
  SilentKnight asks Apple’s software update servers, using the softwareupdate command tool, whether there are any updates available for your Mac. That’s the only way to obtain these updates unless you’re an Enterprise customer, who can download them from the Enterprise SUS (which is more complicated than it sounds).
  If SilentKnight reports that no updates are available, there’s no way to download them, as the server will simply report the requested update isn’t available, something you can test using SK’s Install named update feature.
  You appear to have changed SK’s settings so that it doesn’t download and install updates, but only downloads them, and leaves you to install them. That doesn’t alter the availability of updates, though.
  If your Mac is falling out of date with XProtect updates, then I suggest the best folk to take this to are Apple Support. I’m afraid I have no control over Apple’s software update servers or service – only Apple does.
  Howard.
  
  LikeLike
19

Christian on March 20, 2024 at 11:02 pm
Reply

When I was still using El Capitan, 3 or 4 years ago, the OS was unable to see XProtect updates — but I was able to DL XProtectPlistConfigData_10_14.pkg under 10.14 and then to apply it in 10.11.
I wouldn’t be surprised that the same thing is happening today with MacOS versions prior to 10.15 or 11.0 not seeing XProtect updates any more…
The future will tell. 😉

LikeLiked by 1 person
- 20
  
  hoakley on March 21, 2024 at 9:32 am
  Reply
  
  I think this is a matter for Apple Support.
  Howard.
  
  LikeLike
21

dafoxe1 on March 25, 2024 at 11:03 pm
Reply

XProtect 2190 is finally available today for High Sierra.

LikeLiked by 1 person
- 22
  
  hoakley on March 26, 2024 at 11:46 am
  Reply
  
  Hooray! I think Apple fixed the software update server to deliver it for you.
  Howard.
  
  LikeLike
  - 23
    
    dafoxe1 on March 26, 2024 at 3:44 pm
    Reply
    
    I’m very thankful that my 11″ MacBook Air 4,1, while stuck on High Sierra, still works as well as it did back in 2011, nearly 13 years ago. The other software like MS Office surprisingly works well, too. However, since I’m more or less retired and don’t do much heavy typing on the road, I mostly use my still-supported 2018 11″ iPad Pro when traveling. Apple’s equipment is outstanding!
    
    LikeLiked by 1 person
    - 24
      
      hoakley on March 26, 2024 at 5:40 pm
      
      That MBA is doing well!
      Howard.
      
      LikeLike