hoakley Macs, Technology, Updates

Apple has just released updates to XProtect and XProtect Remediator

Apple has just released its regular weekly update to XProtect, bringing it to version 5368 for all Macs, and to XProtect Remediator bringing that to version 170. As usual it doesn’t release information about what security issues these might address.

This version of XProtect adds 9 new Yara rules for MACOS.CHEEKYCOBRA.COSYA, MACOS.CHEEKYCOBRA.PE, MACOS.FLUSTEREDFLAMINGO.STA, MACOS.FLUSTEREDFLAMINGO.UNA, MACOS.FLUSTEREDFLAMINGO.BAA, MACOS.FLUSTEREDFLAMINGO.OPPAA, MACOS.SHADYSHOELACE.CUOSPACO, MACOS.TIMELYTURTLE.MOA and MACOS.TIMELYTURTLE.SWA, and removes the Yara rule for MACOS.DUBROBBER.CHBI. In the Osascript rules in XPScripts.yr, it adds one new rule for MACOS.OSASCRIPT.SHCUPA and amends the rules for MACOS.OSASCRIPT.COTABR, MACOS.OSASCRIPT.COTAAP and MACOS.OSASCRIPT.SYPR.

In XProtect Remediator, the DubRobber scanner has been removed. There have been no changes made to the Bastion rules for the behavioural form of XProtect. Unfortunately, the XProtect app still won’t run manually, either by double-clicking it, or in XProCheck.

In older versions of macOS you can check whether these updates have been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Golden Gate available from their product page. If your Mac hasn’t yet installed these updates, you can force them using SilentKnight or at the command line.

If you want to install these as named updates in SilentKnight, their labels are XProtectPlistConfigData_10_15-5368 and XProtectPayloads_10_15-170

Sequoia, Tahoe and Golden Gate systems only

This XProtect update has already been released for Sequoia and later via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5368 but your Mac still reports an older version is installed, you should be able to force the update using
sudo xprotect update
There are no guarantees whether that will work in Sequoia, though.