App Control: Chrome Updater Not Working
search cancel

App Control: Chrome Updater Not Working

book

Article ID: 286581

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

  • Chrome Updater (Rules > Software Rules > Updaters > Google Chrome) is already enabled.
  • New Unapproved File Events similar to:
    Computer computer discovered new file c:\windows\systemtemp\chrome_unpacker_beginunzipping...\VERSION_chrome_updater.exe [HASH]. DiscoveredBy[Kernel:Create]
  • Block Events similar to:
    File c:\windows\systemtemp\chrome_unpacker_beginunzipping...\VERSION_chrome_updater.exe [HASH] was blocked because it was unapproved.

Environment

  • App Control Server: All Supported Versions
  • App Control Agent: All Supported Versions
  • Microsoft Windows: All Supported Versions

Cause

The Process and File Path combination the Chrome Updater is looking for has changed.

Resolution

This issue is being investigated by Engineering (EP-20312), but in the meantime there are multiple options to workaround this issue:
  • Approve the Publisher, Google LLC in Rules > Software Rules > Publishers.
  • Create a File Creation Control Rule to use while Engineering investigates the issue:
    1. Log in to the Console and navigate to Rules > Software Rules > Custom > Add Custom Rule.
    2.  Use the following details:
      • Rule Name: Temp - Chrome Updater
      • Description: Workaround during EP-20312
      • Status: Enabled
      • Platform: Windows
      • Rule Type: File Creation Control
      • Write Action: Approve as installer
      • Path:
        <Windows>\systemtemp\chrome_*\*chrome_updater.exe
        <Windows>\systemtemp\chrome_*\*chrome_installer.exe
        
      • Process: 
        <ProgramFilesx86>\Google\GoogleUpdater\*\updater.exe
      • User or Group: Local System
      • Policies: Choose relevant Policies
    3. Click Save & Exit

Additional Information

  • In some instances the Chrome updates can be managed via GPO and the path of the new files may differ slightly from the above. 
  • Using the Saved View, New Files (All) in Reports > Events may assist in confirming expected File Paths.
  • File Creation Control Rules require the Agent to observe the Process specified writing files that match the Path specified.
  • Existing files will need to either be rewritten or manually issued a Local or Global Approval.