Chrome Updater Not Working

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Chrome Updater (Rules > Software Rules > Updaters > Google Chrome) is already enabled.

New Unapproved File Events similar to:

Computer computer discovered new file c:\windows\systemtemp\chrome_unpacker_beginunzipping...\VERSION_chrome_updater.exe [HASH]. DiscoveredBy[Kernel:Create]

Block Events similar to:

File c:\windows\systemtemp\chrome_unpacker_beginunzipping...\VERSION_chrome_updater.exe [HASH] was blocked because it was unapproved.

Environment

App Control Server: All Supported Versions
App Control Agent: All Supported Versions
Microsoft Windows: All Supported Versions

Cause

The Process and File Path combination the Chrome Updater is looking for has changed.

Resolution

This issue was tracked under EPCB-20312 and resolved with the release of Rules Installer 1.28. Upgrading to Rules Installer 1.28 (or higher) and verifying the Chrome Updater is Enabled will prevent future files being written as Unapproved.

In the meantime the following steps will be required:

Existing files will need to be retroactively issued Local Approvals.
An alternative Approval Method can be used
1. Approve the Publisher, Google LLC in Rules > Software Rules > Publishers.
2. Create a File Creation Control Rule to use while Engineering investigates the issue:
  1. Log in to the Console and navigate to Rules > Software Rules > Custom > Add Custom Rule.
  2. Use the following details:
    - Rule Name: Temp - Chrome Updater
    - Description: Workaround during EP-20312
    - Status: Enabled
    - Platform: Windows
    - Rule Type: File Creation Control
    - Write Action: Approve as installer
    - Path:
```
<Windows>\systemtemp\chrome_*\*chrome_updater.exe
<Windows>\systemtemp\chrome_*\*chrome_installer.exe
<Windows>\systemtemp\chrome_*\updatersetup.exe
<Windows>\systemtemp\chrome_*\qualification_app.exe
```
    - Process:
```
<ProgramFilesx86>\Google\GoogleUpdater\*\updater.exe
```
    - User or Group: Local System
    - Policies: Choose relevant Policies
  3. Click Save & Exit

Additional Information

In some instances the Chrome updates can be managed via GPO and the path of the new files may differ slightly from the above.
Using the Saved View, New Files (All) in Reports > Events may assist in confirming expected File Paths.
File Creation Control Rules require the Agent to observe the Process specified writing files that match the Path specified.
Existing files will need to either be rewritten or manually issued a Local or Global Approval.