App Control: Blocks on Files Related to Publisher Google LLC

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Blocks similar to the following are reported by Agent: 

Computer discovered new file c:\users\glachnitt\appdata\local\google\chrome\user data\swreporter\37.188.202\software_reporter_tool.exe  Publisher[Google LLC (EligibleForApproval)]

File 'c:\windows\ccmcache\5\googlechromestandaloneenterprise64.msi' was blocked because it was unapproved. Publisher[Google LLC (EligibleForApproval)]

 

 

Environment

• CB Protection Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

Google has changed their certificate from Google Inc to Google LLC for this file.

Resolution

1. Login to the CB Protection console
2. Navigate to Rules > Software Rules > Publishers tab
3. Find and select "Google LLC"
4. Click Action > Approve

Additional Information

• Carbon Black will be modifying the Google Chrome updater in the near future. This is tracked under "EP-7690".
• Optionally an allow execution rule with the file path and process path can be created if desired.