Carbon Black Cloud: USB With NTFS File Format Is Not Blocked When Inserted In MAC OS

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• USB stick file format is changed to NTFS using Windows machine.
• The USB stick is not being blocked when connected on a macOS.

Environment

• Carbon Black Cloud MAC Sensor: 3.5.3.82 - 3.6.0
• Supported macOS: 10.15 and 11+ 

Cause

Limitation reporting the device is not mountable - DSEN-15365

Resolution

Upgrade to sensor version 3.6.1

Additional Information

The USB device with other file formats like MS-DOS (FAT), ExFAT, or Mac OS Extended will be blocked when connected to the MAC OS