Potential Hack? Strange instance of "Failed to Personalize the Software Update" Error

[MilkandGin]

EDITED TO INCLUDE SCREENSHOT FROM ROUTER/FIREWALL DEVICE, SHOWING STRANGE URLS WHEN I ATTEMPT TO UPDATE MACOS.

Hello all,

I am having what seems to be an unusual case with the "failed to personalize" error when trying to upgrade macOS Ventura. I am running 13.4 (Public Beta) on an M1 MacBook Pro, and I am awaiting a call from Apple to discuss my options. I recognize that as a last resort, I can have the firmware replaced with Configurator. I want to know what your thoughts are as to what happened and whether it can be fixed.

Background.

Shortly after installing macOS 13.4, System Settings said that I had a new update, which was listed as macOS 13.4 (as though I never updated.) I do not recall what caused this to occur or what I was doing when it happened. However, I accepted the new update and it began downloading. There was an issue, however, when it went to attempt to restart my device. I had used Onyx and accidentally turned off the Restart, Shutdown, Logout options in the menu, which apparently is what InstallAssistant uses to restart the device. After about 30-45 minutes, I used 'sudo reboot' in terminal. That restarted my device. However, the update did not 'take.' I was, and am, in an infinite loop of macOS saying there's an update, attempting to download it, and then, as is the case now, giving me an error that the update could not be 'personalized.'

I decided that I was going to repair the installation by reinstalling from Recovery Mode. So, I entered Recovery Mode and started the process. The 'peronalized' error hit me again. It advised that I try again, so I spent about 45 minutes attempting 2-3 more times before Googling the error. Every site had the exact same instructions: try from App Store, try from terminal, try from Safe Boot, turn off VPNs, etc. I did each of these between 2-6 times, each attempt being unsuccessful. I decided to put it off for a couple of days, until yesterday, when I noticed there was some confirmation profile or something that was not appearing in settings but was identified by EtreCheck Pro. (I think it was a Managed Preference that I didn't set up, and in any case, I deleted it.) That didn't work.

Today, I thought I was going to be creative. So, I used createinstallmedia to create a USB installer. I didn't know you couldn't but from a USB installer on an ARM Mac. That didn't work. So I went into regular Recovery Mode, opened terminal, and ran the installer on the USB drive from Recovery Mode on the internal hard drive. It looked like it was going to work, then the same thing. I just spoke with Apple, who advised that I try installing macOS directly on the USB drive, boot from it, erase the internal hard drive, and then reinstall macOS from the USB instance. That didn't work.

The Apple senior technician basically told me that this error is commonly associated with network environments that block certain aspects of the installer from doing its job. I told him I turned off my VPN, and while my router is a firewall device, I turned on Emergency Access for my MacBook Pro, which turns off all rules for that device. That did nothing.

Do any of you have some idea of what could be causing this sort of extreme example of the error and what I need to change about my software or network environment to overcome it? Nothing in the network changed between the last successful update and the current run of unsuccessful ones. I have Little Snitch running, but Little Snitch is set to 'Allow' mode and in either case, both it and the macOS Firewall are not running when macOS is not open, i.e., such as when you're trying to reinstall from Recovery Mode.

I am going to try to connect to my iPhone's hotspot and see if that changes anything. In the meantime, any other thoughts are appreciated.

P.S.,

I am blocking all incoming connections with the macOS. But I just noticed that StartupDiskHelper was listed in the exceptions list. Not sure if I should not be blocking incoming connections or whether I should be removing that from the exceptions. I didn't add it.

Secondly, this is a screenshot from my firewall/router device, showing the network flows for my computer when I attempt to update my computer. I'm not sure what these URLs are, except that at least a few of them do not appear to be registered.

Finally, here's the log from WiFi.log, which also appears strange.

May 14 00:30:03 brains-mbp newsyslog[29906]: logfile turned over Sun May 14 02:20:08.520 Usb Host Notification activated Sun May 14 02:20:08.523 <airport[385]> _initInterface: Unable to initialize unified logger Sun May 14 02:20:08.523 <airport[385]> _initInterface: Unable to initialize unified temp logger Sun May 14 02:20:08.523 <airport[385]> _initInterface: Unable to initialize logger Sun May 14 02:20:08.523 <airport[385]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 02:20:08.523 <airport[385]> _initInterface: Unable to initialize unified temporary logger Sun May 14 02:25:42.738 Usb Host Notification activated Sun May 14 02:25:42.797 <airport[375]> _initInterface: Unable to initialize unified logger Sun May 14 02:25:42.797 <airport[375]> _initInterface: Unable to initialize unified temp logger Sun May 14 02:25:42.797 <airport[375]> _initInterface: Unable to initialize logger Sun May 14 02:25:42.797 <airport[375]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 02:25:42.797 <airport[375]> _initInterface: Unable to initialize unified temporary logger Sun May 14 04:04:42.784 Usb Host Notification activated Sun May 14 04:04:42.806 <airport[415]> _initInterface: Unable to initialize unified logger Sun May 14 04:04:42.808 <airport[415]> _initInterface: Unable to initialize unified temp logger Sun May 14 04:04:42.808 <airport[415]> _initInterface: Unable to initialize logger Sun May 14 04:04:42.808 <airport[415]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 04:04:42.808 <airport[415]> _initInterface: Unable to initialize unified temporary logger Sun May 14 04:10:46.064 Usb Host Notification activated Sun May 14 04:10:46.072 <airport[380]> _initInterface: Unable to initialize unified logger Sun May 14 04:10:46.074 <airport[380]> _initInterface: Unable to initialize unified temp logger Sun May 14 04:10:46.074 <airport[380]> _initInterface: Unable to initialize logger Sun May 14 04:10:46.074 <airport[380]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 04:10:46.074 <airport[380]> _initInterface: Unable to initialize unified temporary logger Sun May 14 04:15:04.621 Usb Host Notification activated Sun May 14 04:15:04.624 <airport[384]> _initInterface: Unable to initialize unified logger Sun May 14 04:15:04.624 <airport[384]> _initInterface: Unable to initialize unified temp logger Sun May 14 04:15:04.624 <airport[384]> _initInterface: Unable to initialize logger Sun May 14 04:15:04.624 <airport[384]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 04:15:04.624 <airport[384]> _initInterface: Unable to initialize unified temporary logger Sun May 14 04:26:14.851 Usb Host Notification activated Sun May 14 04:26:14.864 <airport[422]> _initInterface: Unable to initialize unified logger Sun May 14 04:26:14.867 <airport[422]> _initInterface: Unable to initialize unified temp logger Sun May 14 04:26:14.867 <airport[422]> _initInterface: Unable to initialize logger Sun May 14 04:26:14.867 <airport[422]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 04:26:14.867 <airport[422]> _initInterface: Unable to initialize unified temporary logger Sun May 14 05:11:59.110 Usb Host Notification activated Sun May 14 05:11:59.125 <airport[387]> _initInterface: Unable to initialize unified logger Sun May 14 05:11:59.126 <airport[387]> _initInterface: Unable to initialize unified temp logger Sun May 14 05:11:59.126 <airport[387]> _initInterface: Unable to initialize logger Sun May 14 05:11:59.127 <airport[387]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 05:11:59.127 <airport[387]> _initInterface: Unable to initialize unified temporary logger Sun May 14 05:55:41.540 Usb Host Notification activated Sun May 14 05:55:41.549 <airport[384]> _initInterface: Unable to initialize unified logger Sun May 14 05:55:41.550 <airport[384]> _initInterface: Unable to initialize unified temp logger Sun May 14 05:55:41.550 <airport[384]> _initInterface: Unable to initialize logger Sun May 14 05:55:41.550 <airport[384]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 05:55:41.550 <airport[384]> _initInterface: Unable to initialize unified temporary logger Sun May 14 08:01:37.690 Usb Host Notification activated Sun May 14 08:01:37.695 <airport[384]> _initInterface: Unable to initialize unified logger Sun May 14 08:01:37.696 <airport[384]> _initInterface: Unable to initialize unified temp logger Sun May 14 08:01:37.696 <airport[384]> _initInterface: Unable to initialize logger Sun May 14 08:01:37.696 <airport[384]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 08:01:37.696 <airport[384]> _initInterface: Unable to initialize unified temporary logger Sun May 14 08:07:48.199 Usb Host Notification activated Sun May 14 08:07:48.202 <airport[408]> _initInterface: Unable to initialize unified logger Sun May 14 08:07:48.206 <airport[408]> _initInterface: Unable to initialize unified temp logger Sun May 14 08:07:48.206 <airport[408]> _initInterface: Unable to initialize logger Sun May 14 08:07:48.206 <airport[408]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 08:07:48.206 <airport[408]> _initInterface: Unable to initialize unified temporary logger Sun May 14 08:20:24.994 Usb Host Notification activated Sun May 14 08:20:25.001 <airport[382]> _initInterface: Unable to initialize unified logger Sun May 14 08:20:25.002 <airport[382]> _initInterface: Unable to initialize unified temp logger Sun May 14 08:20:25.002 <airport[382]> _initInterface: Unable to initialize logger Sun May 14 08:20:25.002 <airport[382]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 08:20:25.002 <airport[382]> _initInterface: Unable to initialize unified temporary logger Sun May 14 08:52:41.706 Usb Host Notification hostNotificationUSBDeviceInserted SanDisk 3.2Gen1 isApple N seqNum 1 Total 1 Sun May 14 08:52:41.711 Usb Host Notification Apple80211Set: seqNum 1 Total 1 chg 1 en0 Sun May 14 09:51:07.759 Usb Host Notification hostNotificationUSBDeviceInserted SanDisk 3.2Gen1 isApple N seqNum 1 Total 1 Sun May 14 09:51:07.761 Usb Host Notification activated Sun May 14 09:51:07.765 <airport[403]> _initInterface: Unable to initialize unified logger Sun May 14 09:51:07.766 <airport[403]> _initInterface: Unable to initialize unified temp logger Sun May 14 09:51:07.766 <airport[403]> _initInterface: Unable to initialize logger Sun May 14 09:51:07.766 <airport[403]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 09:51:07.766 <airport[403]> _initInterface: Unable to initialize unified temporary logger Sun May 14 09:51:07.842 Usb Host Notification Apple80211Set: seqNum 1 Total 1 chg 1 en0 Sun May 14 09:51:07.898 Usb Host Notification Error Apple80211Set: Operation not supported seqNum 2 Total 1 chg 1 ap1 Sun May 14 09:51:08.415 Usb Host Notification Error Apple80211Set: Parameter error seqNum 3 Total 1 chg 1 awdl0 Sun May 14 09:51:08.424 Usb Host Notification Apple80211Set: seqNum 4 Total 1 chg 1 en0 Sun May 14 10:00:51.672 Usb Host Notification hostNotificationUSBDeviceRemoved SanDisk 3.2Gen1 seqNum 5 Total 0 Sun May 14 10:00:51.692 Usb Host Notification Apple80211Set: seqNum 5 Total 0 chg 0 en0 Sun May 14 10:00:54.823 Usb Host Notification hostNotificationUSBDeviceInserted SanDisk 3.2Gen1 isApple N seqNum 6 Total 1 Sun May 14 10:00:54.841 Usb Host Notification Apple80211Set: seqNum 6 Total 1 chg 1 en0 Sun May 14 10:27:03.999 Usb Host Notification hostNotificationUSBDeviceInserted SanDisk 3.2Gen1 isApple N seqNum 1 Total 1 Sun May 14 10:27:03.999 Usb Host Notification activated Sun May 14 10:27:04.003 <airport[407]> _initInterface: Unable to initialize unified logger Sun May 14 10:27:04.004 <airport[407]> _initInterface: Unable to initialize unified temp logger Sun May 14 10:27:04.004 <airport[407]> _initInterface: Unable to initialize logger Sun May 14 10:27:04.004 <airport[407]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 10:27:04.004 <airport[407]> _initInterface: Unable to initialize unified temporary logger Sun May 14 10:27:04.060 Usb Host Notification Apple80211Set: seqNum 1 Total 1 chg 1 en0 Sun May 14 10:27:04.097 Usb Host Notification Error Apple80211Set: Operation not supported seqNum 2 Total 1 chg 1 ap1 Sun May 14 10:27:04.531 Usb Host Notification Error Apple80211Set: Parameter error seqNum 3 Total 1 chg 1 awdl0 Sun May 14 10:27:04.538 Usb Host Notification Apple80211Set: seqNum 4 Total 1 chg 1 en0 Sun May 14 10:33:22.866 Usb Host Notification hostNotificationUSBDeviceInserted SanDisk 3.2Gen1 isApple N seqNum 1 Total 1 Sun May 14 10:33:22.866 Usb Host Notification activated Sun May 14 10:33:22.907 <airport[393]> _initInterface: Unable to initialize unified logger Sun May 14 10:33:22.912 <airport[393]> _initInterface: Unable to initialize unified temp logger Sun May 14 10:33:22.948 <airport[393]> _initInterface: Unable to initialize logger Sun May 14 10:33:22.948 <airport[393]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 10:33:22.948 <airport[393]> _initInterface: Unable to initialize unified temporary logger Sun May 14 10:33:23.038 Usb Host Notification Apple80211Set: seqNum 1 Total 1 chg 1 en0 Sun May 14 10:33:23.051 Usb Host Notification Error Apple80211Set: Operation not supported seqNum 2 Total 1 chg 1 ap1 Sun May 14 10:33:23.075 Usb Host Notification Error Apple80211Set: Parameter error seqNum 3 Total 1 chg 1 awdl0 Sun May 14 10:33:23.290 Usb Host Notification Apple80211Set: seqNum 4 Total 1 chg 1 en0 Sun May 14 12:14:57.641 Usb Host Notification hostNotificationUSBDeviceInserted SanDisk 3.2Gen1 isApple N seqNum 1 Total 1 Sun May 14 12:14:57.641 Usb Host Notification activated Sun May 14 12:14:57.647 <airport[385]> _initInterface: Unable to initialize unified logger Sun May 14 12:14:57.647 <airport[385]> _initInterface: Unable to initialize unified temp logger Sun May 14 12:14:57.647 <airport[385]> _initInterface: Unable to initialize logger Sun May 14 12:14:57.647 <airport[385]> _initInterface: Unable to initialize driver message tracer monitor Sun May 14 12:14:57.647 <airport[385]> _initInterface: Unable to initialize unified temporary logger Sun May 14 12:14:57.702 Usb Host Notification Apple80211Set: seqNum 1 Total 1 chg 1 en0 Sun May 14 12:14:57.711 Usb Host Notification Error Apple80211Set: Operation not supported seqNum 2 Total 1 chg 1 ap1 Sun May 14 12:14:58.518 Usb Host Notification Error Apple80211Set: Parameter error seqNum 3 Total 1 chg 1 awdl0 Sun May 14 12:14:58.554 Usb Host Notification Apple80211Set: seqNum 4 Total 1 chg 1 en0

 

[aldiscon]

Did you make any progress on this - I've had this problem with a MacBook Air M1 2020 almost since I got it. I have a feeling it's because I deleted the first account created on the machine and this messed with the Secure Enclave. Apple approved techs haven't been able to help.

 

[MilkandGin]

Did you make any progress on this - I've had this problem with a MacBook Air M1 2020 almost since I got it. I have a feeling it's because I deleted the first account created on the machine and this messed with the Secure Enclave. Apple approved techs haven't been able to help.

I took it into the Apple Store, and they sent it off. They were unable to restore the OS, even using their in-house configuration devices. Apple replaced the SSD, memory, and motherboard.

I have another post that no one will respond to—and one other person had the issue, and not even Apple will respond on the official forums—with a screenshot from an install attempt during November 2022, where the installer log kept saying something like “First color not a match of the second color. This is not an Apple Logo Boot Image. Aborting.” It sounded like it was comparing the color of the logo on the boot image with the expected genuine color and determining that the installer was modified by a malicious actor. The installer log also reported timed advancing of the progress bar on boot, like the progress bar was just a script and not actually documenting the progress of the boot sequence.

So, I think I had a successful rootkit. Hence, Apple’s need to replace the memory, SSD, and motherboard. It was suggested to me they sent it off so they could examine the infection.The folks on here actively attack people for even suggesting that they’re infected with a virus, but when there’s evidence of a genuine infection, they’re silent.

Take it to Apple, not a certified repair facility.

 

[MilkandGin]

P.S., whoever it was also attacked my Ubiquiti Security Cameras. After about three days, I realized that my surveillance cameras were recording and replaying video on a loop. I realized it when, for the third day in a row, my neighbors father carried the same three plastic bins up the stairs, wearing the same clothes. When I spoke to my neighbor, her father had left town to return home two days prior. So, the NVR literally was just copying the video over and over again.

When I checked my cameras and compared the MAC address of the APs they were connected to to the MAC address on the labels on the APs themselves, the MAC address was entirely different. So, I think I was the victim of a proximity/MitM attack. I reset my APs, changed all my passwords, and coincidentally moved out of state. I’ve not had another issue.

I took it into the Apple Store, and they sent it off. They were unable to restore the OS, even using their in-house configuration devices. Apple replaced the SSD, memory, and motherboard.

I have another post that no one will respond to—and one other person had the issue, and not even Apple will respond on the official forums—with a screenshot from an install attempt during November 2022, where the installer log kept saying something like “First color not a match of the second color. This is not an Apple Logo Boot Image. Aborting.” It sounded like it was comparing the color of the logo on the boot image with the expected genuine color and determining that the installer was modified by a malicious actor. The installer log also reported timed advancing of the progress bar on boot, like the progress bar was just a script and not actually documenting the progress of the boot sequence.

So, I think I had a successful rootkit. Hence, Apple’s need to replace the memory, SSD, and motherboard. It was suggested to me they sent it off so they could examine the infection.The folks on here actively attack people for even suggesting that they’re infected with a virus, but when there’s evidence of a genuine infection, they’re silent.

Take it to Apple, not a certified repair facility.