unexpected Restart to install update notification (hacking attempt?)

[myotis]

Yesterday, I got a popup notification that my Mac needed a restart to install updates. It looked like an official Mac systems pop up, but there was no option to ask for details on what the update was.

I clicked on the notification to see if it would give me any information but it just asked for my password to authorise the update, before the restart. I cancelled the request for my password, and it all went away ie the popup notification and the password dialogue box. So far it hasn't returned.

I haven't knowingly downloaded any mac updates, but I do have the security and system auto update option ticked.

I have Sophos AV/anti-malware running and I have double checked with the the deep clean option on Clean my Mac anti-malware, and it seems nothing obvious is on my Mac that shouldn't be there.

I've checked in the systems and apple store updates and there is nothing to update other than to Sonoma. I've also checked the security settings in Safari and Chrome on what websites are allowed to push notifications, and only Facebook has permission, which I hadn't realised, but I've left it as is. Maybe I should remove it, as I'm not interested in Facebook notifications.

I'm just a bit suspicious as normally I need to instigate an update, but I wasn't aware that the auto update of security and system updates was ticked, So maybe this has been going on in the background, and this particular update needs authorisation and a restart for some reason. But I would have expected the notification to have had some sort of explanation of what it was or an option to click on a "details" button for more information.

Has anyone any experience of this. Does this seem safe to click and put in my systems password, should it pop up again? If not, what should I be doing to try and sort it out?

Thanks

I'm running the latest version of Monterey 12.7.2

 

[bogdanw]

Maybe it was just Sonoma trying to install itself
https://forums.macrumors.com/threads/ventura-magically-updated-to-sonoma.2416284/

 

[myotis]

Maybe it was just Sonoma trying to install itself
https://forums.macrumors.com/threads/ventura-magically-updated-to-sonoma.2416284/

Thanks, but reading that thread it seems the notification indicated it was Sonoma. There was no indication of what was being updated on my notification.

 

[bogdanw]

If an update was downloaded, it should be in a folder in /Library/Updates/
The softwareupdate.plist files also store relevant information (ProductKeysLastSeenByUser, UserNotificationDate, LastAttemptBuildVersion). To read them from Terminal:

defaults read ~/Library/Preferences/com.apple.preferences.softwareupdate.plist
defaults read ~/Library/Preferences/com.apple.SoftwareUpdate.plist  
defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist

 

[spegahsheen]

..or, if you love the GUI, you can try SilentKnight (from the EclecticLight web site) for automatic checks of firmware and security systems.

 

[myotis]

If an update was downloaded, it should be in a folder in /Library/Updates/
The softwareupdate.plist files also store relevant information (ProductKeysLastSeenByUser, UserNotificationDate, LastAttemptBuildVersion). To read them from Terminal:

defaults read ~/Library/Preferences/com.apple.preferences.softwareupdate.plist
defaults read ~/Library/Preferences/com.apple.SoftwareUpdate.plist 
defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist

Thanks again.

I've attached screenshots of the information you suggested looking at.

I'm not sure how to interpret the files in the update folder. Does this suggest outstanding updates, or these particular files serving some other purpose?

But the plist info seems to show my 12.7.2 update from a couple of weeks ago and a background update this morning.

Given the odd things happening with the Sonoma upgrade, Is it possible that today's background update might be linked to my update notice yesterday?

 

[MBAir2010]

Yep since Sunday Sonoma auto updated on many Macs
i dont have the actual numbers but this seems to be a problem or a revelation ro some users here.

personally I would be very upset if MY Macs went from Monterey to sonoma
since they are MY Macs.

 

[myotis]

Yep since Sunday Sonoma auto updated on many Macs
i dont have the actual numbers but this seems to be a problem or a revelation ro some users here.

personally I would be very upset if MY Macs went from Monterey to sonoma
since they are MY Macs.

Totally off topic, but my windows laptop went from Win 8 to Win 10, after I had refused the update.

I had to wait for it to complete and then run the roll back, but the roll back told me that the rollback files had been deleted. I then discovered my laptop wasn't compatible with WIN 10 and it's never worked properly since. It does work however, others I was aware of, with the same model of Laptop, were left with completely unusable laptops.

 

[bogdanw]

052-25575 is the XProtectPayloads_10_15 pkg
https://swcdn.apple.com/content/dow...3pab02y84jyiwrtjdy/XProtectPayloads_10_15.pkg

XProtect "macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware."
https://support.apple.com/guide/security/sec469d47bd8/web

XProtect is part of "Install system data files and security updates - Have your Mac install system files and security updates automatically."
https://support.apple.com/guide/mac-help/mchla7037245/12.0/mac/12.0

If you are connecting your iPhone/iPad to your Mac, you should install the MobileSoftwareUpdate listed.
You can start that update by opening /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/MobileDeviceUpdater.app
or by downloading and installing the packages

https://swcdn.apple.com/content/dow...i7hh52r8d5lz6oj7e4rp/MobileDeviceOnDemand.pkg

https://swcdn.apple.com/content/dow...jx4lvsm1bhvi7hh52r8d5lz6oj7e4rp/CoreTypes.pkg

 

[myotis]

052-25575 is the XProtectPayloads_10_15 pkg
https://swcdn.apple.com/content/dow...3pab02y84jyiwrtjdy/XProtectPayloads_10_15.pkg

XProtect "macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware."
https://support.apple.com/guide/security/sec469d47bd8/web

XProtect is part of "Install system data files and security updates - Have your Mac install system files and security updates automatically."
https://support.apple.com/guide/mac-help/mchla7037245/12.0/mac/12.0

If you are connecting your iPhone/iPad to your Mac, you should install the MobileSoftwareUpdate listed.
You can start that update by opening /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/MobileDeviceUpdater.app
or by downloading and installing the packages

https://swcdn.apple.com/content/dow...i7hh52r8d5lz6oj7e4rp/MobileDeviceOnDemand.pkg

https://swcdn.apple.com/content/dow...jx4lvsm1bhvi7hh52r8d5lz6oj7e4rp/CoreTypes.pkg

Thanks, but can you expand on this. I'm not sure what I should be getting from this.

As I said I already have auto install system data files and security updates activated, it looks as if xprotect should be running by default. Or are you suggesting, it isn't auto installed, and I should install it.

If so, is this in addition to SophosAV/malware protection and Clean My Mac Malware protection, or instead of.

Or as another option are you suggesting the update this morning was related to Xprotect updating itself.

 

[bogdanw]

Or as another option are you suggesting the update this morning was related to Xprotect updating itself.

Yes, XProtect was updating and, as the pkg is no longer in the folder, appears to have been updated.

 

[myotis]

Yes, XProtect was updating and, as the pkg is no longer in the folder, appears to have been updated.

Thanks, this is all useful information, as I didn't know about this, but where does this leave me with the issue from yesterday. The notification to restart to install an update that asked for my password.

It hasn't re-appeared, so I suspect that it has either "gone" or is waiting for me to restart to reactivate it.

I suppose I need to pluck up the courage to restart. Given I didn't fill in my password, I am assuming it will be safe to restart the computer.

 

[bogdanw]

To my knowledge, XProtect updates should not require a password to install, they should be installed automatically by the system.

Maybe it was asking for permission to install the MobileDevice update.

If you don’t have the Install macOS Sonoma app in your /Application folder, you can safely restart

 

[myotis]

To my knowledge, XProtect updates should not require a password to install, they should be installed automatically by the system.

Maybe it was asking for permission to install the MobileDevice update.

If you don’t have the Install macOS Sonoma app in your /Application folder, you can safely restart

Well, I have restarted and that's nearly an hour and no pop up notifications so far. I've also run a Clean My Mac deep scan for Malware and it's come back clean.

Hopefully, the issue has been resolved. Thanks for your help, I would have been a bit lost without it.