Just checked, it seems that the latest updates for MRT and XProtect have been installed twice, on April the 1st. I so this in System Information. It seems there are double receipts for each one. I wonder if they are compromised. I use the app Silent Knight to check and install updates for MRT and XProtect, because I can see the update, macOS installs them in the background.
Lotusisrael wrote:
Just checked, it seems that the latest updates for MRT and XProtect have been installed twice, on April the 1st. I so this in System Information. It seems there are double receipts for each one. I wonder if they are compromised. I use the app Silent Knight to check and install updates for MRT and XProtect, because I can see the update, macOS installs them in the background.
If they are compromised, it must have been your 3rd party software that is interfering with it. You don't need any extra help to install security updates. Just leave software update settings at their default values and don't run any 3rd party software that interferes.
I had issues in the past, precisely because those security components install in the background. They installed faulty. So this is why I use that software, as a GUI for updating them. This has not happened before.
I am running macOS 11.2.3 with √ Install system data files and security updates in Software Update > Advanced. I have never had previous to Big Sur or at any time since its installation any redundant or faulty installation of MRT or XProtect data. My money is on something that you have installed that is interfering with this normal installation process.
Back in the day, I was using a re-packaging of MPlayer, a media player with most codec formats support, better then VLC. It need pre-compilation of something, in order to work. I opened it during a software update, when XProtect was updating, and that broke XProtect. I had to reinstall macOS back then. Now, MPlayer no longer being developed, I use a re-packing of MPV Player, a fork of MPlayer. Yet, that issue made me realise that updating XProtext, Gatekeeper and MRT can go wrong and this is why I want to get more control into the process. After discovering Silent Knight, I have used it to see the updates when available and install them on demand.
By the way, I looked again, only XProtect seems to have been double installed.
Under normal circumstances, XProtect runs under Apple's own entitlements, which are higher than anything else. You would have to make significant configuration changes to break this. However, you were well into the "grey market" there. Such apps often require those exact configuration changes in order to run. One well-known MPlayer version is actually a malware distribution platform. So the more likely explanation is that you corrupted your operating system first, and then the security protections failed. That is generally the weak spot in Apple's security. Apple allows the user to override, usually to disastrous effects.
As I said, I use Silent Knight to update those security components, since macOS does not contain a GUI update function for them https://eclecticlight.co/lockrattler-systhist/
Lotusisrael wrote:
They installed faulty.
In what way?
MRT and XProtect updates double install?
