MacOS sometimes asks you to accept some system extension / kext. Unfortunately it can be difficult to clarify why, which can be scary. Sometimes you will only get notified that the kext signed by XYZ has been updated, and then it's on you to find out how to relate XYZ to a specific file and functionality in your system.
I have found myself in the situation a couple of times, so in case it helps others, here's my notes. BEWARE, don't take this as an excuse to assume that everything is fine in your system; instead take this as a hint that should be verified for your own case. Indeed, if you don't know why you have that driver in your system, maybe you should just remove it.
A couple of tools that can help to find installed kexts and other persistent items in these situations are KnockKnock and Lingon X.
Fun fact: I tried asking various LLMs (Gemini, Claude, ChatGPT, LeChat) to identify a kext by the signer's name. The results came out empty at best; at worst they hallucinated connections to other companies.
On to the kexts:
- Kirill Luzanov is the signer for SATSMARTDriver.kext, which can be downloaded from BinaryFruit, the makers of the DriveDX software. The driver enables macOS to read SMART diagnostic info from external USB drives.
- Confusingly, the download page links to the driver's original GitHub repo, which as of this writing has been untouched for 8 years. They must have their own unpublished fork, and I couldn't find any connection between Luzanov and BinaryFruit. There's a GitHub profile for someone with that name but seems pretty dead.
[to be continued]
Comments
Post a Comment