1.4.2 on Catalina: airportd

[objective-see]

1.4.2 on Catalina: airportd

[jab3rd]

Seeing this on my machine too, as of yesterday, running macOS Catalina v10.15.7 and ReiKey 1.4.2. I'm not aware of anything that might have changed to produce this.

Here's another report from Feb 11, 2021, and
https://www.reddit.com/r/techsupport/comments/lhq3ja/macos_keylogger_or_basic_mac_binary/

[chrickers]

This just popped up on my machine too, although I ticked "Ignore Apple programs".

[stefanschmidt]

Running macOS Catalina 10.15.7 and ReiKey 1.4.2.

What's Your Sign? reports /usr/libexec/airportd as validly signed by Apple but it is listed by ReiKey even though "Ignore Apple Programs" is checked.

[checktext00]

Hi, I also have this issue and would really like to figure out a reason. It shows up even when "Ignore Apple Programs" is checked, and it's validly signed by Apple's "Software Signing" certificate (see certificate details in VirusTotal). I've also listed its entitlements, maybe "com.apple.private.SkyLight.event.monitor" has something to do with it, but I only found one unhelpful result online. Here's more info about the file and I've uploaded it online if anyone wants to take a look, thanks

airportd mirror 1
airportd mirror 2

macOS Catalina 10.15.7
ReiKey 1.4.2

edit: someone mentioned here it's not flagged on macOS Mojave

---

airportd (VirusTotal)

location: /usr/libexec/airportd

MD5: 209E17E5DDBE6060D278ED3D31634396
SHA1: 6F66E79C1443B3CF415499E1C7CE6CDF006692D9
SHA256: B6C656B4E2B4F41602E26863CB21272D9C4988F27ECF826ED6819BA26229F783

entitlements:
{
    "com.apple.locationd.effective_bundle" = 1;
    "com.apple.private.SkyLight.event.monitor" = 1;
    "com.apple.private.dark-wake-network-reachability" = 1;
    "com.apple.private.security.nvram.wifi-psks" = 1;
    "com.apple.private.wifid.host.network" = 1;
    "com.apple.private.wifid.interface.management" = 1;
    "com.apple.private.wifivelocity" = 1;
    "com.apple.security.network.server" = 1;
    "com.apple.symptom_diagnostics.report" = 1;
    "com.apple.wifi.bypass-location-services" = 1;
    "com.apple.wlan.authentication" = 1;
    "keychain-access-groups" =     (
        "com.apple.cfnetwork"
    );
}

---

tags: airportd, keyboard events taps, detected event tap, all processes, passive listener