Technical Tip: Browser events are not reported on Windows with the Chrome 126 update

Summary:

Reveal Agent releases up to and including 11.3.2 on the Windows platform will not report browser events and detections raised from browser activity with any version of Chrome released after 11th July 2024. Web upload blocking will also stop functioning. 

Impact:

No browser events or detections from browser activity will be raised. Web upload blocking will stop functioning.  

Root Cause:

The Reveal Agent uses the signing certificate of the Browser to help identify that it is communicating with a legitimate browser. As the signing certificate for Chrome was updated for releases after 11th July, this means the Reveal Agent no longer trusts Google Chrome, and the browser extension cannot communicate with the Reveal Agent to send browser events or receive verdicts on file uploads.

Identifying potentially impacted nodes:

1. Log in to the Reveal Platform.
2. Open the Investigate page on Process Starts.
3. Search for binary_name = chrome.exe
4. additionally search for child_process_signature_signers = "serialnumber=3582691,cn=google llc,o=google llc,l=mountain view,st=california,c=us,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553"
5. Any nodes that have run an affected version of Chrome within the time window will be highlighted.

Workaround:

A temporary solution, if required before an upgrade to 11.3.3 is possible, is to downgrade or limit the upgrade of Chrome to version 126.0.6478.127 as this is the last version where certificates will be trusted. This can be done with Group Policy by following the instructions outlined by Google here.

Solution:

The 11.3.3 version of the Reveal Agent is now available to download from and via Automatic Update. Customers with Automatic Updates for Reveal Agent set to 'Latest' will pick up this release automatically.

Note:

Reveal Agent release 11.3.2 and later introduces an additional process for both Windows and macOS that should be excluded from antivirus scanning to ensure interoperability:

Windows: C:\Program Files\Jazz Networks\Agent\contentng.exe
macOS: /Library/Application\ Support/Ava/Reveal/contentng/contentng