Home → Beta →

gpg-agent Killed by Cylance AV during message signing

• Edit

Greg

11 Nov, 2015 02:20 PM

GPGMail 2.6b2

I am currently using Cylance for threat detection on Mac and when using GPG Tools to sign outgoing messages, Cylance kills the gpg-agent due to "Exploit Attempt" specifically Stack Pivoting.

ADDED   PROCESS NAME    PROCESS ID  TYPE    ACTION  USER NAME
11/06/15 9:36 AM    /usr/local/MacGPG2/bin/gpg-agent    50022   Stack Pivot Terminated  ghuff
11/06/15 9:36 AM    /usr/local/MacGPG2/bin/gpg-agent    50021   Stack Pivot Terminated  ghuff
11/05/15 8:29 AM    /usr/local/MacGPG2/bin/gpg-agent    47163   Stack Pivot Terminated  ghuff
11/05/15 8:29 AM    /usr/local/MacGPG2/bin/gpg-agent    44646   Stack Pivot Terminated  ghuff

Any thoughts on why this is happening? I apologize in advance for not having additional technical details on what exactly is going on.

1. Support Staff 1 Posted by Steve on 12 Nov, 2015 02:23 PM

   

   Hi Greg,

   first time hearing of Cylance. So to move this forward, we'd have to test, if the problem persists if you use the gpg-agent "as is" directly from gnupg.

   To do that

   • uninstall GPGTools
   • install homebrew
   • brew install gpg2
   • re-install GPGTools but use "Customized install" and de-select MacGPG2

   Then let us know if the problem happens as well.

   Would be great if you could test this. Let me know if the steps are detailed enough to make something useful out of them.

   All the best,
   steve

   • Edit

2. 2 Posted by wingman on 13 Nov, 2015 10:17 AM

   

   Can you submit samples to Cylance as FP? if yes you might be able to get the app and submit it to them

   • Edit

3. 3 Posted by Greg on 04 Jan, 2016 05:42 PM

   

   Steve,
   Your solution seems to have remedied the situation. Thank you for your help.

   • Edit

4. Support Staff 4 Posted by Steve on 01 Feb, 2016 02:52 PM

   

   We have a ticket for this problem. I connected this discussion with the existing ticket. That means, should this discussion get closed, it will be re-opened as soon as the ticket is closed. That way you'll stay in the loop and get notified as soon as we have news. Feel free to open a new discussions should you run into further problems or need assistance.

   Kindly,
   steve

   • Edit

5. Steve closed this discussion on 01 Feb, 2016 02:52 PM.

6. Steve closed this discussion on 19 Jun, 2017 04:57 PM.