SEB 3.1.1 for MacOS: "Prohibited Processes" function does not work

[tavaba]

I created 2 configuration files, one for Windows (created on Windows, running SEB 3.4.1) and the other for MacOS (created on MacOS, runnning 3.1.1). Both configurations should prevent "unwanted" processes such as Teamviewer, Telegram... from running.
In Windows case, SEB works as intended, but in MacOS case it does not. I still can "teamviewer" to the Mac while SEB is running. Other prohibited processes (Microsoft Teams, Telegram) also run without any problem.
macOS-Monterey-SEB-3.1.1.zip
Do I miss anything?

[danschlet]

Are you sure Teams and Telegram are not terminated? SEB for macOS restarts terminated prohibited processes when quitting. When I open your config file (by double clicking it, SEB 3.1.1 gets started), Teams and Telegram are definitely terminated (and restarted when SEB is quit).

If it really doesn't work, send me your SEB log files please.

I don't have TeamViewer installed currently, it's possible that they changed the relevant processes or their Bundle ID (currently "com.TeamViewer.TeamViewer ") which SEB would need to terminate to prevent connections to work. You can try yourself which process needs to be terminated, use Activity Monitor to search for all "teamviewer" processes and force quit those one-by-one and every time try if you still can connect to TeamViewer on that Mac. You can check the Bundle ID of a process in Activity Monitor by double clicking the process, click the "Sample" button and then check the "Identifier:" line.

You can also use the macOS built-in Assessment Mode (AAC) kiosk mode, where processes are prevented to connect to the network while SEB is running in that mode. Unfortunately this mode only works on some newer macOS versions (in older one with limitations, see SEB macOS 3.1.1 release notes).

[tavaba]

Thank you very much, Mr. Schneider.
I might be wrong about Teams and Telegram, but I'm sure that Teamviewer does work when SEB is running.
I'll follow your suggestion to try to solve the problem and notice the result ASAP.
Best regards.

[tavaba]

Hi guys,
As Mr. Schneider said above, "it's possible that they changed the relevant processes or their Bundle ID (currently "com.TeamViewer.TeamViewer ")". I checked the Bundle ID of a TeamViewer in Activity Monitor and found a different value, namely "com.teamviewer.TeamViewer" for the latest version (15.36.6). After setting up new rule in "Prohibited Processes" TeamViewer is now blocked by SEB.
Many thanks to Mr. Schneider again.

[danschlet]

Thank you for your feedback! I will add "com.teamviewer.TeamViewer" as an additional entry for preset default prohibited processes to the upcoming SEB release 3.2.1 (Bundle identifiers are actually case sensitive, that's the reason the new TeamViewer Bundle ID wasn't recognized anymore).

[danschlet]

This is now fixed in SEB 3.2.1.