What is GoogleSoftwareUpdate.app on my Mac?

What is Google Software Update on my Mac?

I never know there is a software called Google Software Update that is installed in my Mac without my knowledge and sending data back to google more frequent than it is necessary until a couple of days ago. Google Software Update is not a malware, but it behaves like a one.

Google Keystone (Google's codename for its Google Software Update) has "mutated" since I published this article, be sure you read the "Update on July 2019" below.

What is Google Software Update?

When I trying to find out why my cron job doesn't work (just to be clear, it has nothing to do with what I described in this article) a couple of days ago, I came across tons of quite verbose logs generated by a background daemon called GoogleSoftwareUpdateAgent on my MacBook Pro's system.log. The only Google software that I have on my Mac is Chrome browser. Like everything nowadays, I did a quick search on the Internet, and turns out there are full pages of search results related to this topic on the Internet, including an article from Wired.com called "Why Google's software update tool is evil" that dated back to 2009!

Google Software Update (a.k.a. Google Update on some of Google websites) is a program to install requested software and keep it up to date and running in the background without your knowledge on your computer. Google Software Update is used to support software patching (both background updating, and on-demand update checks) for Google Chrome, Earth, and a variety of other Google products on at least Mac and Windows as far as I know (and it probably on Linux platform as well).

According to Google, "in order to provide greater transparency and to make the technology available to other applications, the Google Update technology is open source" (Quoted from "Google Chrome Privacy Whitepaper"). This leads me to Google's github under a project code name Omaha. According to the Omaha github page, Omaha is the open-source version of Google Update. In another word, Google not only using a special version of Omaha itself, it also hoping others will adopt the technology. This actually make me very uncomfortable. Try to imaging that any software can use Omaha to securely install a piece of software on my Mac without my explicit permission and sending information about my usage patterns. For a few good guys, this could be a tool provide seamless update with good user experience. But to bad guys, this is an open source software that could be twisted and disguised to be malware or spyware.

What does Google Software Update do?

According to Google Chrome Privacy Whitepaper, Google Software Update send information such as the version of your Google Chrome (or other Google Apps), its release channel, your computer's hardware information. It also send Google information such as usage frequency and number of active profiles, etc.

To be fair, all the information described seems to be harmless, but what I don't understand is why Google make it behaves like a malware? What will you think if I'm telling you that there is a piece of software that:

  • it install in your computer without explicit asking for your permission, nor giving the options to decline it;
  • it frequently sending data back to Google without your knowledge;
  • it can't be configured via a setting menu;
  • there is no uninstallation tool for you;
  • and it will re-install by itself if you delete it.

With all the information that I collected so far, I think it make sense that many Google Chrome users would want to remove the automatic software installer until such point as Google change it to behave less like a malware and give its users an ability to control the settings. But judging from the history dated back to 2009, I don't have much hope on that.

How to disable Google Software Update

Since this is a know issue that can traced back to Google Earth in 2009, there are ton of tutorials, stack overflow discussions on how to disable it or uninstall it. The methods changed as both the Mac OS and Google Software Update evolving over the years. Here are my methods that work on Mac OS El Capitan (10.11.6) and MacOS High Sierra (10.13.2) on my Mac Mini and MacBook Pro.

How to change Google Software Update interval?

To find out the available default settings of Google Software Update, Mac's command-line command defaults (which is used by Mac OS to manage your Preference Panel) come in handy, launch terminal.app and run this command:

defaults read com.google.Keystone.Agent.plist

For those users who never use terminal.app, it can be find from LaunchPad/Other/Terminal or Finder/Applications/Utilities/Terminal

It will look something like this, depending on the Google apps you have installed and how long it has been installed.

{
    ActivesInfo =     {
        "com.google.Chrome" =         {
            LastActiveDate = "2017-12-06 14:28:43 +0000";
            LastActivePingDate = "2017-12-08 08:00:01 +0000";
            LastRollCallPingDate = "2018-01-08 08:00:00 +0000";
            "ping_freshness" = "185764A0-9BC7-4A8D-AEDC-xxxxxxxxxxxx";
        };
        "com.google.Keystone" =         {
            LastActiveDate = "2018-01-19 06:50:23 +0000";
            LastActivePingDate = "2018-01-08 08:00:00 +0000";
            LastRollCallPingDate = "2018-01-08 08:00:00 +0000";
            "ping_freshness" = "75D4020E-0E22-4BBA-9749-xxxxxxxxxxxx";
        };
    };
    ReportingAttributes =     {
    };
    checkInterval = 18000;
    "firstRun-1.2.2.554" = "2015-12-20 07:08:17 +0000";
    "firstRun-1.2.3.738" = "2015-12-20 07:09:12 +0000";
    "firstRun-1.2.4.919" = "2016-03-07 01:38:45 +0000";
    "firstRun-1.2.5.1190" = "2016-07-16 08:31:35 +0000";
    "firstRun-1.2.6.1370" = "2016-09-24 02:32:46 +0000";
    "firstRun-1.2.7.43" = "2017-02-16 07:45:43 +0000";
    "firstRun-1.2.8.57" = "2017-05-16 03:13:00 +0000";
    "firstRun-1.2.8.82" = "2017-08-17 01:28:13 +0000";
    "firstRun-user-1.2.9.98" = "2017-11-08 10:56:30 +0000";
    "lastCheck-1.2.3.738" = "2016-02-28 10:08:31 +0000";
    "lastCheck-1.2.4.919" = "2016-07-06 06:24:37 +0000";
    "lastCheck-1.2.5.1190" = "2016-08-27 10:22:35 +0000";
    "lastCheck-1.2.6.1370" = "2017-01-14 09:12:26 +0000";
    "lastCheck-1.2.7.43" = "2017-04-07 09:56:14 +0000";
    "lastCheck-1.2.8.57" = "2017-07-25 06:51:51 +0000";
    "lastCheck-1.2.8.82" = "2017-10-08 03:44:58 +0000";
    "lastCheck-user-1.2.9.98" = "2018-01-09 07:51:29 +0000";
    lastCheckStartDate = "2018-01-19 06:50:23 +0000";
    lastServerCheckDate = "2017-11-08 10:56:04 +0000";
}

Notice that there is a setting as checkInterval = 18000;, this means that Google will check the update every 5 hours (3600 x 5 = 18000 seconds) by default.

This is based on the settings from my Mac Mini running OS X El Capitan (10.11.6) with Google Chrome 63.0.3239.132 installed. However, on my MacBook Pro running MacOS High Sierra (10.13.2) and same version of Chrome, it seems to sending update to Google every hour.

We can set change the interval to longer time, for example, to 24 hours with a value of 24 x 3600 = 86400, or 7 days with a value of 24 x 3600 x 7 = 604800. If we change the value to 0, it will basically no longer sending data to Google. To change the value, run the following command in the terminal:

defaults write com.google.Keystone.Agent checkInterval 604800

This is sufficient to most of the users. If however you share my concerns and dislike this malware alike behaviour, and want to remove Google Software Update altogether, then follow the next step.

How to uninstall Google Software Update?

The Google Software Update is not visible from the Mac Graphic User Interface (GUI) as it is located in a hidden ~/Library/Google/ directory.

sudo rm -R ~/Library/Google/GoogleSoftwareUpdate/

This will delete Google Software Update, however, if you run Google Chrome (or other Google Apps) again, it will invite itself in and reinstall the Google Software Update without your knowledge as soon as you launch Google Chrome or other Google App, doesn't this behave like a malware or virus?

To prevent Google apps reinstall the Google Software Update again, we will create a dummy file with the same name but assign the file ownership to root user instead of the username that you are currently using. The newly created file will also have a file access permission of 444, meaning no one has the write permission for the file. To do that, run the following terminal command:

sudo touch ~/Library/Google/GoogleSoftwareUpdate
sudo chmod 444 ~/Library/Google/GoogleSoftwareUpdate

And finally do some housecleaning by removing all the files related to Google Software Update, this is an option, but I don't like to have some ghost files lettering in my hard disk.

sudo rm ~/Library/LaunchAgents/com.google.keystone.agent.plist
sudo rm  -R ~/Library/Caches/com.google.Keystone*
sudo rm ~/Library/Preferences/com.google.Keystone.Agent.plist

Now if you launch Google Chrome and type in chrome://help as the URL, Chrome will complain with a message update failed. That's okay, but Iā€™d also suggest checking this on a regular basis to make sure that you are up to date.

Google Chrome shows "Update Failed" without Google Software Update running
Google Chrome shows "Update Failed" without Google Software Update running

Final Words

Although this solution stopped Google Software Update from installing itself on your machine uninvitedly, however, I have a feeling that things may changes in future, for example, it may install it for "All users" (i.e. a system wide installation at /Library/ instead of installing it on your user profile directory ~/Library/). MacOS update in future might also break our settings.

The General Data Protection Regulation (GDPR) that was adopted by all EU members on 27 April 2016 will become enforceable by 25 May 2018, Google should take note and be cautious about its software behaviour, but I'm leaving outside of EU (and US) in the part that Americans often lump it together called ROW (Rest of the World), I don't know whether Google will implement a different privacy practise based on each region's regulatory, or will change its Software Update due to GDPR. It will be naive to expect Google to honour its founding mottos of "Don't be evil", but I do expect it to "do the right thing" sooner than later.

Safe surfing!

Update on July 2019

I have stopped using Chrome since I discovered Chrome's behaviour since Jan 2018, but I do keep a Chrome installation (version 63.0.3239.132) on my Mac for my web development purpose. Recently I need to test one of the latest feature of Chrome browser, so I removed my setting temporarily to allow Chrome update the browser to the latest version 75.0.3770.100, and only put back my setting after the Chrome update. But I noticed that Chrome is no longer display "updated failed" to complain about my blocking afterward.

As I predicted in my "Final Words" that Keystone might one day "mutated" to 'install it for "All users" (i.e. a system wide installation at /Library/ instead of installing it on individual user directory ~/Library/)'. I don't know when Google made the change somewhere between version 63.0.3239.132 more than a year ago and this latest version 75.0.3770.100, but this is exactly the behaviour now.

If you block the Keystone self-installation at the user level ~/Library/Google/, it will automatically self-install itself at global level /Library/Google/, so if you want to stop the Keystone self-install behaviour, in addition to what I described under "How to uninstall Google Software Update?", you will have to repeat the process to block Keystone at /Library/Google directory.

Read my latest blog "How Google Read Your Gmail"

40 comments by readers

  1. Hello

    Thank you for this. The EU is correct privacy is important. The horse may be out of the barn but these companies need to stop. Money is the only reason this keeps going. Please leet me have my privacy

    Thank you so much for your post of this. BTW, for my search I now use DUCK DUCK GO. supposedly they do not track what I am searching for.

  2. this is a great post.. thank you for preparing it. have de-autoupdated my machines. could not agree more that googlers are a bunch of shits and their spamware must be managed very carefully

  3. After catching the Google update agent using 100% of CPU I got rid of it the way you said. Looking forward to faster startups! šŸ™‚ Thanks for the article.

  4. Good job!
    A huge thanks for this article. I recently got this annoying app in my two computers so…
    It was perfect. It was quick and it gave me the chance to open my Terminal for the first time since a couple of years. That means that it was well done and very well explain because… I’m not a novice but almost. :p
    Really appreciated!
    Thanks

  5. This does not work. I suspect Google has snuck around these workarounds by now. I’m on Chrome 84. There is no Google or GoogleSoftwareUpdate at the /Library, I have removed the daemons, etc. Everytime I restart Chrome all the crap is put back. Don’t be evil? Indeed!

  6. I’m not a techie so I have no idea what you’re talking about.
    Is there not an easier way to get rid of this unwanted piece of crap?
    Asking cos am a techno klutz and your gnomic instructions are as comprehensible as ancient Sanskrit to me. Sorry.

Comments are closed.