What is GoogleSoftwareUpdate.app on my Mac?

What is Google Software Update on my Mac?

I never know there is a software called Google Software Update that is installed in my Mac without my knowledge and sending data back to google more frequent than it is necessary until a couple of days ago. Google Software Update is not a malware, but it behaves like a one.

Google Keystone (Google's codename for its Google Software Update) has "mutated" since I published this article, be sure you read the "Update on July 2019" below.

What is Google Software Update?

When I trying to find out why my cron job doesn't work (just to be clear, it has nothing to do with what I described in this article) a couple of days ago, I came across tons of quite verbose logs generated by a background daemon called GoogleSoftwareUpdateAgent on my MacBook Pro's system.log. The only Google software that I have on my Mac is Chrome browser. Like everything nowadays, I did a quick search on the Internet, and turns out there are full pages of search results related to this topic on the Internet, including an article from Wired.com called "Why Google's software update tool is evil" that dated back to 2009!

Google Software Update (a.k.a. Google Update on some of Google websites) is a program to install requested software and keep it up to date and running in the background without your knowledge on your computer. Google Software Update is used to support software patching (both background updating, and on-demand update checks) for Google Chrome, Earth, and a variety of other Google products on at least Mac and Windows as far as I know (and it probably on Linux platform as well).

According to Google, "in order to provide greater transparency and to make the technology available to other applications, the Google Update technology is open source" (Quoted from "Google Chrome Privacy Whitepaper"). This leads me to Google's github under a project code name Omaha. According to the Omaha github page, Omaha is the open-source version of Google Update. In another word, Google not only using a special version of Omaha itself, it also hoping others will adopt the technology. This actually make me very uncomfortable. Try to imaging that any software can use Omaha to securely install a piece of software on my Mac without my explicit permission and sending information about my usage patterns. For a few good guys, this could be a tool provide seamless update with good user experience. But to bad guys, this is an open source software that could be twisted and disguised to be malware or spyware.

What does Google Software Update do?

According to Google Chrome Privacy Whitepaper, Google Software Update send information such as the version of your Google Chrome (or other Google Apps), its release channel, your computer's hardware information. It also send Google information such as usage frequency and number of active profiles, etc.

To be fair, all the information described seems to be harmless, but what I don't understand is why Google make it behaves like a malware? What will you think if I'm telling you that there is a piece of software that:

  • it install in your computer without explicit asking for your permission, nor giving the options to decline it;
  • it frequently sending data back to Google without your knowledge;
  • it can't be configured via a setting menu;
  • there is no uninstallation tool for you;
  • and it will re-install by itself if you delete it.

With all the information that I collected so far, I think it make sense that many Google Chrome users would want to remove the automatic software installer until such point as Google change it to behave less like a malware and give its users an ability to control the settings. But judging from the history dated back to 2009, I don't have much hope on that.

How to disable Google Software Update

Since this is a know issue that can traced back to Google Earth in 2009, there are ton of tutorials, stack overflow discussions on how to disable it or uninstall it. The methods changed as both the Mac OS and Google Software Update evolving over the years. Here are my methods that work on Mac OS El Capitan (10.11.6) and MacOS High Sierra (10.13.2) on my Mac Mini and MacBook Pro.

How to change Google Software Update interval?

To find out the available default settings of Google Software Update, Mac's command-line command defaults (which is used by Mac OS to manage your Preference Panel) come in handy, launch terminal.app and run this command:

defaults read com.google.Keystone.Agent.plist

For those users who never use terminal.app, it can be find from LaunchPad/Other/Terminal or Finder/Applications/Utilities/Terminal

It will look something like this, depending on the Google apps you have installed and how long it has been installed.

{
    ActivesInfo =     {
        "com.google.Chrome" =         {
            LastActiveDate = "2017-12-06 14:28:43 +0000";
            LastActivePingDate = "2017-12-08 08:00:01 +0000";
            LastRollCallPingDate = "2018-01-08 08:00:00 +0000";
            "ping_freshness" = "185764A0-9BC7-4A8D-AEDC-xxxxxxxxxxxx";
        };
        "com.google.Keystone" =         {
            LastActiveDate = "2018-01-19 06:50:23 +0000";
            LastActivePingDate = "2018-01-08 08:00:00 +0000";
            LastRollCallPingDate = "2018-01-08 08:00:00 +0000";
            "ping_freshness" = "75D4020E-0E22-4BBA-9749-xxxxxxxxxxxx";
        };
    };
    ReportingAttributes =     {
    };
    checkInterval = 18000;
    "firstRun-1.2.2.554" = "2015-12-20 07:08:17 +0000";
    "firstRun-1.2.3.738" = "2015-12-20 07:09:12 +0000";
    "firstRun-1.2.4.919" = "2016-03-07 01:38:45 +0000";
    "firstRun-1.2.5.1190" = "2016-07-16 08:31:35 +0000";
    "firstRun-1.2.6.1370" = "2016-09-24 02:32:46 +0000";
    "firstRun-1.2.7.43" = "2017-02-16 07:45:43 +0000";
    "firstRun-1.2.8.57" = "2017-05-16 03:13:00 +0000";
    "firstRun-1.2.8.82" = "2017-08-17 01:28:13 +0000";
    "firstRun-user-1.2.9.98" = "2017-11-08 10:56:30 +0000";
    "lastCheck-1.2.3.738" = "2016-02-28 10:08:31 +0000";
    "lastCheck-1.2.4.919" = "2016-07-06 06:24:37 +0000";
    "lastCheck-1.2.5.1190" = "2016-08-27 10:22:35 +0000";
    "lastCheck-1.2.6.1370" = "2017-01-14 09:12:26 +0000";
    "lastCheck-1.2.7.43" = "2017-04-07 09:56:14 +0000";
    "lastCheck-1.2.8.57" = "2017-07-25 06:51:51 +0000";
    "lastCheck-1.2.8.82" = "2017-10-08 03:44:58 +0000";
    "lastCheck-user-1.2.9.98" = "2018-01-09 07:51:29 +0000";
    lastCheckStartDate = "2018-01-19 06:50:23 +0000";
    lastServerCheckDate = "2017-11-08 10:56:04 +0000";
}

Notice that there is a setting as checkInterval = 18000;, this means that Google will check the update every 5 hours (3600 x 5 = 18000 seconds) by default.

This is based on the settings from my Mac Mini running OS X El Capitan (10.11.6) with Google Chrome 63.0.3239.132 installed. However, on my MacBook Pro running MacOS High Sierra (10.13.2) and same version of Chrome, it seems to sending update to Google every hour.

We can set change the interval to longer time, for example, to 24 hours with a value of 24 x 3600 = 86400, or 7 days with a value of 24 x 3600 x 7 = 604800. If we change the value to 0, it will basically no longer sending data to Google. To change the value, run the following command in the terminal:

defaults write com.google.Keystone.Agent checkInterval 604800

This is sufficient to most of the users. If however you share my concerns and dislike this malware alike behaviour, and want to remove Google Software Update altogether, then follow the next step.

How to uninstall Google Software Update?

The Google Software Update is not visible from the Mac Graphic User Interface (GUI) as it is located in a hidden ~/Library/Google/ directory.

sudo rm -R ~/Library/Google/GoogleSoftwareUpdate/

This will delete Google Software Update, however, if you run Google Chrome (or other Google Apps) again, it will invite itself in and reinstall the Google Software Update without your knowledge as soon as you launch Google Chrome or other Google App, doesn't this behave like a malware or virus?

To prevent Google apps reinstall the Google Software Update again, we will create a dummy file with the same name but assign the file ownership to root user instead of the username that you are currently using. The newly created file will also have a file access permission of 444, meaning no one has the write permission for the file. To do that, run the following terminal command:

sudo touch ~/Library/Google/GoogleSoftwareUpdate
sudo chmod 444 ~/Library/Google/GoogleSoftwareUpdate

And finally do some housecleaning by removing all the files related to Google Software Update, this is an option, but I don't like to have some ghost files lettering in my hard disk.

sudo rm ~/Library/LaunchAgents/com.google.keystone.agent.plist
sudo rm  -R ~/Library/Caches/com.google.Keystone*
sudo rm ~/Library/Preferences/com.google.Keystone.Agent.plist

Now if you launch Google Chrome and type in chrome://help as the URL, Chrome will complain with a message update failed. That's okay, but Iā€™d also suggest checking this on a regular basis to make sure that you are up to date.

Google Chrome shows "Update Failed" without Google Software Update running
Google Chrome shows "Update Failed" without Google Software Update running

Final Words

Although this solution stopped Google Software Update from installing itself on your machine uninvitedly, however, I have a feeling that things may changes in future, for example, it may install it for "All users" (i.e. a system wide installation at /Library/ instead of installing it on your user profile directory ~/Library/). MacOS update in future might also break our settings.

The General Data Protection Regulation (GDPR) that was adopted by all EU members on 27 April 2016 will become enforceable by 25 May 2018, Google should take note and be cautious about its software behaviour, but I'm leaving outside of EU (and US) in the part that Americans often lump it together called ROW (Rest of the World), I don't know whether Google will implement a different privacy practise based on each region's regulatory, or will change its Software Update due to GDPR. It will be naive to expect Google to honour its founding mottos of "Don't be evil", but I do expect it to "do the right thing" sooner than later.

Safe surfing!

Update on July 2019

I have stopped using Chrome since I discovered Chrome's behaviour since Jan 2018, but I do keep a Chrome installation (version 63.0.3239.132) on my Mac for my web development purpose. Recently I need to test one of the latest feature of Chrome browser, so I removed my setting temporarily to allow Chrome update the browser to the latest version 75.0.3770.100, and only put back my setting after the Chrome update. But I noticed that Chrome is no longer display "updated failed" to complain about my blocking afterward.

As I predicted in my "Final Words" that Keystone might one day "mutated" to 'install it for "All users" (i.e. a system wide installation at /Library/ instead of installing it on individual user directory ~/Library/)'. I don't know when Google made the change somewhere between version 63.0.3239.132 more than a year ago and this latest version 75.0.3770.100, but this is exactly the behaviour now.

If you block the Keystone self-installation at the user level ~/Library/Google/, it will automatically self-install itself at global level /Library/Google/, so if you want to stop the Keystone self-install behaviour, in addition to what I described under "How to uninstall Google Software Update?", you will have to repeat the process to block Keystone at /Library/Google directory.

Read my latest blog "How Google Read Your Gmail"

40 comments by readers

  1. Thank you. This was the best answer to this issue. I’ve been dealing with this issue off and on for the past couple of years. I get rid of it, and it comes back over and over. Creating a dummy file was a great idea by attaching it to root was great. I tried using a dummy file but it would write over it. But by tying to root though is a great idea.
    The problem for me aside from the privacy issue is that it crashes my computer. My computer will be really slow to the point where I can check in Console to see what’s going on and it’s completely with google software updating and crashing. And this latest install was phoning home every hour. It’s so obnoxious. Thank you again!!!

  2. Thanks for taking the time to post this – I encountered the issue when disabling Chrome’s Auto-Update “feature” which, as I discovered, is no longer optional.

    There’s a certain ominous arrogance to Google’ vibe these days. Tried FireFox and it’s still underdeveloped and, Safari, well it’s clearly a development of Tim’s Apple and as such, not ready for prime-time.

    Cheers.

  3. this is an excellent solution
    and it works perfectly, thank you

    a question:

    after implementing the steps above, how can we update chrome when we want after it becomes available ?

  4. If you still want to get update chrome, the solution is to not totally block the Google auto-update feature but set it to a relative long time for it to “phone-home”. e.g.

    defaults write com.google.Keystone.Agent checkInterval 604800

    This would set it to checking for update every 7 days (7 x 24 x 3600 = 604800 seconds = 7 days).

  5. Notice there is a Google Software Update package hidden in Google folder then Software update, What should I do? Delete it?

    1. What OS of your computer is? What I described are based on Mac, where the GoogleSoftwareUpdate directory is located at ~/Library/Google/, delete it and create a dummy file and set it to read only to block Google from re-installing it. For PC, I’m not sure where the file location, but what described here should works in principle.

  6. another option is having something like LittleSnitch or HandsOff, and block any internet connections that the updater tries to make.
    I have the updater, but it cannot connect anywhere to send data or download updates

    1. Thanks for the information. Good to know that.

      Actually, as I pointed in the article, it seems that if you set the checkInterval to `0` with:

      defaults write com.google.Keystone.Agent checkInterval 0

      It will no longer sending data to Google to achieve what you did with LittleSnitch or HandsOff. Personally I just don’t feel comfortable to have a Keystone installed in my Mac.

  7. Ive found that in Norton internet security its possible to block the Google updater etc. This I have done and I get messages telling the app has been blocked regularly.

  8. I haven’t had any Google apps on my computer for a few years but this software is still running intermittently every day and crashing, slowing my computer down significantly. I’m very glad to have found a way to delete it.

  9. I downloaded Google’s Android File Transfer to use with my old-ish Samsung cell phone, but it wouldn’t work so I deleted it using launchpad, and deleting it from Applications. However, looking at System Information – Legacy Software it’s still there!

    Even searching for invisible files won’t find it, and several reboots, even after a boot into safe mode still show it in System Information.

    Maybe I’m being anal but I really don’t want it there. I don’t use Chrome, and I only have a very old version of Google Earth which I haven’t launched since migrating to this new MacBook Pro.

    I don’t want ANYTHING Google on my machine so I’m going to try your Terminal solutions and if it doesn’t work I’ll be back to let you know, if it does work I’ll be back to thank you. šŸ™‚

    1. Well, your solutions have worked. GoogleSoftwareUpdate is nowhere to be found, but, System Info still shows this:

      Google, Inc.:
      Android File Transfer:
      ksinstall:
      Reason: 32-bit
      Signer: Google, Inc.
      Last Used: 2019-09-24 10:07:37
      Path: /Applications/Android File Transfer.app/Contents/Frameworks/KeystoneRegistration.framework/Versions/A/Resources/ksinstall
      Team ID: EQHXZ8M8AV
      Signing ID: ksinstall
      Signing Hash: d0c15ff2fc37629b8f9e7c9bd034aae7b5ece052
      Parent Process: /Applications/Android File Transfer.app/Contents/MacOS/Android File Transfer

      I’ve tried modifying your Terminal commands using those file paths but the files aren’t there.

      Maybe a reboot will do the trick? Even refreshing info in the System Information.app still shows the crap still there.

      Man, do I hate Google!

      1. Did you try the /Library/Google/? Google KeyStone has evolved (or mutated) in the past year, if you block the Keystone self-installation at the user level ~/Library/Google/, it will automatically self-install itself at root level /Library/Google/, you will have to repeat the process to block Keystone at /Library/Google directory. Hope this will help.

  10. Thanks,

    Did it both at user and keystone levels. Version 77 still reads update failed.
    Works Great!!!

    Update failed (error: 10)
    Learn more
    Version 77.0.3865.90 (Official Build) (64-bit)

  11. Going to /Library/Google sounds the alert, opens the Library directory and shows no Google folder.

    Searching the HD, my user directory, everywhere, finds no trace of anything Google, I’m pleased to say.

    Like I said in my previous posts I can only see Android File Transfer – ksinstall, as a 32 bit item under Legacy Software in System Information.

    It obviously got listed there when I first opened Android File Transfer.app, I’m just puzzled as to why it’s still there now that it and everything Google seems to have been deleted.

    Surely it shouldn’t still show?

    1. One should never disable the Apple System Integrity Protection(SIP), this should not be an issued for those apps that distributed through Apple Stores because the signature of those apps are correctly signed and recognised. The problem is that Google Chrome with KeyStone was never gone through the App store approval system…

    1. Not sure what do you mean “get”? If you have google products such as Chrome installed, Google will automatically installed the google update program in your Mac.

  12. Hello, I’ve been using Chrome for ages, and now I have a continual pop-up horror “GoogleSoftwareUpdate.bundle” is an app downloaded from the internet. Are you sure you want to open it’ In grey, it says ‘Chrome downloaded this file on an unknown date’ and there are two options, ‘Cancel’ and ‘Open’, neither of which makes the flipping thing go away. Mac with ISP firewall, Mac firewall, Malwarebytes etc

  13. I meant to add – I was on the phone with Apple for hours trying to fix this, and they had no clue.

  14. Thanks for posting this helpful article. I’m on a MacBook Pro 15″ 2015 running Sierra. I followed your simple suggestion to change the interval to 7 days. But the daemon still launches at computer startup and causes the fans to ramp up for the first couple of minutes. There are a few other items that are also contributing to the problem at startup, but the Google daemon shows up a couple of times in Activity Monitor using 100+% CPU. Any suggestion for how to prevent this, but not fully disable it with your more detailed method? Thanks very much.

Comments are closed.