2

Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur.

On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that leverage "event taps".

Today I got this strange (and somehow creepy) situation: as soon as I started the Password Manager software Bitwarden, a warning came up from ReiKey. In particular, the presence of the process /usr/libexec/gamecontrollerd was highlighted.

If I close Bitwarden, the process /usr/libexec/gamecontrollerd keeps running. I have to kill it through the terminal. However, as soon as I open BitWarden, /usr/libexec/gamecontrollerd restarts.

The presence of gamecontrollerd as passive listener of key taps apparently started after the BigSur update (there's an Apple post here)

I know this may be just a coincidence (i.e., the start of Bitwarden and a key-tap passive listener), however I wanted to check with someone else who may have had the same type of scenario.

Thanks

Improve this question
2
  • 1
    Well BitWarden's GUI is an Electron app. That Apple post you linked explains why the listener will start when you open that program.
    – user
    Commented Dec 31, 2020 at 19:30
  • Hey @FancyPants there's a thread on github issues regarding the ReiKey notification showing the gamecontrollerd as a keylogger. I guess this is not a strict yes or no answer, but rather a question if you play games, if you secured yourself elsewhere. But I assure you, it's 100% not related to Bitwarden. This pwd manager passes regular security checks and based in Germany, so kind of trusted group.
    – magnump0
    Commented May 8, 2021 at 18:22

1 Answer 1

Reset to default
0

TL;DR

  1. gamecontrollerd daemon is part of MacOS environment.
  2. any app which uses chromium underneath (any Electronjs) would launch for some reason this daemon
  3. what actually triggers the unfocusing is ReiKey itself

The gamecontrollerd is related to a new Game Controller framework which is a part of the MacOS system. For some reason Chrome (based on Chromium) and accordingly Electronjs (also based on Chromium) are launching this daemon when you open those apps. For example Spotify would do that, Slack too. The issue might not be the issue at all actually. I recommend to read through the thread on the ReiKey github to get more understanding if this is the problem. Try turn off the apps which are starting this daemon for a while and see if the focus is still lost. I did this test and can confirm it doesn't start. What actually triggers the unfocusing from the active window is ReiKey itself thinking that gamecontrollerd is a suspicious thing. But Patrick Wardle, creator of ReiKey and other security apps, is definitely a trusted person with other eyes watching him as well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .