Bitwarden on MacOS making calls to Google DNS?

Ask the Community Password Manager
1

I’ve dug through the Preferences, searched the Web, and done a search here so if I missed the answer please pardon me! :slight_smile:

I’m running Bitwarden app, v2022.5.1, on MacOS, a company owned Macbook. Recently when I’ve been directly connected to our company network our desktop security team has been getting alerted that my computer is calling Google DNS, and it flags Bitwarden in the alert message. I don’t know why that would be and I’m not finding anything in the preferences. Last week I disabled the ability to launch URLs and Google Search from the app. I haven’t been in the office to see if it raises red flags with them since. Can anyone offer insight into why this might happen or where I should look to address it? They’re suggesting I change password lockers but I just dropped LastPass after using it for a dozen or so years and already nitpicked other offerings before settling on BitWarden.

The detection is being done with Carbon Black and appears as follows (the blurred IP is my Mac’s internal addr):

bitwarden-googledns
bitwarden-googledns993×165 34.2 KB

In case it matters, here are the rest of the About specs from the app:
Version 2022.5.1
Shell 16.1.0
Renderer 96.0.4664.174
Node 16.9.1
Architecture x64

TIA

2

I wonder if it has something to do with the Icon server? If so, you could try Settings → Options → Disable Website Icons.

2 Likes
3

Good suggestion, @grb.

Also, @Volksaholic - is anything returned if you type this command into the Terminal app on your Mac.

scutil --dns | grep 8.8.
4

@dh024 I’ll have try that when I’m on the office network. I’m getting 8.8.4.4 right now but that’s coming from my DSL DHCP config since CenturyLink’s name servers were being unreliable at one point.
@grb I also disabled the Icon Server to give that a try. I noticed your instructions and the doc on the Bitwarden site both say to go to “Settings” to change that, but in my version it’s “Preferences” and then it’s a checkbox labeled “Disable Website Icons” at the bottom of the dialog box. I don’t know if that’s a Mac version thing, a different client build, or whether there’s some other way to get to it.

I appreciate the suggestions. I’ll hopefully be able to run into the office tomorrow and have Security scan my Mac again, and also check out what scutil reports for my DNS servers. Thanks!

5

As a follow-up… it appears it must have been related to one of the Preferences:
Disable Web Icons

Or Services… Service Preferences:
Open URL
Search with Google

I’ve disabled all those settings and Security is no longer seeing the alert. If I have time I may try to narrow it down by enabling these one at a time and seeing if Carbon Black picks it up. Thanks for your help.

2 Likes