Apple's new macOS Sequoia update is breaking some cybersecurity tools
(techcrunch.com)64 points by zspitzer 10 months ago
64 points by zspitzer 10 months ago
> “As a developer of macOS security tools, it’s incredibly frustrating to time and time again have to deal with (understandably) upset users (understandably) blaming your tools for breaking their Macs, when in reality it was Apple’s fault all along,”
I would like to understand this better. Were there not any beta releases that these companies could have tested with in advance? Or were changes made between the beta and the release that broke things? Or something else?
Per Patrick Wardle, this was well reported to Apple during beta.
Thank you, this makes the frustration in the above quote more understandable. For anyone wanting to avoid the x click:
> Worth stressing this was reported to Apple before the GA was released (by multiple people, to multiple teams/orgs within Apple) so Apple 100% knew about this, and shipped macOS 15 anyways
IMO those Mac anti-virus tools are basically malware exploiting all kinds of loopholes and hacks to get their hands on everything going on in the system. It's a good thing Apple fixes those loopholes and it's not Apple's responsibility to make sure every hack used by these tools keeps working.
Apple, or at least their teams responsible for answering feedback, rarely ever give substantial responses nowadays, regardless of how well documented the submission was. So it compounds the frustration.
And this isn’t even the most egregious case, sometimes the bugs are so obvious that they generate multiple hard faults, per hour, logged in Console, on a fresh installation with only the default apps running.
Apple is not responsible for ensuring your malware (yes, that’s what I personally consider this software) or even your software runs on Mac.
The betas are there for you to test your code against future Mac releases. Apple can and probably will take away APIs that your business is built around. Especially when those APIs are actually decreasing security.
Is there even an equivalent to WSUS on macOS that lets admins block an update until it's tested?
Yep, a lot of these policies seem to come from some random person scrolling through a list of supported options and arbitrarily making up values that are enforced on people.
One of our policies enforce that screen savers must start after 20 minutes, and it’s not possible to reduce it (I have my personal on 3 minutes). Or the fact that it will constantly reset the UI notification volume to 100% and speaker output, even though have headphones almost always.
Infuriating.
Yes, it's called MDM (Mobile Device Management) and lets admins set all kinds of policy on apple devices. There are several vendors out there that implement it.
> At this point, it’s unclear exactly what is the issue
So, is this a bug in Sequoia or a change that affects these low-level tools? If the latter, they may not like it, but that’s par for the game on MacOS.
(Tried reading https://x.com/patrickwardle/status/1836862900654461270, referenced by sephamorr, but that link isn’t working for me)
It apepars that the default application firewall blocking rules are overly restrictive.
There are two «firewalls» in OS X: the IP packet filter (controlled pfctl) and the application level one (controlled by /usr/libexec/ApplicationFirewall/socketfilterfw). The one that is causing a lot of grief for upgraded users is the latter one.
The workaround is to remove/disable the app level blocking rules manually:
1. Get a list of app level firewall rules:
/usr/libexec/ApplicationFirewall/socketfilterfw --listapps
3. Disable the app specific rules:
/usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp <path to the app from the list in step 1>
/usr/libexec/ApplicationFirewall/socketfilterfw --remove <path to the app from the list in step 1>
If a DoH DNS configuration is used, it also makes sense to explicitly whitelist the DoH provider in «pfctl» rules at IPv4/IPv6 and domain levels.
Not just networking issues, there are plenty of reports with external drives having problems as well.
Yes, this is the right move that Windows should have done long ago. These are not security products; they are security theater. Chosen only for compliance or CYA reasons by people who don't fully understand the systems they are in charge of securing and administering.
Break them again and again until people realize how useless they are.
I read somewhere about old ESET rules being in the macOS firewall blocked various udp traffic. Quick Google might get you more information.
It is for me. I've had to disable it on my mbp and ios devices; otherwise DNS lookups choke.
> “As a developer of macOS security tools, it’s incredibly frustrating to time and time again have to deal with (understandably) upset users (understandably) blaming your tools for breaking their Macs, when in reality it was Apple’s fault all along,”
> On the day of macOS Sequoia’s release, a CrowdStrike sales engineer said in a Slack room for Mac admins that the company had to delay support for the new version of Mac’s operating system. “I’m very sorry to report that we will not be supporting Sequoia on day 1 in spite of our intention (and previous track record) to support the latest OS within hours of [General Availability],” the engineer said in the message, seen by TechCrunch.
If only Apple had offered these clowns some sort of beta or developer preview version to test their snake oil against before the widespread release of the new OS...
Absolutely zero sympathy.
These cybersecurity tools are like posting a contracted armed security guard to an airport departure lounge.
Please look past the fact that CrowdStrike is today’s, or yesterday’s, cultural whipping boy. They make software, and its users would like it to work. It’s not a good thing.
And when they report bugs to the vendor, and Apple just black holes those bugs, as they do in probably 99.8%+ of bug reports?
"Suck it up"?
I don't see a single product listed there that actually improves security. I'd consider them "cover your ass for compliance" products. None of these vendors has a track record of delivering quality or actual protection without increasing the attack surface, as proven by past screwups of these companies. They even quote Crowdstrike in the first paragraph.
macOS release dates are predictable and Apple ships developer previews and public betas. If these vendors can't update their products in time that doesn't speak for their processes, automated testing infrastructure nor care for their customers.