September 19th, 2024

Apple's new macOS Sequoia update is breaking some cybersecurity tools

Apple's macOS 15, Sequoia, has caused significant disruptions to cybersecurity tools from CrowdStrike and SentinelOne, leading to user frustrations and expert criticism over inadequate testing prior to release.

Read original articleLink Icon
Apple's new macOS Sequoia update is breaking some cybersecurity tools

Apple's recent release of macOS 15, named Sequoia, has led to significant issues with various cybersecurity tools from companies like CrowdStrike, SentinelOne, and Microsoft. Users have reported that the update disrupts the functionality of these security products, causing frustration among developers and users alike. Patrick Wardle, a macOS security expert, expressed his discontent with Apple's lack of thorough testing before releasing updates, which often results in users blaming security tools for problems caused by the operating system itself. CrowdStrike announced a delay in support for Sequoia, citing extensive changes in the network stack that require adjustments in their software. Other companies, including SentinelOne and ESET, have also warned customers against upgrading until their products are compatible with the new OS. Reports from users indicate that issues extend to network connections and firewall functionalities, affecting web browsing and other operations. As of now, Apple has not responded to inquiries regarding these problems, leaving users and security firms awaiting a resolution.

- The macOS Sequoia update has disrupted several cybersecurity tools.

- Companies like CrowdStrike and SentinelOne have delayed support for the new OS.

- Users are experiencing issues with network connections and firewall functionalities.

- Experts criticize Apple for insufficient testing before software releases.

- Apple has not yet commented on the reported issues.

Link Icon 9 comments
By @jasonvorhe - 5 months
I don't see a single product listed there that actually improves security. I'd consider them "cover your ass for compliance" products. None of these vendors has a track record of delivering quality or actual protection without increasing the attack surface, as proven by past screwups of these companies. They even quote Crowdstrike in the first paragraph.

macOS release dates are predictable and Apple ships developer previews and public betas. If these vendors can't update their products in time that doesn't speak for their processes, automated testing infrastructure nor care for their customers.

By @move-on-by - 5 months
> “As a developer of macOS security tools, it’s incredibly frustrating to time and time again have to deal with (understandably) upset users (understandably) blaming your tools for breaking their Macs, when in reality it was Apple’s fault all along,”

I would like to understand this better. Were there not any beta releases that these companies could have tested with in advance? Or were changes made between the beta and the release that broke things? Or something else?

By @mikl - 5 months
Always fun to see the spyware merchants whining about how Apple’s privacy protection efforts makes creeping on users difficult.

Cry harder, dirtbags.

By @Someone - 5 months
> At this point, it’s unclear exactly what is the issue

So, is this a bug in Sequoia or a change that affects these low-level tools? If the latter, they may not like it, but that’s par for the game on MacOS.

(Tried reading https://x.com/patrickwardle/status/1836862900654461270, referenced by sephamorr, but that link isn’t working for me)

By @perryizgr8 - 5 months
Yes, this is the right move that Windows should have done long ago. These are not security products; they are security theater. Chosen only for compliance or CYA reasons by people who don't fully understand the systems they are in charge of securing and administering.

Break them again and again until people realize how useless they are.

By @yawnbox - 5 months
all my wireguard tunnels could not connect upon upgrade. disabling the macos firewall allowed me to use my tunnels again, fyi.
By @lxgr - 4 months
> “As a developer of macOS security tools, it’s incredibly frustrating to time and time again have to deal with (understandably) upset users (understandably) blaming your tools for breaking their Macs, when in reality it was Apple’s fault all along,”

> On the day of macOS Sequoia’s release, a CrowdStrike sales engineer said in a Slack room for Mac admins that the company had to delay support for the new version of Mac’s operating system. “I’m very sorry to report that we will not be supporting Sequoia on day 1 in spite of our intention (and previous track record) to support the latest OS within hours of [General Availability],” the engineer said in the message, seen by TechCrunch.

If only Apple had offered these clowns some sort of beta or developer preview version to test their snake oil against before the widespread release of the new OS...

Absolutely zero sympathy.

By @guidedlight - 5 months
These cybersecurity tools are like posting a contracted armed security guard to an airport departure lounge.
By @musicale - 5 months
> And, somehow, the software update has broken the functionality of several security tools made by CrowdStrike, ...

What terrible news – whatever shall we do?