News: 0175080451

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Apple's New macOS Sequoia Update Breaking Major Security Tools (techcrunch.com)

(Thursday September 19, 2024 @05:30PM (msmash) from the how-about-that dept.)


Apple's latest [1]macOS 15 "Sequoia" update, [2]released earlier this week , has [3]disrupted security tools from major providers including CrowdStrike, SentinelOne, and Microsoft, according to reports. The extent and cause of the disruption remain unclear.



[1] https://apple.slashdot.org/story/24/06/10/1810245/apple-unveils-macos-15-sequoia-at-wwdc-introduces-window-tiling-and-iphone-mirroring

[2] https://tech.slashdot.org/story/24/09/09/1925238/apple-will-release-ios-18-macos-15-ipados-18-other-updates-on-september-16

[3] https://techcrunch.com/2024/09/19/apples-new-macos-sequoia-update-is-breaking-some-cybersecurity-tools/



Non-public APIs keep you out of App Store (Score:5, Informative)

by drnb ( 2434720 )

> we want 30% and must be in app store to use this API!

Actually using non-public APIs (unsupported APIs) is what keeps you out of the App Store and forces you to distribute yourself, and be vulnerable if anything changes in these APIs.

Re: (Score:2)

by mukundajohnson ( 10427278 )

Lazy ass companies*

I think programmers would love to be paid to do a load of maintenance gruntwork.

Re: (Score:2)

by unrtst ( 777550 )

> I think programmers would love to be paid to do a load of maintenance gruntwork.

Speak for yourself. Laziness is one of the three tenants of a good Perl programmer (Laziness, Impatience, and Hubris).

Details (Score:3)

by ThosLives ( 686517 )

The media articles are light on information. Are these issues that weren't in the preview releases, but only originated at the official release? This is the only way I'd put it on Apple.

If the changes were in the preview releases, what were these companies doing with those releases?

Re: (Score:3)

by 605dave ( 722736 )

Same question. As a dev I have been running the beta since its release. Did no one check for compatibility? Seems like a system change that would affect these services would not be something new in the RC.

Re: (Score:2)

by Z00L00K ( 682162 )

Given the recent events caused by Crowdstrike I'm not surprised that Apple no longer allows others into the inner workings of the operating system.

Re:Details (Score:4, Insightful)

by guruevi ( 827432 )

Apple announced that change 5 years ago when it released Catalina. You couldn't get any of those tools automatically deployed in the last 2 versions of macOS without putting specific commands in an MDM, so they just sat and waited until now. Basically if you have problems with Sequoia, you are exposing that your products are not being actively developed anymore.

Re: (Score:2)

by thegarbz ( 1787294 )

> Given the recent events caused by Crowdstrike I'm not surprised that Apple no longer allows others into the inner workings of the operating system.

This has nothing to do with "recent events". "Recent events" do not cause massive breaking updates to be pushed out to OSes (that's known as a cure worse than a disease). Apple have been reworking the network stack for MacOS 15 for nearly a year now, not only that Apple confirmed that Crowdstrike's implementation in MacOS wasn't capable of causing the issue they saw on Windows - so that alone was irrelevant for them.

Re: (Score:2)

by guruevi ( 827432 )

People at CrowdStrike, lol, no. They still haven't released official support for Ubuntu 24 or RHEL 9.4, they want us to stick to 9.2 which will be legacy in a few months for integration with our other security products.

Mac and Linux are not "first class citizens" in any security product. At least both of those OS allow me to limit their interaction with my files.

Re: (Score:2)

by guruevi ( 827432 )

If you were in the preview, you got notifications that those apps wouldn't be working anymore. You actually got warnings ... in CATALINA 5 years ago, that the equivalent of a "kernel driver" in Windows (kernel extensions) would be deprecated.

Re: (Score:2)

by thegarbz ( 1787294 )

This has nothing to do with your 5 year old warning. That kernel driver got depreciated long ago and isn't used (Apple even confirmed in July that Crowdstrike do not use any kind of kernel level access in MacOS and that the outage which occurred on Windows can't happen on Mac). Apple reworked the network stack and security APIs in MacOS and a few companies are slow to roll out updates.

Malwarebyts seems fine (Score:2)

by FictionPimp ( 712802 )

The only thing that changed with it was it requested access to scan the local network. Which I denied. It still works fine.

preemptive crowdstrike (Score:3)

by awwshit ( 6214476 )

We'll break your software before you can break ours!

CrowdStrike was pretty clear about it (Score:3)

by Guyle ( 79593 )

They said they weren't ready to support macOS Sequoia yet and to wait to deploy until they were ready. This is because Apple often makes last minute changes from the last beta to general release and they need time to sort things out. Apologies, can't link to the source because it's behind a CrowdStrike login.

Re: CrowdStrike was pretty clear about it (Score:2)

by Malc ( 1751 )

So they said that Apple often make changes rather than they actually made a change?

If Apple are in the wrong, they should come out and say it publicly instead of hiding it behind a login. Why would they let people question their integrity by not stating this?

Re: CrowdStrike was pretty clear about it (Score:2)

by ArmoredDragon ( 3450605 )

Because you're not a customer? Besides, macos isn't an enterprise product. It's a consumer OS. Meant for consumers only, not businesses. Nothing necessarily wrong with that, but if you're a business using macos then you should already expect shit like this to happen.

Re: (Score:2)

by ToasterMonkey ( 467067 )

> Meant for consumers only, not businesses.

lol

Do Linux is for hobbyists only next, good grief.

Security tools? (Score:3)

by Shag ( 3737 )

Would these be the security tools that you can install all of on a machine and let them fight it out? The ones that report each other as malware? (Sometimes, the ones from Microsoft that report other ones from Microsoft as malware?) I think I'll wait for more details about whose fault this actually is.

Re: (Score:2)

by NoMoreACs ( 6161580 )

> Would these be the security tools that you can install all of on a machine and let them fight it out? The ones that report each other as malware? (Sometimes, the ones from Microsoft that report other ones from Microsoft as malware?) I think I'll wait for more details about whose fault this actually is.

I'm pretty sure that, unless it's a dire emergency, Apple gives long advance notice for API changes, especially "breaking" ones. That has been their practice for decades, and I don't see that changing much in recent years.

Re: (Score:2)

by Ol Olsoc ( 1175323 )

> (Sometimes, the ones from Microsoft that report other ones from Microsoft as malware?)

Well, they aren't wrong, thou knowest!

Oh come on (Score:2)

by _dj6_ ( 8250908 )

This article should just read "Many fools think they can cross their fingers and upgrade their Mac to the next major macOS release version without testing all of their critical or risky software/drivers first." EITHER DO THE TESTING OR WAIT FOR YOUR VENDORS TO RELEASE COMPATIBLE VERSIONS IN THE MERE WEEK OR TWO AFTER THE MACOS RELEASE!!! Many vendors actually get their compatible release out BEFORE the OS drops...you just have to install it before you upgrade!!

So that's why the stock went up today (Score:3)

by RogueWarrior65 ( 678876 )

Up more than $8 a share today. Good things happen when you get rid of the barnacles.

Attention Satanists! (Score:1)

by Narcocide ( 102829 )

Maybe you should stop making every single major software release that coincides with one of your global orgies into a complete clusterfuck. Someone besides me might notice the pattern and start wondering why it seems that none of you can ever get your shit together around those days.

Right now hundreds of Anonymous Cowards are cheering the fact that only
Windows boobs are victims of ILOVEYOU and other email viruses. I realize
Outlook is so insecure that using it is like posting a sign outside your
door saying, "DOOR UNLOCKED -- ROB ME!". However, Linux isn't immune. If I
had a dollar for every pine buffer overflow uncovered, I could buy a
truckload of fresh herring.

I expect the next mass email virus to spread will be cross-platform. If
the recipient is a Windows/Outlook luser, they'll get hit. If the
recipient is a Linux/pine user, they'll find themselves staring at a
self-executing bash script that's has just allocated 1 petabyte of memory
and crashed the system (or worse).

Either that or the next mass email virus will only damage Linux systems. I
can just see Bill Gates assigning some junior programmer that very task.
Be afraid. Be very afraid.

-- A speech given at the First Annual Connecticut Conspiracy]
Convention (ConConCon) by an anonymous creature said to
be "wearing what appeared to be a tuxedo".