DSEASDK on MacOS: Is it Malware?

For a long time my MacBook Pro has been flattening its battery surprisingly quickly, even when in Sleep mode. It had got to the stage that I'd leave it sleeping overnight and have to charge it in the morning before I could use it.

"Using Significant Energy" on the battery taskbar applet showed nothing untoward. However, one day I noticed a process I didn't recognise using up a lot of CPU cycles in Activity Monitor: DSEASDK.

It took a surprising amount of sleuthing to work out what DSEASDK was and why it was there. Apparently not many people have googled for an answer to this. So here's the answer.

What is DSEA SDK?

DSEA SDK, or DSEASDK as it appears in Activity Monitor on MacOS, is an SDK (not surprisingly) that in my case was supporting another process. The other process was shown as being part of a package called EPOS Connect. This puzzled me, as I don't do anything involving Electronic Point of Sale. So my first thought was that it could easily be malware.

DSEASDK was running automatically on my Mac on startup, and because of the way it's installed, it doesn't appear as a login item, and can't be disabled in the usual way. Killing the process would stop it briefly and then it would restart. This is exactly what you'd expect from malware. Again, finding out the true provenance of DSEASDK and EPOS Connect took some more digging.

What the hell is EPOS Connect and why is it installing crapware on my Mac?

Turns out it's nothing to do with Electronic Point of Sale. This link showed that EPOS Connect is - get this - "a desktop application that enables the user to update EPOS devices with the latest available firmware, configure the device to the preferred settings and connect EPOS devices seamlessly with the range of softphones.

"The IT administrator in a company may deploy firmware and specific setting to the users of EPOS Connect. This is achieved by EPOS Manager in combination with EPOS Connect."

Finding out you've got something running on your Mac which seems to be allowing an unknown remote administrator to deploy updates is a really great way to reinforce any suspicions that this is malware. But, it turns out...

The company behind EPOS Connect is EPOS Audio. They seemingly have nothing to do with EPOS. However, they're the parent company of Sennheiser, maker of headphones and other consumer and semi-pro audio equipment. I have some of their stuff - headphones and mics, mainly.

Why are EPOS Connect and DSEASDK installed on my Mac?

A few months ago I'd been having some issues with a pair of Sennheiser wireless headphones. It seemed worth checking they had the latest firmware. So I'd downloaded and run a legitimate firmware update tool via Sennheiser's official website.

Rather than install an app which updated the firmware, Sennheiser had installed the firmware update tool into /Library/Application Support, into two subfolders: DSEA and EPOS Connect.

The binaries in these subfolders had been set to run automatically on startup. Because they weren't running as normal apps, they wouldn't appear in the Dock, Task Bar, Force Quit Applications or any of the normal places you'd expect to see legitimate applications.

DSEASDK had been installed in such a way that even if you found the process and killed it, it'd restart automatically. In short, Sennheiser have designed their headphone firmware update tool to behave in exactly the same way you'd expect malware to behave, and to hell with the battery life of their customers.

Why they've chosen this approach in 2023, I have no idea, but let's just say it's a completely shitty way to treat your customers, as (a) it kills the battery life on your MacBook, even when it's sleeping, (b) they've made it very difficult to work out what's causing this, and (c) there's absolutely no need for a firmware update tool to auto-launch itself to run constantly in the background.

So Sennheiser, if you're reading this - screw you, assholes. Seriously, bite me. This is no way for a legitimate company to do business.

How do I uninstall DSEASDK and EPOS Connect from my Mac?

Once you understand what these malware-wannabee processes are doing and where they are, it's actually easy to get rid of them. It's the obfuscation part that makes it tricky.

Open Finder.
In the Go menu, select "Go to Folder..."
Enter /Library/Application Support/
When the folder opens, look for the DSEA subfolder. Delete it.
Also find the EPOS Connect subfolder. Delete that too.
While I was in there I also noticed a Sennheiser subfolder. I deleted that too, because who knows what other shitty antics they're getting up to.
Empty your trash.
Restart the machine.
Open Activity Monitor, and check that DSEASDK is no longer running.

Summary

If you're finding your MacBook Pro battery life is being hammered, and you're a Sennheiser customer, consider that you may have inadvertently installed a piece of complete crapware to update your Sennheiser firmware.

If you want to get rid of this crapware and restore your MacBook Pro to health, the instructions to delete it can be found above.

< Older Post