Malware As A Service

Funny how CrowdStrike already sounds like some malware’s name.

It literally sounds like a DDoS!
- Botnet if you will
Not too surprising if the people making malware, and the people making the security software are basically the same people, just with slightly different business models.
- Reminds me of the tyre store that spreads tacks on the road 100m away from their store in the oncoming lanes.
  
  People get a flat, and oh what do you know! A tyre store! What a lucky coincidence.
- Classic protection racket. "Those are some nice files you've got there. It'd be a shame if anything happened to them..."
It sounds like the name of a political protest group.

This is, in a lot of ways, impressive. This is CrowdStrike going full "Hold my beer!" about people talking about what bad production deploy fuckups they made.

You know you’ve done something special when you take down somebody else’s production system.
- *production systems around whole world
I'm volunteering to hold their beer.

Everyone remember to sue the services not able to provide their respective service. Teach them to take better care of their IT landscape.
- Typically auto-applying updates to your security software is considered a good IT practice.
  
  Ideally you'd like, stagger the updates and cancel the rollout when things stopped coming back online, but who actually does it completely correctly?

The real malware is the security software we made along the way.

We've known that since Norton and McAfee.
- At least McAfee's antics were entertaining
After working at a company that had Crowdstrike installed on all machines, it is most certainly malware.

Can't get hacked if your machine isn't running.

You’re hired!
- Idk boss, people weren't too happy the last time we tried that.

The answer is obviously to require all users to change their passwords and make them stronger. 26 minimum characters; two capitals, two numbers, two special characters, cannot include '_', 'b' or the number '8', and most include Pi to the 6th place.

Great! Now when I brute force the login, I can tell my program to not waste time trying '_', 'b' and '8' and add Pi to the 6th place in every password, along with 2 capitals, 2 numbers and 2 other special characters.

Furthermore, I don't need to check passwords with less than 26 characters.
Sorry, I don’t understand. Do you mean there have to be 6 digits of Pi in there, or the sixth character must be π? I’m down either way.
- We won't tell you, and the rule gets re-rolled every 14 seconds. It may stay the same or it may change.
The modern direction is actually going the other way. Tying identity to hardware, preventing access on unapproved or uncompliant hardware. It has the advantage of allowing biometrics or things like simple pins. In an ideal world, SSO would ensure that every single account, across the many vendors, have these protections, although we are far from a perfect world.
- SSO means you only need to compromise one piece of hardware to get access to everything.

What’s the saying about dying a hero or becoming the villain?

Maybe this is a case of hindsight being 20/20 but wouldn't they have caught this if they tried pushing the file to a test machine first?

It's not hindsight, it's common sense. It's gross negligence on CS's part 100%
- Well, it is hindsight 20/20... But also, it's a lesson many people have already learned. There's a reason people use canary deployments lol. Learning from other people's failures is important. So I agree, they should've seen the possibility.
I saw one rumor where they uploaded a gibberish file for some reason. In another, there was a Windows update that shipped just before they uploaded their well-tested update. The first is easy to avoid with a checksum. The second...I'm not sure...maybe only allow the installation if the windows update versions match (checksum again) :D
- Windows has beta channels for their updates
It's a sequence of problems that lead to this:

The kernel driver should have parsed the update, or at a minimum it should have validated a signature, before trying to load it.

There should not have been a mechanism to bypass Microsoft's certification.

Microsoft should never have certified and signed a kernel driver that loads code without any kind signature verification, probably not at all.

Many people say Microsoft are not at fault here, but I believe they share the blame, they are responsible when they actually certify the kernel drivers that get shipped to customers.

Now threat actors know what EDR they are running and can craft malware to sneak past it. yay(!)

Smart threat actors use the EDR for distribution. Seems to be working very well for whoever owned Solar Winds.

A real Anakin arc right here.

SHOULD'VE USED OPENBSD LMAO

Yes but the difference is one of them is also going to help you fix it.

For additional payment

Who says it was accidental?

Netflix knew they were going to move from DVD rentals to streaming over the Internet. It is right in their name.

CrowdStrike knew they were eventually going to _________. It is right in their name.

ItS NoT A wInDoWs PrObLeM -- Idiots, even on Lemmy

I genuinely can't tell at whom you are addressing this. Those claiming it is a Windows problem or those that say otherwise?
You can not like windows, and also recognize that CrowdStrike isn't from Microsoft - so a problem that CrowdStrike caused isn't the fault of Windows.

If that makes me a idiot by holding two different ideas in my head, so be it, but you are spending time with us, so thank you for elevating us!
- I'm sorry, but distinguishing between different concepts is forbidden here. You go straight to jail.
- I'm waiting for the post mortem before declaring this to not be anything to do with MS tbh. It's only affecting windows systems and it wouldn't be the first time dumb architectural decisions on their part have caused issues (why not run the whole GUI in kernel space? What's the worst that could happen?)
Hi, idiot here. Can you explain how it is a windows problem?
- It's a problem affecting Windows, not problem caused by Windows I guess.
- If you patch a security vulnerability, who's fault is the vulnerability? If the OS didn't suck, why does it need a 90 billion dollar operation to unfuck it?
  
  Redhat is VALUED at less than that.
  
  https://pitchbook.com/profiles/company/41182-21
  
  It's a fucking windows problem.
"even on Lemmy"

Like this is some highbrow collection of geniuses here?
- No just statistically we are all Arch (btw) Linux users who hate Windows.
Because it isn't. Their Linux sensor also uses a kernel driver, which means they could have just as easily caused a looping kernel panic on every Linux device it's installed on.
- There's no way of knowing that, though. Perhaps their Linux and Darwin drivers wouldn't have paniced the system?
  
  Regardless, doing almost anything at the kernel level is never a good idea
Tell me you don't have any clue about IT without telling me you don't have any clue about IT. Good job!