Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

modzero.com

Post reply on HN
Print view View original

31–40 of 167 posts

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#31

Post by mberning »

mrjin wrote: post #17
mberning wrote: post #11

Working as a developer inside large enterprise is increasingly intolerable by the day, made possible by tools such as crowdstrike falcon. By the time your workstation is saddled with endpoint security, DLP, zero trust networking, antivirus, etc. it barely functions. And you can get in trouble for doing anything. Installing tree from homebrew can get you flagged on some naughty list where you have to justify why you n…

Exactly. For competent developer, such tool is nothing but wasting time. The reason is simple: if they don't know what they are doing or cannot be trusted, they shouldn't be hired in the first place. But I do understand why those are in place: 1. There are lots of those who have no idea what they are doing in the organization. And/or 2. Some high up who have no idea what they are doing want to show their value. Such…

I think there is a lot of value in these tools for the enterprise. Even if it is just CYA insurance. If somebody steals data but you have a DLP tool you can just blame the vendor. My biggest issue with the tools is they have an insanely deleterious impact on performance and the harsh scrutiny applied has a chilling effect on employees. It turns people into drones that do not dare step outside the norm.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#32

Post by mdbug »

cr3ative wrote: post #24

Refusing to interact with an existing security process (HackerOne) and demanding a personal contact instead for a minor issue is certainly an interesting take.

You find "interesting" that someone just wants to report a security vulnerability without having to accept any conditions first?

Funny, I find it interesting that they want to pay a bugbounty even though nobody asked for it. But I guess paying hush money is just cheaper than having to seriously fix the issue.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#33

Post by CoastalCoder »

cr3ative wrote: post #24

Refusing to interact with an existing security process (HackerOne) and demanding a personal contact instead for a minor issue is certainly an interesting take.

I don't get the impression that the researchers were simply being lazy or attention-seeking.

They objected to having to sign an NDA, when there was no clear incentive to legally bind themselves in that manner.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#34

Post by BeefWellington »

jeroenhd wrote: post #8

Sounds like they expect everyone to be out for a bounty rather than to improve someone else's software so they probably have a contract with HackerOne to let them do all the annoying hard work dealing with security researchers. Personally, I would've released the PoC back in July when they said the problem was resolved. No need to ask if the quote can be used, it's exactly what they told the security researchers afte…

What's interesting is there are roles out there where you are not permitted to participate in bug bounty programs. I've worked a few positions where the company outright refused to allow compensation and I wouldn't have been authorized to sign an NDA on behalf of my company just to report issues to a third party.

It created a lot of friction but I kind of understand the policy.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#35

Post by [deleted] »

nikanj wrote: post #30
boondaburrah wrote: post #26

Earlier quoted context omitted.

They fixed it with an update this month, but CrowdStrike was hooking /every/ single call to NtCreateUserProcess on my work machine last month, and you /know/ how electron-based apps work. VSCode took so long to launch its sub processes it would pop up a crash reporter. "Hello World" compiled from C++ would take a minute to launch sometimes. WSL straight up could not be started because the TTY timed out waiting for it…

Because your organization's customers demanded your employer get some security certificate, and part of that certification is hoisting that BS on all users

[deleted]

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#36

Post by rroot »

cr3ative wrote: post #24

Refusing to interact with an existing security process (HackerOne) and demanding a personal contact instead for a minor issue is certainly an interesting take.

It's interesting that they don't want to sign an NDA when there's absolutely nothing in it for them. Utterly astonishing. I'm hopping mad.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#37

Post by TecoAndJix »

nikanj wrote: post #18
TecoAndJix wrote: post #16

Earlier quoted context omitted.

There is a LOT of snake oil in the industry, but endpoint protection IS useful. Not every person is a Hacker News reading tech enthusiast. People download and do dumb shit. That is not to say every device needs it and at a max “check every process/file activity” level, though.

10% of Falcon is blocking dumb shit people do. 90% is blocking things people are supposed to be doing, and have been doing successfully so far. Nothing starts your week better than "After the latest definitions update, Falcon heuristic started quarantining your core business tools as suspicious".

I feel your pain at a deep and spiritual level. I have been in charge of at least half a dozen endpoint protection products over the years (deployment, configuration, management, etc.). Once a user experiences what you just described they are (rightfully) suspicious and sour towards endpoint protection.

Questions i would ask in your example: 1) Was the core business tool excluded from the more intrusive protection modules or does the tool have a significant risk surface? 2) What was the threshold set for quarantining? Does it make sense in this case? 3) Is/should your device be part of a "Developer" policy that is more permissive? Are all users of the tool impacted? 4) Does this happen frequently? If so, should definitions be manually pushed in batches so everyone is not nerfed at once. 5) What is the process for the developer to report/fix the false positive? Is the response time sufficient?

I'm probably forgetting a few. The point is, shit happens (especially with technology). You respond, fix, and hopefully learn. If shit happens a lot, its either because the tool owner doesn't give a shit or the product is shit itself. The delicate balance of security and business operations/innovation is all about weighing and evaluating risk/benefit.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#38

Post by rroot »

thisdrunkdane wrote: post #29
red_trumpet wrote: post #23

Earlier quoted context omitted.

A bit speculative, but the word "NDA" appears four times in their post.

Yea I noticed that, but what do they specifically not like about the NDA? afaik, HackerOne still makes vulnerability disclosure possible (and automatic if taking too long?)

I guess the specifics are the letters N, D and A and what they stand for. And the fact that there's absolutely nothing in it for them.

Would you even consider signing an NDA if I sent you one? I surely hope not.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#39

Post by [deleted] »

rroot wrote: post #38
thisdrunkdane wrote: post #29

Earlier quoted context omitted.

Yea I noticed that, but what do they specifically not like about the NDA? afaik, HackerOne still makes vulnerability disclosure possible (and automatic if taking too long?)

I guess the specifics are the letters N, D and A and what they stand for. And the fact that there's absolutely nothing in it for them. Would you even consider signing an NDA if I sent you one? I surely hope not.

[deleted]

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#40

Post by vladvasiliu »

mberning wrote: post #31
mrjin wrote: post #17

Earlier quoted context omitted.

Exactly. For competent developer, such tool is nothing but wasting time. The reason is simple: if they don't know what they are doing or cannot be trusted, they shouldn't be hired in the first place. But I do understand why those are in place: 1. There are lots of those who have no idea what they are doing in the organization. And/or 2. Some high up who have no idea what they are doing want to show their value. Such…

I think there is a lot of value in these tools for the enterprise. Even if it is just CYA insurance. If somebody steals data but you have a DLP tool you can just blame the vendor. My biggest issue with the tools is they have an insanely deleterious impact on performance and the harsh scrutiny applied has a chilling effect on employees. It turns people into drones that do not dare step outside the norm.

> If somebody steals data but you have a DLP tool you can just blame the vendor.

This is just about the main thing that bugs me with this kind of tool: sure you can blame the vendor, but the data is still stolen.

And companies are happy to have checked that box and won't bother implementing actually useful policies.

Post reply on HN