Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor • Hacker News Board

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#111

Post by FreakLegion » Mon, Aug 22, 2022, 7:17 PM UTC

horsawlarway wrote: post #70

FreakLegion wrote: post #5

Earlier quoted context omitted.

> Even modzero themselves admitted that the vulnerability is not of great severity They're wrong. It's not at all uncommon for companies to give employees admin, and privilege escalation tends to be easy on Windows anyway. > CrowdStrike has no obligation in providing them with free trials or such in verifying a vulnerability fix Sure, and modzero has no obligation to responsibly disclose, and now here we are. I'm sur…

I mean... as a user on the machine, if I have admin rights there's very, very little they can meaningfully do to stop me from removing their software. Hooking a token into their uninstaller is hardly sufficient... I have SO much surface area to attack that I don't genuinely think you can call this anything other than trivial. For an admin user, I'd take this token prompt more as a "Hey - you're about to violate compa…

CrowdStrike has kernel code meant to stop everything you mention minus the network part (and being offline should have minimal impact on the security of the system), but in practice I'm sure you're right. It's easy enough to get attacks past them that frankly I haven't bothered trying to disable the agent.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#112

Post by monocasa » Mon, Aug 22, 2022, 7:20 PM UTC

tptacek wrote: post #67

FreakLegion wrote: post #5

Earlier quoted context omitted.

> Even modzero themselves admitted that the vulnerability is not of great severity They're wrong. It's not at all uncommon for companies to give employees admin, and privilege escalation tends to be easy on Windows anyway. > CrowdStrike has no obligation in providing them with free trials or such in verifying a vulnerability fix Sure, and modzero has no obligation to responsibly disclose, and now here we are. I'm sur…

"Responsible" disclosure is an Orwellian term. The real term is "coordinated disclosure", and, as you can see from the timeline, there's coordination here.

"Coordinated disclosure" is the orwellian reimagining here. The only reason why the industry settled on the responsible disclosure process is that works regardless of how much vendor coordination occurs, or even if they are technically responding to emails but really just stalling indefinitely.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#113

Post by ajross » Mon, Aug 22, 2022, 7:24 PM UTC

detaro wrote: post #99

ajross wrote: post #96

Earlier quoted context omitted.

The thing is, "releasing our findings to the public" puts the vendor's customers at risk, it's not just some imagined Just Punishment For The Guilty, innocents get hurt. Imagine if you took a new job and they had a bunch of hardware sitting around from such a vendor. Would you be OK if someone published an exploit for your systems? (In this case, the vulnerability seems minor, so it's sort of academic. But I'm not un…

You can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, because just because you aren't exploiting it doesn't mean nobody else will find it. Modzero was even following a more conservative playbook here: not setting a deadline from the start, but only talking about release once the vendor indicated there was no issue (a…

> You can't let vendors hide security problems by just not doing anything about them.

Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#114

Post by FreakLegion » Mon, Aug 22, 2022, 7:29 PM UTC

microtonal wrote: post #12

FreakLegion wrote: post #5

Earlier quoted context omitted.

> Even modzero themselves admitted that the vulnerability is not of great severity They're wrong. It's not at all uncommon for companies to give employees admin, and privilege escalation tends to be easy on Windows anyway. > CrowdStrike has no obligation in providing them with free trials or such in verifying a vulnerability fix Sure, and modzero has no obligation to responsibly disclose, and now here we are. I'm sur…

possibly the origin of named and marketed vulnerabilities. Heartbleed is older (2014).

Incredible! In my mental timeline VENOM came first, maybe because we had to pull an all-nighter.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#115

Post by xphos » Mon, Aug 22, 2022, 7:32 PM UTC

ajross wrote: post #96

outworlder wrote: post #93

Earlier quoted context omitted.

> Bug disclosure without a known remedy has to be an absolute last resort kind of thing, and it's actually a little upsetting that modzero used that tactic as a kind of threat I don't think it is upsetting at all. "We found a vulnerability" "There's no vulnerability" "No, you misunderstand, here's how it works and how to exploit" "Naah, no vulnerability" "Ok, if there's no vulnerability as you claim, you don't mind u…

The thing is, "releasing our findings to the public" puts the vendor's customers at risk, it's not just some imagined Just Punishment For The Guilty, innocents get hurt. Imagine if you took a new job and they had a bunch of hardware sitting around from such a vendor. Would you be OK if someone published an exploit for your systems? (In this case, the vulnerability seems minor, so it's sort of academic. But I'm not un…

I don't think its the job of Security Researchers to defend a OEMs customers. That's the OEMs job? If the OEM does not want to protect its customers after a research has literally given the vulnerability to them its no longer on the researcher. In fact its probably bad ethics for the researcher not to publish because just because there is no report does not mean the bug is not exploited or known by malicious actors. The researchers last recourse is to publish a notification to let the OEMs customers there is an issue since the OEM won't acknowledge it.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#116

Post by paulryanrogers » Mon, Aug 22, 2022, 7:33 PM UTC

ajross wrote: post #96

outworlder wrote: post #93

Earlier quoted context omitted.

> Bug disclosure without a known remedy has to be an absolute last resort kind of thing, and it's actually a little upsetting that modzero used that tactic as a kind of threat I don't think it is upsetting at all. "We found a vulnerability" "There's no vulnerability" "No, you misunderstand, here's how it works and how to exploit" "Naah, no vulnerability" "Ok, if there's no vulnerability as you claim, you don't mind u…

The thing is, "releasing our findings to the public" puts the vendor's customers at risk, it's not just some imagined Just Punishment For The Guilty, innocents get hurt. Imagine if you took a new job and they had a bunch of hardware sitting around from such a vendor. Would you be OK if someone published an exploit for your systems? (In this case, the vulnerability seems minor, so it's sort of academic. But I'm not un…

> The thing is, "releasing our findings to the public" puts the vendor's customers at risk

If vendor denies there is a problem despite repeated submissions of evidence then customers are already at risk indefinitely.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#117

Post by jeroenhd » Mon, Aug 22, 2022, 7:34 PM UTC

ajross wrote: post #113

detaro wrote: post #99

Earlier quoted context omitted.

You can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, because just because you aren't exploiting it doesn't mean nobody else will find it. Modzero was even following a more conservative playbook here: not setting a deadline from the start, but only talking about release once the vendor indicated there was no issue (a…

> You can't let vendors hide security problems by just not doing anything about them. Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?

Telling the customers that there's a vulnerability will make them turn to their vendor. The vendor will obviously lie and say there's no vulnerability, everything is fine, ignore the panic.

Without the necessary details telling the public about a vulnerability is like shouting at a wall. Publishing the details forces vendors to release fixes when they deny the existence of the vulnerability.

This isn't some hidden password or evil DoS attack, this is an attack only processes with admin access can leverage on infected machines. This command is either executed by a computer user (which should flag a warning in the management software) or it's executed by a virus with admin permissions that went undetected by the antivirus solution on the machine. The stakes are low enough and the vendor is irresponsible enough that I don't see a problem with publishing a PoC when vendors lie about these kinds of bugs.

Of course remote exploitation and auth bypass PoCs shouldn't be released into the wild without trying to get a patch out first, but even still vendors like D-Link just don't seem to care if you don't at least threaten them with releasing the details to the public.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#118

Post by xphos » Mon, Aug 22, 2022, 7:35 PM UTC

ajross wrote: post #113

detaro wrote: post #99

Earlier quoted context omitted.

You can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, because just because you aren't exploiting it doesn't mean nobody else will find it. Modzero was even following a more conservative playbook here: not setting a deadline from the start, but only talking about release once the vendor indicated there was no issue (a…

> You can't let vendors hide security problems by just not doing anything about them. Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?

This kind of thinking does not protect customers though. We can all pretend there is no vulnerability but that does not mean there isn't a vulnerability. This is kind of "Don't look up" thinking. The spectrum here was they tried with the OEM and the OEM said let it burn by snubbing the researchers. The researchers than attempted to let customers know since the OEM did not want to protect them.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#119

Post by paulryanrogers » Mon, Aug 22, 2022, 7:37 PM UTC

ajross wrote: post #113

detaro wrote: post #99

Earlier quoted context omitted.

You can't let vendors hide security problems by just not doing anything about them. People deserve to know if the product they rely on has vulnerabilities, because just because you aren't exploiting it doesn't mean nobody else will find it. Modzero was even following a more conservative playbook here: not setting a deadline from the start, but only talking about release once the vendor indicated there was no issue (a…

> You can't let vendors hide security problems by just not doing anything about them. Telling people that the product they rely on has vulnerabilities is clearly not the same thing as "release the vulnerability report" though, is it? I still remain amazed at the absolutism in the arguments here. There is a spectrum of responses that can be explored before dropping bombs. But everyone wants to see stuff burn?

So what's the intermediate step on the spectrum? Publicly call out the vendor and model, yet vaguely enough that others will have to find the specific gap(s)? Tell the press?

If one publicly discloses some mitigation it's usually enough to give malicious actors enough to go on anyway.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#120

Post by matheusmoreira » Mon, Aug 22, 2022, 7:47 PM UTC

ajross wrote: post #87

jeroenhd wrote: post #8

Sounds like they expect everyone to be out for a bounty rather than to improve someone else's software so they probably have a contract with HackerOne to let them do all the annoying hard work dealing with security researchers. Personally, I would've released the PoC back in July when they said the problem was resolved. No need to ask if the quote can be used, it's exactly what they told the security researchers afte…

> Personally, I would've released the PoC back in July when they said the problem was resolved. Dropping a zero day on the public is never acceptable, regardless of how disingenuous a device manufacturer is being. Bug disclosure without a known remedy has to be an absolute last resort kind of thing, and it's actually a little upsetting that modzero used that tactic as a kind of threat ("As the issue was not considere…

It is absolutely acceptable. Corporate negligence harms everyone. If disclosing vulnerabilities is what it takes to force them to do something about them, so be it.