Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

modzero.com

Post reply on HN
Print view View original

161–167 of 167 posts

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#161

Post by patchtopic »

arminiusreturns wrote: post #49
pnemonic wrote: post #46

Earlier quoted context omitted.

Your sources are from thegrayzone? You should learn to consider your sources...

The GrayZone has been impeccable in their reporting, with any errors quickly being admitted and disclosed. Of course many people disagree with them, and love to try character assassination and other ad hominems, but I've found them informative and having integrity. Maybe you should elaborate your reasoning. To elaborate further: "Leaked emails reveal British journalist Paul Mason plotting with an intel contractor to…

not a credible source https://rationalwiki.org/wiki/The_Grayzone

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#162

Post by egberts1 »

tptacek wrote: post #139
roblabla wrote: post #132

Earlier quoted context omitted.

The problem is with the publishing part. It's pretty unclear - to me at least - what the legal status of publishing 0days is around the world. In the USA, I'd expect it to be protected by free speech, but even then I wouldn't be 100% sure.

Publishing vulnerabilities in the US is protected speech. You get in trouble with disclosing vulnerabilities in the US in four ways, ordered from most to least common: 1. You tested someone else's servers, and not software running on your own computer, and you didn't get permission or adhere to the rules of engagement the target established. Now you're not a researcher, you're an intruder, subject to CFAA. There's a…

great stuff. then there’s about many more US laws outside of CFAA.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#163

Post by jcims »

tptacek wrote: post #139
roblabla wrote: post #132

Earlier quoted context omitted.

The problem is with the publishing part. It's pretty unclear - to me at least - what the legal status of publishing 0days is around the world. In the USA, I'd expect it to be protected by free speech, but even then I wouldn't be 100% sure.

Publishing vulnerabilities in the US is protected speech. You get in trouble with disclosing vulnerabilities in the US in four ways, ordered from most to least common: 1. You tested someone else's servers, and not software running on your own computer, and you didn't get permission or adhere to the rules of engagement the target established. Now you're not a researcher, you're an intruder, subject to CFAA. There's a…

Excellent breakdown! The reason I was thinking of safe harbor is that most bug bounties tend to explicitly grant permission to folks participating in the program. It’s usually walled off by some scoping criteria but it’s part of the deal.

The thing that seems a little iffy for me with crowdstrike is that it’s an agent that calls back to services. It seems plausible that I could unintentionally break something in their environment while testing their software.

I like how you wrapped it up though and totally agree.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#164

Post by horsawlarway »

conioh wrote: post #158
horsawlarway wrote: post #70

Earlier quoted context omitted.

I mean... as a user on the machine, if I have admin rights there's very, very little they can meaningfully do to stop me from removing their software. Hooking a token into their uninstaller is hardly sufficient... I have SO much surface area to attack that I don't genuinely think you can call this anything other than trivial. For an admin user, I'd take this token prompt more as a "Hey - you're about to violate compa…

> I can steal the network, change the registry, simply delete their binaries, update shared dlls, or any number of other easy hacks to get them offline. That's a bold claim. Mostly incorrect, but bold. A proper Windows endpoint protection software's Registry filter will prevent you from modifying its Registry data; its filesystem minifilter will prevent you from modifying its files; its EXEs will use the Windows miti…

It IS trivial. Period.

If you don't want people to modify the machine - don't give them admin access.

If you give them admin access... don't assume they won't modify the machine.

For comparison - I worked software security for 5 years dealing with fortune 100 banks. I have zero faith in the industry. It's mostly a shell game for liability.

I can absolutely do the things I mentioned above. At best, it's a discussion of how hard I'll have to work. So again... this is basically a "hey - you're about to violate company policy" notice.

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#165

Post by nikanj »

zdragnar wrote: post #86
semi-extrinsic wrote: post #59

Earlier quoted context omitted.

Can I ask, since you're as a person who has administered endpoint protection products: how much legitimate stuff do they actually catch?

Not OP, but I've worked for an endpoint protection product company. Part of the onboarding was them loading up a virtual machine with the endpoint installed, then demonstrating several attacks (installing malicious software, running scripts off the internet, etc) and showing the logs of what the endpoint detected, and at what point it shut down the malicious behavior. The examples shown were behavior based, not hash…

You should’ve also demonstrated attacks like ”open the line-of-business app we’ve used daily for years”. My problem is not the hit rate on actual attacks, it’s the hit rate on collateral damage

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#166

Post by manholio »

tptacek wrote: post #139
roblabla wrote: post #132

Earlier quoted context omitted.

The problem is with the publishing part. It's pretty unclear - to me at least - what the legal status of publishing 0days is around the world. In the USA, I'd expect it to be protected by free speech, but even then I wouldn't be 100% sure.

Publishing vulnerabilities in the US is protected speech. You get in trouble with disclosing vulnerabilities in the US in four ways, ordered from most to least common: 1. You tested someone else's servers, and not software running on your own computer, and you didn't get permission or adhere to the rules of engagement the target established. Now you're not a researcher, you're an intruder, subject to CFAA. There's a…

Wonderful!

Re: Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

#167

Post by UncleMeat »

0x457 wrote: post #133
bsamuels wrote: post #77

Earlier quoted context omitted.

Seriously. I don't think the researcher realizes how many people try to bypass hackerone because H1 would have flagged their finding as invalid. Using h1 isn't about bug bounties, it's about not having to spend a 1-2 of your team's full time engineers triaging security researcher reports.

We had some of the dumbest H1 "findings" at some companies that I worked: - Service that is explicitly out of scope of program is "leaking" default CloudFront headers. - Android application can be decompiled (that's it, not secret is there, just the fact that it's possible) - "I can do something bad IF I had a way to load malicious JavaScript" (no, CSRF protection was one and correctly implemented) (there is also no…

Not only have I seen similarly stupid reports, I’ve received death threats from “researchers” who didn’t receive the payout they expected for basically clicking “inspect element” in their browser.
Post reply on HN