Microsoft's global sprawl under fire from regulators after Windows outage • Hacker News Board

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#91

Post by AstralStorm » Sun, Jul 21, 2024, 1:13 PM UTC

ehsankia wrote: post #46

gruez wrote: post #6

It seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?

I'm curious what people think, but while obviously CrowdStrike caused the breakage, does the Operating System not have some responsibility in not allowing such outages to happen? Especially if it's an enterprise product? Ideas: 1. Microsoft themselves could potentially enforce a gradual rollout on updates (did the update go through windows updates?) 2. Have better automatic recovery options, could windows have detect…

They have tried some experiments in this area, like CLR drivers and altogether different kernel.

Nothing stuck for a variety of reasons...

Reverting security to an insecure state is called a downgrade attack. Can't allow that.

What could be done is a better Safe Mode with Networking that would allow for secure remoting over an AD enterprise configuration... And the machines configured to automatically enter that mode. Still bit of a security issue potential.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#92

Post by slowmovintarget » Sun, Jul 21, 2024, 1:14 PM UTC

teekert wrote: post #29

gruez wrote: post #6

It seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?

So normies in governments are finally seeing the issues, it’s for the wrong reason indeed, but is it though? It could have been an MS trip up and then it may have been worse even…

Microsoft personnel are usually more careful with existential risks... usually.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#93

Post by slowmovintarget » Sun, Jul 21, 2024, 1:15 PM UTC

dlahoda wrote: post #8

gruez wrote: post #6

It seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?

is not it the case that kernel drivers are signed and approved by microsoft?

Drivers yes, virus signature files or configuration files pushed by third parties, no.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#94

Post by AstralStorm » Sun, Jul 21, 2024, 1:20 PM UTC

bilekas wrote: post #10

dlahoda wrote: post #8

Earlier quoted context omitted.

is not it the case that kernel drivers are signed and approved by microsoft?

I'm not aware of Microsoft signing off on vendor kernal drivers code changes. Driver signing is not a Quality Assurance measure. It's an identify measure.

More importantly, the code signing is a security measure. You can in theory vet the signature database by hand preventing the execution of unapproved drivers.

Microsoft normally puts it in revocation mode only, with bad drivers with unfixed holes being blocked.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#95

Post by AstralStorm » Sun, Jul 21, 2024, 1:24 PM UTC

rewgs wrote: post #54

gruez wrote: post #6

It seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?

There is a frustrating amount of nuance being lost in this discussion, and as usual it's devolving into tribalism. However, I'll say that, while this clearly is not Microsoft's fault, the realization of just how much critical infrastructure is running on Windows -- let alone Windows that's connected to the internet and has automatic updates enabled -- was sobering. Are kernel mode drives maybe a bad idea? Yes! Should…

Windows specifically does not allow automated rollback in case of boot drivers because:

a) that generally does not work, because the driver is required to boot into recovery environment

b) even if it did, for security like this, downgrade attacks are a consideration

and most importantly

c) in this case, Windows does not have a full backup of previous external configuration because this was not a driver update

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#96

Post by AstralStorm » Sun, Jul 21, 2024, 1:26 PM UTC

josephcsible wrote: post #84

gruez wrote: post #77

Earlier quoted context omitted.

>There should be a mechanism to go back to ‘last known good’ regardless of kernel level issues. Innovations like Fedora Silverblue with ostree and greenboot tech should be adopted by Windows. Can you explain how they work? AFAIK the issue is that they pushed a bad config file, and that's the thing that caused the crash, not a new driver. Are those systems going to roll back every file ever to try to recover themselve…

> Are those systems going to roll back every file ever to try to recover themselves? Isn't that totally feasible with things like Btrfs snapshots?

It is, assuming your disk driver or related drivers aren't the ones failing.

Then again, nothing is preventing an update loop here.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#97

Post by gruez » Sun, Jul 21, 2024, 2:23 PM UTC

dissent wrote: post #90

gruez wrote: post #6

It seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?

I go the other way, it's absolutely their fault. Their historical business model of monopolizing the enterprise while outsourcing security is at the root of all this. The same thing could happen with Crowdstrike on other platforms, but it's only on Windows where these suites are considered essential.

>but it's only on Windows where these suites are considered essential.

They're "considered essential" for all corporate machines for compliance and CYA reasons. If you're the CISO/CTO and a hack occurred on your watch, do you really want to be the one telling the board that you didn't need EDR on your linux machines because linux is secure?

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#98

Post by bwock » Sun, Jul 21, 2024, 2:47 PM UTC

dlahoda wrote: post #25

dlahoda wrote: post #21

Earlier quoted context omitted.

how 8.5M devices got approval to install? may they came with hard to disable windows autoupdate?

gpt said it could be updated by ms https://chatgpt.com/share/8eca1a08-062f-4474-9310-95444bab67...

this isnt a good contribution to this site

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#99

Post by shadowgovt » Sun, Jul 21, 2024, 3:40 PM UTC

ehsankia wrote: post #46

gruez wrote: post #6

It seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?

I'm curious what people think, but while obviously CrowdStrike caused the breakage, does the Operating System not have some responsibility in not allowing such outages to happen? Especially if it's an enterprise product? Ideas: 1. Microsoft themselves could potentially enforce a gradual rollout on updates (did the update go through windows updates?) 2. Have better automatic recovery options, could windows have detect…

What responsibility does the Linux bear if you write your own kernel module, install it, and it bricks your machine until you boot into a different OS?

There are limits to the sensible responsibility of the operating system vendor / maintainer. They stopped somewhere south of "mutating core configuration of the OS itself," because if they don't, the owner doesn't control their own computer.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#100

Post by dissent » Sun, Jul 21, 2024, 5:51 PM UTC

gruez wrote: post #97

dissent wrote: post #90

Earlier quoted context omitted.

I go the other way, it's absolutely their fault. Their historical business model of monopolizing the enterprise while outsourcing security is at the root of all this. The same thing could happen with Crowdstrike on other platforms, but it's only on Windows where these suites are considered essential.

>but it's only on Windows where these suites are considered essential. They're "considered essential" for all corporate machines for compliance and CYA reasons. If you're the CISO/CTO and a hack occurred on your watch, do you really want to be the one telling the board that you didn't need EDR on your linux machines because linux is secure?

It's a culture that has grown up around a dominant platform that had little or no security built in. Where I work, Windows is heavily locked down with all sorts of security junk on it, but iOS gets by with minimal MDM.