Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike will be liable for damages in France, based on the OVH precedent

thehftguy.com

Post reply on HN
Print view View original

261–270 of 285 posts

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#261

Post by amluto »

ongy wrote: post #239
amluto wrote: post #70

Earlier quoted context omitted.

> How do you actively detect a malware agent running in user space using stealth or a kernel. You start with correct design. The system has a root of trust (ideally you skip the insane level of complexity that is Secure Boot + TPM and use something simple, testable, and verifiable — this isn’t actually that hard). Only authorized images will boot, and, more importantly, nothing else on the network trusts the machine…

> Only authorized images will boo How do you do this on modern commodity hardware without secure boot? Or do you assume something in the category of embedded systems that allow to blow some efuses to get similar trusted boot?

> How do you do this on modern commodity hardware without secure boot?

It’s not necessarily easy without Secure Boot, sadly. The actual straightforward solution is boot ROM. It would be nifty if someone made SD cards, eMMC devices and such meant for this use case for independent use. Most Android vendors manage to use boot ROM.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#262

Post by amluto »

ungamedplayer wrote: post #232
amluto wrote: post #178

Earlier quoted context omitted.

re: SELinux, I think it depends on your use case. If your system is a flight information display, then you may well have two userspace processes that do anything of significance: the display manager and the actual app. There is no persistent state. At this point, SELinux is purely overhead and extra attack surface — what would it even protect. If your payload is a container (database server, microservice, whatever),…

Absolutely depends on the use case. I'm attempting to talk in the generic case. If you limit policy to the minimum attack surface from outside the process including permissions and capabilities which are significantly more fine grained in selinux compared to normal Unix permissions, you reduce the the capability of the attacker once they gain access to the system. Imagine if they got access to local code execution...…

For this sort of kernel attack surface reduction, I would use a combination of seccomp and runtime module loading restriction.

In the specific example of sctp, one can turn off loading of modules at runtime entirely.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#263

Post by adrianN »

627467 wrote: post #207
dathinab wrote: post #159

Earlier quoted context omitted.

IMHO it would send really wrong signals if this doesn't end up with CrowdStrike closing their doors... like if the largest outage in history was caused by you due to a config parser failing and it looks as far as I can tell that they didn't follow industry best practices when it comes to config/parsing handling and probably also didn't follow some best practices when it comes to kernel module programming then honestl…

I understand that CS doesn't draw much sympathies even before this happened - from myself included - and it is easy to pin point systemic issues to a single failure point and make it liable and financially responsible for all downstream failures. But this only creates excuses for all other responsible players in this systemic issue - or society at large. Just to pick 1 example: I keep reading comments on how profound…

In the end it's a matter of cost. Having two independent supply chains for anything as complex as healthcare infrastructure is essentially unaffordable.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#265

Post by blitzar »

webworker wrote: post #264

What, the $10 gift certificate for customers isn't enough?

Virtual gift cards offered by Cybersecurity firm CrowdStrike to those who aided customers through the global IT outage have been blocked and flagged for potential fraud by Uber.

https://www.abc.net.au/news/2024-07-26/crowdstrike-gift-card...

I almost feel sorry for CrowdStrike.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#266

Post by simiones »

dotancohen wrote: post #254
simiones wrote: post #222

Earlier quoted context omitted.

Ok, how about an image in an email? Or a PDF receipt? How about clicking a link online? All of these have a serious potential to infect your system with malware.

I really don't want executables in PDF files or email. Really, I don't.

PDF parsers, and really all complex format parsers, are very often exploitable. Maliciously crafted documents trigger a buffer overflow, and now they can take control of the process and execute arbitrary code, code that almost certainly has access to your other documents as well.

Also, how about malicious scripts that I convince you to explicitly give execute permissions to and run? How about Git repos that I convince someone to clone, compile, and run, that have malicious code?

Signature-based heuristics can help protect from all of these things that the OS is powerless to help against with only traditional security measures.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#267

Post by simiones »

cesarb wrote: post #245
simiones wrote: post #183

Earlier quoted context omitted.

The cat-and-mouse game is between OS security features and hackers. AV software is not a crutch, it's an extra level of defense. All OS kernels are vulnerable to malware - this is a 100% given at this moment in history. The question is how to mitigate this problem, and AV is one component of that, as are firewalls, network-level intrusion prevention systems, and a whole host of other security software. Maybe some day…

> AV software is not a crutch, it's an extra level of defense. The issue is that it's the only "level of defense" which introduces arbitrary non-deterministic behavior. An executable which correctly follows all the APIs as documented and implemented, and which does nothing malicious, might arbitrarily be denied or even erased, and this behavior changes daily or even hourly due to factors outside the control of the co…

All of these are legitimate issues with AV software. However, they don't mean that AV is a crutch, or that it could easily be supplanted by other security features. There is simply no good alternative to AV for systems where it's likely the user will interact with untrusted input, such as receiving documents, receiving email, browsing the internet, downloading code from GitHub etc

Of course, when you have a locked down system such as a server or an embedded device, the need for AV protection drops down significantly. But on a wide open system, there's really no alternative.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#268

Post by GJim »

dathinab wrote: post #230
gruez wrote: post #219

Earlier quoted context omitted.

What are they supposed to use instead? "Starting in Q3/H2"?

yes, many non US firms do exactly that for international announcements: - use "second half of ", "begin of", 3 quartal of, etc. - or a specific month if they want to be more precise also for western focused announcements they also use "holliday session" as their tends to be a holliday session in most countries in both summer and winter (through their start differs _a lot_, but it tends to just work out if you release…

> holiday session

Classic example!

In the US, people will normally assume you are talking about Christmas holidays. In Blighty, people will assume summer holidays.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#269

Post by GJim »

gruez wrote: post #244
dathinab wrote: post #230

Earlier quoted context omitted.

yes, many non US firms do exactly that for international announcements: - use "second half of ", "begin of", 3 quartal of, etc. - or a specific month if they want to be more precise also for western focused announcements they also use "holliday session" as their tends to be a holliday session in most countries in both summer and winter (through their start differs _a lot_, but it tends to just work out if you release…

The meteorological dates for "summer" correspond to June 1 to August 31. That straddles 2 quarters and both halves of the year. What are you going to do if a product launch is in July (+- 1 month)? You can't really use Q3 or H2 because neither of them fully captures that 3 month period.

> The meteorological dates for "summer" correspond to June 1 to August 31

That is winter in the southern hemisphere.

I'm amazed at the need to have to explain this to a grown adult: https://spaceplace.nasa.gov/seasons/en/

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#270

Post by account42 »

adrianN wrote: post #263
627467 wrote: post #207

Earlier quoted context omitted.

I understand that CS doesn't draw much sympathies even before this happened - from myself included - and it is easy to pin point systemic issues to a single failure point and make it liable and financially responsible for all downstream failures. But this only creates excuses for all other responsible players in this systemic issue - or society at large. Just to pick 1 example: I keep reading comments on how profound…

In the end it's a matter of cost. Having two independent supply chains for anything as complex as healthcare infrastructure is essentially unaffordable.

> essentially unaffordable

[citation needed]

Post reply on HN