Why the CrowdStrike bug hit banks hard

#1

Post by sideway » Wed, Jul 31, 2024, 3:07 PM UTC

Why the CrowdStrike bug hit banks hard
bitsaboutmoney.com

Re: Why the CrowdStrike bug hit banks hard

#2

Post by pantulis » Wed, Jul 31, 2024, 3:25 PM UTC

This is a good writeup, but to be fair it's just not a matter of banking regulations. Basically all big companies are under similar obligations regarding endpoint protection.

Re: Why the CrowdStrike bug hit banks hard

#3

Post by deepsun » Wed, Jul 31, 2024, 3:27 PM UTC

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path.

And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

Re: Why the CrowdStrike bug hit banks hard

#4

Post by hulitu » Wed, Jul 31, 2024, 3:30 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

I think they said it was a windows driver, not a normal application. Running crap in kernel mode does not end well on any OS.

Re: Why the CrowdStrike bug hit banks hard

#5

Post by [deleted] » Wed, Jul 31, 2024, 3:31 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

[deleted]

Re: Why the CrowdStrike bug hit banks hard

#6

Post by klodolph » Wed, Jul 31, 2024, 3:31 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

How did Microsoft put it on the Windows critical path? (Informational question—I’m not following the issue super closely, but I thought CrowdStrike was a third-party system. Crowdstrike was wrong to put so much code in the kernel. Microsoft was reportedly legally bound to provide this access and allow third-party code to run in the kernel.)

Re: Why the CrowdStrike bug hit banks hard

#7

Post by Cthulhu_ » Wed, Jul 31, 2024, 3:35 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

In the article it states that Microsoft HAD to allow Crowdstrike to run in kernelspace by EU laws, because else MS would have the monopoly on kernel-level security solutions / integrations.

Re: Why the CrowdStrike bug hit banks hard

#8

Post by School-Cotton » Wed, Jul 31, 2024, 3:35 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

Microsoft is not who made the decision to put this on Windows' critical path; CrowdStrike was. Nothing stops you from running whatever dodgy third-party kernel modules you like on Linux or FreeBSD and they could easily cause the same sort of problem.

Re: Why the CrowdStrike bug hit banks hard

#9

Post by concerned_user » Wed, Jul 31, 2024, 3:38 PM UTC

hulitu wrote: post #4

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

I think they said it was a windows driver, not a normal application. Running crap in kernel mode does not end well on any OS.

Yes it is a driver which is signed and tested by Microsoft. Driver allows to run arbitrary unsigned code. Why is that allowed?

Re: Why the CrowdStrike bug hit banks hard

#10

Post by asr » Wed, Jul 31, 2024, 3:38 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

Not MSFT’s fault: https://stratechery.com/2024/crashes-and-competition/