Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the CrowdStrike bug hit banks hard

bitsaboutmoney.com

Post reply on HN
Print view View original

121–130 of 250 posts

Re: Why the CrowdStrike bug hit banks hard

#121

Post by notepad0x90 »

candiddevmike wrote: post #29
pantulis wrote: post #2

This is a good writeup, but to be fair it's just not a matter of banking regulations. Basically all big companies are under similar obligations regarding endpoint protection.

Should endpoint protection require kernel level access? At what point does it stop becoming protection and start becoming a liability? Obligatory who watches/protects the watchmen/protector...

Yes, it needs kernel access given the userspace api's available in windows. Period. not a single person who knows how the tool works and the threats it protects against has said other wise. userpace can't disable or tamper kernel space but an admin/root process in userspace can.

Re: Why the CrowdStrike bug hit banks hard

#122

Post by bdamm »

voytec wrote: post #116

> Another way is if it has recently joined a botnet orchestrated from a geopolitical adversary of the United States after one of your junior programmers decided to install warez because the six figure annual salary was too little to fund their video game habit. Fictional statements like this make me reluctant to read further, and ignore source of such "news" in the future.

It's obviously fictional, but let's call it contemporary drama based on a true story. I thought the point was well made. The author already noted this was a handwaving segment.

Re: Why the CrowdStrike bug hit banks hard

#123

Post by bob1029 »

I feel like this only impacted the larger banks. I've heard absolutely no explosion noises coming from smaller institutions. The effect of regulations and their enforcement is felt differently across the spectrum.

There is something to be said for a diverse banking industry when it comes to this kind of problem. Also, this event is a powerful argument for keeping the core systems on unusual mainframe architectures. I think building a bank core on windows would be a really bad choice, but some vendors have already done this.

Re: Why the CrowdStrike bug hit banks hard

#124

Post by bluGill »

btilly wrote: post #67
ghusto wrote: post #41

Earlier quoted context omitted.

Couldn't you just ask some OS APIs provided by something in kernelspace for what you need? In fact, isn't this how macOS does things?

You could, and in fact this is what Microsoft wanted to do. The EU said that they couldn't. And the reason why not is simple. Anything that Microsoft thinks is a good thing to add to the API, they'll add for themselves. When the new API is released, their software is released with it. This gives them a competitive advantage over competitors who have to wait for Microsoft to have the idea that they want, and then scra…

> Windows 95 with Microsoft Word available at the same time, and with WordPerfect unable to run

That is somewhat revisionist history. WordPerfect admitted at the time they saw OS/2 as the future and were focused on that. Only in hindsight did they realize OS/2 was going nowhere (too bad, it was better than 95) and had to rush to get a WordPerfect for 95. Worse for them, they wrote each release of WordPefect in platform specific code (mostly assembly) so it wasn't a case of port to 95 it was a case of start over mostly from scratch.

Yes WordPerfect lost to Word with 95 - but it was bad decisions on WordPerfect's part. They had opportunity to get WordPerfect on 95 much faster. I don't know if it would have been fast enough, but they didn't even try until it was too late.

Re: Why the CrowdStrike bug hit banks hard

#125

Post by bluGill »

lucianbr wrote: post #93
btilly wrote: post #67

Earlier quoted context omitted.

You could, and in fact this is what Microsoft wanted to do. The EU said that they couldn't. And the reason why not is simple. Anything that Microsoft thinks is a good thing to add to the API, they'll add for themselves. When the new API is released, their software is released with it. This gives them a competitive advantage over competitors who have to wait for Microsoft to have the idea that they want, and then scra…

The way I see it, Microsoft sells some antivirus software, and also gets to decide who is allowed or not to compete with their antivirus software, by providing or denying access to the API. Obviously unfair.

I think anti-virus should be part of the core os. This does kill all third party vendors - good riddance to most of them, sorry if there is one that isn't evil (I'm not aware of it)

Re: Why the CrowdStrike bug hit banks hard

#126

Post by davidgerard »

Cthulhu_ wrote: post #7
deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

In the article it states that Microsoft HAD to allow Crowdstrike to run in kernelspace by EU laws, because else MS would have the monopoly on kernel-level security solutions / integrations.

So why didn't MS lock it down in the US if it's an EU-local rule? Their excuse isn't plausible.

Re: Why the CrowdStrike bug hit banks hard

#127

Post by davidgerard »

ortusdux wrote: post #13
deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

Is there any merit to Microsoft's argument that the EU forced them into keeping their kernel accessible by 3rd parties? https://www.theregister.com/2024/07/22/windows_crowdstrike_k...

No. They could have done an EU-only edition that behaved that way. But they didn't.

Re: Why the CrowdStrike bug hit banks hard

#128

Post by bluGill »

crmd wrote: post #109
btilly wrote: post #67

Earlier quoted context omitted.

You could, and in fact this is what Microsoft wanted to do. The EU said that they couldn't. And the reason why not is simple. Anything that Microsoft thinks is a good thing to add to the API, they'll add for themselves. When the new API is released, their software is released with it. This gives them a competitive advantage over competitors who have to wait for Microsoft to have the idea that they want, and then scra…

This is why tech conglomerates are anti-competitive and need to be broken up. There is no reason a leading operating system company should be allowed to also be a word processing, video conferencing, and music-selling company. They will leverage their control of the operating system business to gain unearned competitive advantage in the unrelated markets.

> There is no reason a leading operating system company should be allowed to also be a word processing, video conferencing, and music-selling company.

If I write a new OS how will you force the "word processing, video conferencing, and music-selling" companies to write code for it? If they don't write the above my OS is worthless, but if my OS fails in the market anyway they just wasted a lot of money. This is why OS companies tend to have the other things, their OS cannot exist in a vacuum and the only way to ensure they have those needed tools is to write them themselves.

Re: Why the CrowdStrike bug hit banks hard

#129

Post by bluGill »

tmm wrote: post #54
greenn wrote: post #37

Earlier quoted context omitted.

With the current model kernel level access is required. Real security products have to be able to operate above userland. Ideally in the future there can be a layer in between userland and kernel for this sort of thing. Maybe we use some of those extra protection rings?

> Maybe we use some of those extra protection rings? Maybe not. Intel is considering removing rings 1 and 2 for a future 64-bit only x86 architecture, because they "are unused by modern software". https://www.intel.com/content/www/us/en/developer/articles/t...

I don't think those extra rings would be useful for what is needed anyway.

Re: Why the CrowdStrike bug hit banks hard

#130

Post by lucianbr »

jmuguy wrote: post #92
lucianbr wrote: post #80

Earlier quoted context omitted.

Management decides to use Crowdstrike, not IT, and IT has no way to rollout updates in controlled fashion. So not really a failure of IT, at least not for this reason.

My comment assumes that the IT department (including its executive) gets to make these sort decisions - why wouldn't they?

Sure, if there's a security exec who made the decision, it may be their fault. I was thinking more of the rank and file, but that's just my bias.
Post reply on HN