Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the CrowdStrike bug hit banks hard

bitsaboutmoney.com

Post reply on HN
Print view View original

151–160 of 250 posts

Re: Why the CrowdStrike bug hit banks hard

#151

Post by jachee »

valenterry wrote: post #144
mingus88 wrote: post #133

Earlier quoted context omitted.

In many mature orgs, corporate IT rolls up to the CIO and security will roll up to the CISO The CISO and security ops will demand to be completely independent from corp IT, for legit reasons, as the security team needs to treat IT as potential insider threat actors with elevated privileges. They will also demand the ability to push out updates everywhere at any time in response to real-time threats, and per the previ…

> The CISO and security ops will demand to be completely independent from corp IT, for legit reasons, as the security team needs to treat IT as potential insider threat actors with elevated privileges. I always wondered: why should security ops not be a potential insider thread actor? In fact, if they were compromised, it would be even worse. Do we need two different security ops that monitor each other? :)

Isn’t that why some organizations have a red team and a blue team?

Re: Why the CrowdStrike bug hit banks hard

#152

Post by shadowgovt »

Just as a general comment on this whole affair:

This would be the third incident I'm familiar with of a file of entirely zeroes breaking something big.

Folks, as much as we wish it weren't true, null comes up all the damn time, and if you don't have tests trying to force-feed null into your system in novel and exciting ways, production will demonstrate them for you.

Never assume 'zero' (for whatever form zero takes in context) can't be an input.

Re: Why the CrowdStrike bug hit banks hard

#153

Post by __MatrixMan__ »

imtringued wrote: post #147
__MatrixMan__ wrote: post #65

I like the technical stuff here. I'm not so sure about this: > money is core societal infrastructure, like the power grid and transportation systems are. It would be really bad if hackers working for a foreign government could just turn off money. Sure, it would be inconvenient in the short term. But I think the current design is holding us back. I suspect that most of us would have more to gain than to lose if we ma…

I agree there needs to be more competition, but that doesn't mean you need to get rid of the old way. It is better when two approaches run in parallel, to compensate the other's shortcomings.

That would indeed be ideal: one as a backup for the other, and when both are functioning, chose the one that suits you best. I just think that it's outages that will convince us that we need this... stakeholders in the status quo certainly aren't going to do it.

Re: Why the CrowdStrike bug hit banks hard

#154

Post by hpen »

SirMittens wrote: post #68
hpen wrote: post #46

We blame car manufacturers for defects from suppliers, but we don't blame platform manufacturers (Microsoft) for holes in their architecture?

I think that's the wrong analogy. A more correct one would be "Should we blame a car company for a broken engine, that was modified after it was sold to you?". A kernel level driver from a 3rd party is something that you willingly add to the OS, it wasn't there. Just because windows allow you to do it, doesn't mean you should. I mean, you can apply some dangerous mods to your car's engine, but you probably shouldn't,…

Does crowdstrike void the warranty like an engine add on?

Re: Why the CrowdStrike bug hit banks hard

#155

Post by [deleted] »

Joker_vD wrote: post #105
gadders wrote: post #90

Earlier quoted context omitted.

In the short term people would probably starve to death.

Probably not. A competent government could install temporary rationing for the most essential goods such as food. It happened through the the whole of the 1917—1920 Russian revolution, with four or five kinds of paper money being circulated around, and the urban population managed through it only if barely. That government was much less competent than the US government is today.

[deleted]

Re: Why the CrowdStrike bug hit banks hard

#156

Post by btilly »

bluGill wrote: post #124
btilly wrote: post #67

Earlier quoted context omitted.

You could, and in fact this is what Microsoft wanted to do. The EU said that they couldn't. And the reason why not is simple. Anything that Microsoft thinks is a good thing to add to the API, they'll add for themselves. When the new API is released, their software is released with it. This gives them a competitive advantage over competitors who have to wait for Microsoft to have the idea that they want, and then scra…

> Windows 95 with Microsoft Word available at the same time, and with WordPerfect unable to run That is somewhat revisionist history. WordPerfect admitted at the time they saw OS/2 as the future and were focused on that. Only in hindsight did they realize OS/2 was going nowhere (too bad, it was better than 95) and had to rush to get a WordPerfect for 95. Worse for them, they wrote each release of WordPefect in platfo…

Sorry, who is being revisionist here?

The use of platform specific code was a performance necessity at the time, everyone did it. Part of the promise of Windows 95 was that it could run your Windows 3.1 programs. They bent over backwards for a ton of programs, but not WordPerfect. Microsoft also had an early access program to Windows 95. WordPerfect applied for it - and was denied access. After that the OS/2 bet was their only real hope.

The truth is that Microsoft had a long and documented history of using one monopoly to leverage into another. Over and over again they lost antitrust lawsuits, but internally regarded them as speeding tickets on the way to greater monopoly power. This history showed up in court. The internal documentation on the WordPerfect case showed up in the Netscape case, and is part of why Mocrosoft won.

It wasn't until the EU started charging Microsoft over $400 million per day for noncompliance in 2006 that Microsoft's attitude started to change. Now I see them as just normal big guys with a worse than average history. But back in the 90s and early 2000s? They EARNED the title of "evil empire".

Re: Why the CrowdStrike bug hit banks hard

#157

Post by btilly »

bluGill wrote: post #128
crmd wrote: post #109

Earlier quoted context omitted.

This is why tech conglomerates are anti-competitive and need to be broken up. There is no reason a leading operating system company should be allowed to also be a word processing, video conferencing, and music-selling company. They will leverage their control of the operating system business to gain unearned competitive advantage in the unrelated markets.

> There is no reason a leading operating system company should be allowed to also be a word processing, video conferencing, and music-selling company. If I write a new OS how will you force the "word processing, video conferencing, and music-selling" companies to write code for it? If they don't write the above my OS is worthless, but if my OS fails in the market anyway they just wasted a lot of money. This is why OS…

You work deals for early access to your OS, and work to make your OS backwards compatible.

Nobody wants to try to be selling consumer software that is optimized for the out of date and unsupported version of the OS.

Re: Why the CrowdStrike bug hit banks hard

#158

Post by codewench »

bluGill wrote: post #132
jabroni_salad wrote: post #55

Earlier quoted context omitted.

If you don't do it, someone else will. Unless the OS is locked down to the point that even its owner cannot do that. Actually, this is something I like about Operational Technology, you run into a lot of doodads where the elevation process requires turning a physical key, and the device's main functionality is disabled while it is in service mode. Ofc the doodad has to be engineered to operate reliably, perpetually,…

I have said for 20 years now that Microsoft Word should have a check on startup, if the current user is administrator it should put up a message that administrators are not allowed to use a Word Process, login as someone else. This one change would solve a lot of problems. Even on home machines where no user has a password, having to do something special to get into administrator mode will stop several attacks just b…

That's pretty much what Microsoft tried with the UAC prompts, and that was fairly universally disliked. Not that I disagree with you, running as admin by default is a terrible practice, but it's a tough sell to the general public

Re: Why the CrowdStrike bug hit banks hard

#159

Post by Dalewyn »

bluGill wrote: post #132
jabroni_salad wrote: post #55

Earlier quoted context omitted.

If you don't do it, someone else will. Unless the OS is locked down to the point that even its owner cannot do that. Actually, this is something I like about Operational Technology, you run into a lot of doodads where the elevation process requires turning a physical key, and the device's main functionality is disabled while it is in service mode. Ofc the doodad has to be engineered to operate reliably, perpetually,…

I have said for 20 years now that Microsoft Word should have a check on startup, if the current user is administrator it should put up a message that administrators are not allowed to use a Word Process, login as someone else. This one change would solve a lot of problems. Even on home machines where no user has a password, having to do something special to get into administrator mode will stop several attacks just b…

Administrators can and should be able to do anything and everything, that is literally an administrator's job description.

Also, if you want to stop everyone from using administrator accounts, the simplest way is to not have the Windows installer/OOBE setup make an administrator account first.

Windows has a built-in Administrator account already not unlike Root in Linux, there is no reason (other than tradition and absolute convenience) the Windows installer/OOBE setup needs to make an administrator account for the user installing/setting up.

Re: Why the CrowdStrike bug hit banks hard

#160

Post by com »

valenterry wrote: post #144
mingus88 wrote: post #133

Earlier quoted context omitted.

In many mature orgs, corporate IT rolls up to the CIO and security will roll up to the CISO The CISO and security ops will demand to be completely independent from corp IT, for legit reasons, as the security team needs to treat IT as potential insider threat actors with elevated privileges. They will also demand the ability to push out updates everywhere at any time in response to real-time threats, and per the previ…

> The CISO and security ops will demand to be completely independent from corp IT, for legit reasons, as the security team needs to treat IT as potential insider threat actors with elevated privileges. I always wondered: why should security ops not be a potential insider thread actor? In fact, if they were compromised, it would be even worse. Do we need two different security ops that monitor each other? :)

Generally, act vs monitor is the segregation of duties that I have seen best working between platform or IT ops and engineering (act) vs security ops (monitor).

For many high privilege operations there are more segregation of duties in the act side of things - these can be down to plan, authorise, configure, activate, validate or some rollups of these. Another is dual control on the act side, since conspiracy is generally quite hard to do especially if it’s just for pocket-change. Different if it’s $$Billions of fungible cash of course at stake.

People often overcomplicate - simple do/check is often enough.

Post reply on HN