Why the CrowdStrike bug hit banks hard • Hacker News Board

Re: Why the CrowdStrike bug hit banks hard

#21

Post by Saris » Wed, Jul 31, 2024, 3:43 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

What about the previous crowdstrike bugs that hit Linux systems in a similar fashion?

I don't understand how this has anything to do with Windows, Crowdstrike is the one who built the application.

Re: Why the CrowdStrike bug hit banks hard

#22

Post by CydeWeys » Wed, Jul 31, 2024, 3:43 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

I don't think "Microsoft should lock down Windows so hard" is the solution we want here. I don't want my desktop OS to be a walled garden like iOS is. I want to be able to install software on it that does anything I need to be able to do -- and yes, having that capability to run software at the lowest possible level in the OS does also mean that that software has extra responsibility to be well-behaved, as the OS can't protect the system from it. But I still would rather have that option than not have it (and also I wouldn't use CrowdStrike).

Re: Why the CrowdStrike bug hit banks hard

#23

Post by Bjartr » Wed, Jul 31, 2024, 3:43 PM UTC

School-Cotton wrote: post #8

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

Microsoft is not who made the decision to put this on Windows' critical path; CrowdStrike was. Nothing stops you from running whatever dodgy third-party kernel modules you like on Linux or FreeBSD and they could easily cause the same sort of problem.

In fact, CrowdStrike has taken down Linux systems in much the same way in the past year (in April I think). It's just that the impact was less widespread.

Re: Why the CrowdStrike bug hit banks hard

#24

Post by Joker_vD » Wed, Jul 31, 2024, 3:45 PM UTC

concerned_user wrote: post #9

hulitu wrote: post #4

Earlier quoted context omitted.

I think they said it was a windows driver, not a normal application. Running crap in kernel mode does not end well on any OS.

Yes it is a driver which is signed and tested by Microsoft. Driver allows to run arbitrary unsigned code. Why is that allowed?

...you want Microsoft to forbid you from running certain kinds of programs on your own machine, even if you really, really insist on it, do I understand you correctly?

Re: Why the CrowdStrike bug hit banks hard

#25

Post by [deleted] » Wed, Jul 31, 2024, 3:45 PM UTC

btbuildem wrote: post #12

The takeaway from this article seems to be: buy crowdstrike shares, because major corps are unable to make any changes, and will continue to pay licensing fees for this "service" for the foreseeable future.

[deleted]

Re: Why the CrowdStrike bug hit banks hard

#26

Post by imiric » Wed, Jul 31, 2024, 3:46 PM UTC

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

To be fair, AFAIK the CrowdStrike driver was WHQL-certified. The loophole is that the driver loaded files at runtime, which made it impossible to predict every failure scenario.

Maybe this is the loophole that needs closing. You can't claim a driver is certified for Windows if the manufacturer can push arbitrary files that change its behavior. Especially if that manufacturer has sloppy development practices.

I understand that a primary goal of endpoint monitoring software is to be able to quickly react to new threats, and that the turn around time for Windows certification is surely unacceptable in this scenario, but this functionality can never be allowed to jeopardize the stability of the system it's supposed to protect. So it's ultimately on Microsoft to fix this for their users.

Re: Why the CrowdStrike bug hit banks hard

#27

Post by [deleted] » Wed, Jul 31, 2024, 3:46 PM UTC

Retr0id wrote: post #14

> For historical reasons, that area where almost everything executes is called “userspace.” It's an old term at this point, but I don't think the reasons for it being called "userspace" have changed or become outdated since then, so I wouldn't call them historic per se.

[deleted]

Re: Why the CrowdStrike bug hit banks hard

#28

Post by waihtis » Wed, Jul 31, 2024, 3:48 PM UTC

Regulations are a big reason why this happened, sure, but also it hit the companies with great security budgets more.

Hospitals, for instance, weren't that widely affected as they barely have any money to buy security tooling.

Silver linings and all that, I guess.

Re: Why the CrowdStrike bug hit banks hard

#29

Post by candiddevmike » Wed, Jul 31, 2024, 3:50 PM UTC

pantulis wrote: post #2

This is a good writeup, but to be fair it's just not a matter of banking regulations. Basically all big companies are under similar obligations regarding endpoint protection.

Should endpoint protection require kernel level access? At what point does it stop becoming protection and start becoming a liability? Obligatory who watches/protects the watchmen/protector...

Re: Why the CrowdStrike bug hit banks hard

#30

Post by Macha » Wed, Jul 31, 2024, 3:51 PM UTC

Retr0id wrote: post #14

> For historical reasons, that area where almost everything executes is called “userspace.” It's an old term at this point, but I don't think the reasons for it being called "userspace" have changed or become outdated since then, so I wouldn't call them historic per se.

Things have gotten messier with virtualization, containerisation, hypervisors etc. The internet loves to produce pedants to argue the post should go into the finer points of these even when it's not relevant to the message. And so people like the author have a defensive reflex to throw in some language to bounce the pedants away.