Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike ex-employees: 'Quality control was not part of our process'

semafor.com

Post reply on HN
Print view View original

201–210 of 311 posts

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#201

Post by tempodox »

chii wrote: post #182
0xbadcafebee wrote: post #126

Earlier quoted context omitted.

I've worked in these enterprise organizations for a long time. They don't run on common sense, or even what one might consider "business sense". Their existing incentives create bizarre behavior. For example, you might think "if a big security exploit happens, the stock price might tank" . So if they value the stock price, they'll focus on security, right?. In reality what they do is focus on burying the evidence of…

While good, those ideas will all increase costs. Would you pay 10x (or more, even) for these systems? That means 10x the price of water, utilities, transport etc, which then accumulate up the chain to make other things which don't have criticality but do depend on the ones that do. The thing is, what exists today exists because it's the path of least resistence.

Cars without seat belts were the path of least resistance for a long time. I wonder how that changed.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#202

Post by dbattaglia »

insane_dreamer wrote: post #59
Zigurd wrote: post #38

Earlier quoted context omitted.

At some companies, like Boeing, the shorter list would be the gruntled employees.

> gruntled have never heard that word used is a non-negative way

I’ve only heard it from Michael Scott: “Everyone here is extremely gruntled”.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#203

Post by mewpmewp2 »

tsimionescu wrote: post #172
hello_moto wrote: post #151

Earlier quoted context omitted.

> one part enterprisey, one part "move fast and break things". When there's 0day, how enterprisey you would like to catch the 0day?

Not sure, but definitely more enterprisey than "release a patch to the entire world at once before running it on a single machine in-house".

So it would be preferable to have your data encrypted, taken hostage unless you pay, and be down for days, instead of 6 hours of just down?

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#204

Post by mavhc »

hn_throwaway_99 wrote: post #70
daedrdev wrote: post #8

Earlier quoted context omitted.

Two things are clear though Nobody ran this update The update was pushed globally to all computers With that alone we know they have failed the simplest of quality control methods for a piece of software as widespread as theirs. This is even excluding that there should have been some kind of error handling to allow the computer to boot if they did push bad code.

While I agree with this, from a software engineering perspective I think it's more useful to look at the lessons learned. I think it's too easy to just throw "Crowdstrike is a bunch of idiots" against the wall, and I don't think that's true. It's clear to me that CrowdStrike saw this as a data update vs. a code update, and that they had much more stringent QA procedures for code updates that they did data updates. It…

If they weren't idiots they wouldn't be parsing data in the kernel level module

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#205

Post by j4coh »

notepad0x90 wrote: post #167
hiddencost wrote: post #166

Earlier quoted context omitted.

Storing secrets in unsecured environments in plaintext is literally a vulnerability. One of the most famous examples can be seen in the NSA slide at the top of this article: https://www.washingtonpost.com/world/national-security/nsa-i...

the security tools' storage system is always considered a secured environment.

Without even having to secure it?

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#206

Post by throw_a_grenade »

j4coh wrote: post #205
notepad0x90 wrote: post #167

Earlier quoted context omitted.

the security tools' storage system is always considered a secured environment.

Without even having to secure it?

Yes, but also No.

So there's this thing called "Threat model" and it includes some assumptions about some moving parts of the infra, and it very often includes assertion that a particular environment (like IDS log, signing infra surrounding HSM etc.) is "secure" (they mean outside of the scope of that particular threat model). So it often gets papered over, and it takes some reflex to say "hey, how we will secure that other part". There needs to be some conciousnes about it, because it's not part of this model under discussuon, so not part of the agenda of this meeting...

And it gets lost.

That's how shit happens in compliance-oriented security.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#207

Post by [deleted] »

st3fan wrote: post #36

Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…

[deleted]

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#208

Post by Fnoord »

notepad0x90 wrote: post #156
st3fan wrote: post #36

Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…

that's what EDRs do. anyone with access to your SIEM or CS data should also be trusted with response access (i.e.: remotely access those machines). If you want this redacted, it is a SIEM functionality not Crowdstrike's. Depends on the SIEM but even older generation SIEMs have a data scrubbing feature. This isn't a Crowdstrike design decision as you've put it. any endpoint monitoring too, including the free and open…

Sure, storage. Networking though? SIEMs receive and send data unencrypted? They should not. By sending the data in plain text you open up an attack surface to anyone sniffing the network.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#209

Post by st3fan »

notepad0x90 wrote: post #159
skewer99 wrote: post #74

Earlier quoted context omitted.

The monitoring and collection isn't the problem, that's what modern EDR does - collect, analyze, compare, and do statistics on all of the things. The plaintext part is not okay.

Thank you, that's a sound perspective, but it is the responsibility of the security staff who deploy EDRs like Crowdstrike to scrub any data at ingestion time into their SIEM. but within CS's platform, it makes little sense to talk about scrubbing, since CS doesn't know what you want scrubbed unless it is standardized data forms (like SSNs,credit cards,etc..). Another way to look at it is, the CS cloud environment is…

Unfortunately the software doesn’t allow for scrubbing or redacting to be configured. Those features simply do not exist.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#210

Post by st3fan »

hello_moto wrote: post #147
meowface wrote: post #53

Earlier quoted context omitted.

All SIEM instances certainly contain a lot of sensitive data in events, but I'm not sure if most agents forward all environment variables to a SIEM.

Agents don't just read env vars and send them to SIEM. There's a triggering action that caused the env vars to be used by another ... ehem... Process ... that any EDR software in this beautiful planet would have tracked.

No it logs every command macOS runs or that you type in a terminal. Either directly or indirectly. From macOS internal periodic tasks to you running “ls”.
Post reply on HN