Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the CrowdStrike bug hit banks hard

bitsaboutmoney.com

Post reply on HN
Print view View original

31–40 of 250 posts

Re: Why the CrowdStrike bug hit banks hard

#31

Post by shadowgovt »

imiric wrote: post #26
deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

To be fair, AFAIK the CrowdStrike driver was WHQL-certified. The loophole is that the driver loaded files at runtime, which made it impossible to predict every failure scenario. Maybe this is the loophole that needs closing. You can't claim a driver is certified for Windows if the manufacturer can push arbitrary files that change its behavior. Especially if that manufacturer has sloppy development practices. I unders…

Ironically, this is exactly the failure pattern that the changes in Chrome extensions to manifest v3 try to prevent. You can't provide a guarantee to the end-user of pre-vetted safety when the application is downloading and executing arbitrary code from a third-party source. That's like expecting a static code verifier to prevent all runtime errors.

It is, perhaps, a guarantee that no vendor should be expected to make.

Re: Why the CrowdStrike bug hit banks hard

#32

Post by gciguy »

deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

Dave's Garage has a great video on this: https://www.youtube.com/watch?v=wAzEJxOo1ts

Re: Why the CrowdStrike bug hit banks hard

#33

Post by tootie »

btbuildem wrote: post #12

The takeaway from this article seems to be: buy crowdstrike shares, because major corps are unable to make any changes, and will continue to pay licensing fees for this "service" for the foreseeable future.

This is going to crush their sales pipeline and lead to at least a few attempting a migration off. Crowdstrike is unlikely to go out of business, but this is not a good time to buy.

Re: Why the CrowdStrike bug hit banks hard

#34

Post by Macha »

Cthulhu_ wrote: post #7
deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

In the article it states that Microsoft HAD to allow Crowdstrike to run in kernelspace by EU laws, because else MS would have the monopoly on kernel-level security solutions / integrations.

They probably had to, in the same way that banks had to use crowdstrike. Much as it's easy for banks to say "we use crowdstrike, like everyone else" rather than implement a bespoke and accountable framework for risk assessment and mitigation for every type of endpoint use case (and argue that case to both the auditor and regular). In this case it's easier for Microsoft to say "see, they can run in kernel space" rather than provide a bunch of API functions that achieve what's needed, convince all third party vendors to use them, and put in place a process to convince an auditor that Microsoft security software will never use any knowledge or functionality from the OS outside this.

Re: Why the CrowdStrike bug hit banks hard

#35

Post by shadowgovt »

concerned_user wrote: post #9
hulitu wrote: post #4

Earlier quoted context omitted.

I think they said it was a windows driver, not a normal application. Running crap in kernel mode does not end well on any OS.

Yes it is a driver which is signed and tested by Microsoft. Driver allows to run arbitrary unsigned code. Why is that allowed?

This is the nugget of the issue. The code-signing process, in this case, was abused to verify something that, fundamentally, cannot give the guarantee "Doesn't crash your OS" because it is allowed to run arbitrary code in the form of novel commands in what is essentially a DSL. So if code-signing is supposed to be a guarantee from MS that "this code can't crash your system," it should never have been signed... But then MS would have been on hooks for blocking a competitor.

There is no guarantee the law is written soundly.

Re: Why the CrowdStrike bug hit banks hard

#36

Post by mewpmewp2 »

ctxc wrote: post #20
deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

The application (Crowdstrike) was part of Windows' booting process. Windows cannot simply "skip" failed drivers. Say Crowdstrike driver failed as a one time thing, Windows skipped it instead of retrying which led to the endpoint being vulnerable and a ransomware happens. We'd be saying the opposite now. This is a high-impact ability Windows offers to applications - and applications should take responsibility and trea…

But then again ransomware would happen like you said if they skipped it? And ransomware sounds even worse.

Re: Why the CrowdStrike bug hit banks hard

#37

Post by greenn »

candiddevmike wrote: post #29
pantulis wrote: post #2

This is a good writeup, but to be fair it's just not a matter of banking regulations. Basically all big companies are under similar obligations regarding endpoint protection.

Should endpoint protection require kernel level access? At what point does it stop becoming protection and start becoming a liability? Obligatory who watches/protects the watchmen/protector...

With the current model kernel level access is required. Real security products have to be able to operate above userland. Ideally in the future there can be a layer in between userland and kernel for this sort of thing. Maybe we use some of those extra protection rings?

Re: Why the CrowdStrike bug hit banks hard

#38

Post by wolpoli »

concerned_user wrote: post #9
hulitu wrote: post #4

Earlier quoted context omitted.

I think they said it was a windows driver, not a normal application. Running crap in kernel mode does not end well on any OS.

Yes it is a driver which is signed and tested by Microsoft. Driver allows to run arbitrary unsigned code. Why is that allowed?

To get a driver signed by Microsoft, the developer of the driver is required to provide a full cert pass log from the Windows Hardware Lab Kit to dev center [0]. Do you have any article that says the CrowdStrike driver has been tested by Microsoft?

[0]: https://learn.microsoft.com/en-us/windows-hardware/drivers/i...

Re: Why the CrowdStrike bug hit banks hard

#39

Post by cookiengineer »

waihtis wrote: post #28

Regulations are a big reason why this happened, sure, but also it hit the companies with great security budgets more. Hospitals, for instance, weren't that widely affected as they barely have any money to buy security tooling. Silver linings and all that, I guess.

> Hospitals

Everybody seems to be quick to forget about WannaCry.

Re: Why the CrowdStrike bug hit banks hard

#40

Post by SoftTalker »

pantulis wrote: post #2

This is a good writeup, but to be fair it's just not a matter of banking regulations. Basically all big companies are under similar obligations regarding endpoint protection.

If not regulations, then demands by insurers for cyberattack insurance coverage.
Post reply on HN