Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike Update: Windows Bluescreen and Boot Loops

old.reddit.com

Post reply on HN
Print view View original

311–320 of 1001 posts

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#311

Post by imdsm »

pharos92 wrote: post #299

1. This is why kernel modules are a bad idea 2. This is why centralism is a bad idea 3. This is why sacrificing stability for security is a bad idea 4. Security still needs to factor in security of supply - not just data safety

Centralisation in a nutshell. Monopolies so big that they become globally fragile. CloudFlare outages break a lot of the internet, and now we can see, Windows-based updates bricking machines across the world.

We've all pushed bad updates but how was this not tested?

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#312

Post by patates »

This company has post-apocalyptic style photos to make you panic-buy their solution.

https://ibb.co/Bc6n527

"62 minutes could bring your business down"

I guess they could bring all the businesses down much quicker.

https://www.crowdstrike.com/en-us/#teaser-79minutes-adversar...

(Repeating my comment because other story is duped)

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#313

Post by amluto »

teeheelol wrote: post #203

Throwaway account... CrowdStrike in this context is a NT kernel loadable module (a .sys file) which does syscall level interception and logs then to a separate process on the machine. It can also STOP syscalls from working if they are trying to connect out to other nodes and accessing files they shouldn't be (using some drunk ass heuristics). What happened here was they pushed a new kernel driver out to every client…

I did approximately this recently, but on a Linux machine on GCP. It sucked far worse than it should have: apparently GCP cannot reliably “stop” a VM in a timely manner. And you can’t detach a boot disk from a VM that isn’t “stopped”, nor can you multi-attach it, nor can you (AFAICT) convince a VM to boot off an alternate disk.

I used to have this crazy idea that fancy cloud vendors had competent management tools. Like maybe I could issue an API call to boot an existing instance from an alternate disk or HTTPS netboot URL. Or to insta-stop a VM and get block-level access to its disk via API, even if I had to pay for the instance while doing this.

And I’m not sure that it’s possible to do this sort of recovery at all without blowing away local SSD. There’s a “preview” feature for this on GCP, which seems to be barely supported, and I bet it adds massive latency to the process. Throwing away one’s local SSD on every single machine in a deployment sounds like a great way to cause potentially catastrophic resource usage when everything starts back up.

Hmm, I wonder if you’re even guaranteed to be able to get your instance back after stopping it.

WTF. Why can’t I have any means to access the boot disk of an instance, in a timely manner? Or any better means to recover an instance?

Is AWS any better?

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#317

Post by gmerc »

openrisk wrote: post #196

The details (the particular companies / systems etc) of this global incident don't really matter. When the entire society and economy are being digitized AND that digitisation is controlled and passes through a handful of choke points its an invitation to major disaster. It is risk management 101, never put all your digital eggs in one (or even a few) baskets. The love affair with oligopoly, cornered markets and powe…

Hey hey, Silicon Valley just bought themselves a VP to ensure no regulation.

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#318

Post by nomercy400 »

dalmo3 wrote: post #42

Looks like this also took down half of New Zealand's economy. https://www.nzherald.co.nz/nz/bank-problems-reports-bnz-asb-...

Netherlands is somewhat affected: Two main airports, Rotterdam harbour, a few hospitals and news reporting.

Surprisingly: banks, government, police, fire department, railways, buses are mostly unaffected.

Maybe they have a good IT department/provider.

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#320

Post by adityaathalye »

openrisk wrote: post #196

The details (the particular companies / systems etc) of this global incident don't really matter. When the entire society and economy are being digitized AND that digitisation is controlled and passes through a handful of choke points its an invitation to major disaster. It is risk management 101, never put all your digital eggs in one (or even a few) baskets. The love affair with oligopoly, cornered markets and powe…

Sadly, I'm going to have to update examples in my blog post... https://www.evalapply.org/posts/software-debt/index.html#sof....

Software debt is networked.

I'm writing this in the wake of the aftermath of the disclosure of the log4j zero-day vulnerability. But this is only a recent example of just one kind of networked risk.

With managed services we effectively add one more level to the Inception world of our software organisation. We outsource nice big chunks of supply chain risk management, but we in-source a different risk of depending critically on entities that we do not control and cannot fix if they fail.

Not to mention the fact that change ripples through the parallel yet deeply enmeshed dimensions of cyberspace and meatspace. Code running on hardware is inexorably tied to concepts running in wetware. Of course, at this level of abstraction, the notion applies to any field of human endeavour. Yet, it is so much more true of software. Because software is essentially the thoughts of people being played on repeat.

Post reply on HN