Where are the technical details?
[deleted]
Technical Details on Today's Outage
51–60 of 136 posts
Re: Technical Details on Today's Outage
#52Earlier quoted context omitted.
Halting problem is undecidable. On the scale of "no one bothered to put error handling or validation in" to "a subtle problem exists for this given input"; you and I lack the information to make a judgement.
I mean, the whole world was impacted. All they had to do was test this change in a lab with several pcs. Clearly this wasn't a edge case nor a subtle problem. This was clearly a lack of testing.
It was a Friday. Devs just wanted to go home for the weekend.
Re: Technical Details on Today's Outage
#53Earlier quoted context omitted.
This "channel file" is equivalent to an AV signature file. Crowdstrike is the company, the product here is "Falcon" which does behavioral monitoring of processes both on the device and using logs collected from the device in the cloud. I can see your perspective, but you should consider this: They protect these many companies, industries and even countries at such a global scale and you haven't even heard of them in…
they are dumb enough to process their "channel files" in kernel, this should be only done in usermode
While I can understand both arguments for and against a gradual rollout, this is the main issue: why do these things need to be processed in kernel? And if there’s a good reason to do it, why isn’t there some kind of circuit breaker?
Re: Technical Details on Today's Outage
#54Earlier quoted context omitted.
they are dumb enough to process their "channel files" in kernel, this should be only done in usermode
While I can understand both arguments for and against a gradual rollout, this is the main issue: why do these things need to be processed in kernel? And if there’s a good reason to do it, why isn’t there some kind of circuit breaker?
probably they didn't find solution where they fully trust information coming from usermode process
Re: Technical Details on Today's Outage
#55“Technical” detail report reads more like a lawyer generated report. This company is awful. If I ever get a sales pitch from these shit brains, they will get immediately shut down. Also fuck MS and their awful operating system that then spawned this god awful product/company known as “CrowdStike Falcon”
You are probably not the target market of this product then. The real product CrowdStrike Falcon sells is regulatory compliance and it's a defacto requirement in many regulated industries including banking.
By the way, Falcon can be and is deployed to Linux and MacOS hosts in these organisations too it's just that this particular incident only affected Windows.
Re: Technical Details on Today's Outage
#56So - a malformed configuration is capable of crashing a kernel process. Sounds very exploitable. Very
Re: Technical Details on Today's Outage
#57Light on technical and light on details. Putting the actual blast radius aside, this whole thing seems a bit amateurish for a "security company" that pulls the contracts they do.
Yeah, I think I'm getting more detailed analysis on Social Media from strangers, which I know I should take with a grain of salt. But I guess I'm expecting a lot more than "a filed caused this" from the company that caused this havoc.
Re: Technical Details on Today's Outage
#58Light on technical and light on details. Putting the actual blast radius aside, this whole thing seems a bit amateurish for a "security company" that pulls the contracts they do.
You assume the most competent company got the contracts, which is simply not the world we live in. The company that lobbied the hardest and paid the most in bribes got the contracts.
Rather point I think is there technical and evaluation gates companies of this nature regularly go through while contracting, part of that is being able to talk the language of the industry properly .
This seems very amateurish for companies who regularly talk professionally to win said contracts , whether the best product or not.
My guess is C-suite, crisis consultants and lawyers are involved heavily so the actual engineering folks have little voice now in any communication and we get stuff like this.
Re: Technical Details on Today's Outage
#59Can someone who actually understands what CrowdStrike does explain to me why on earth they don't have some kind of gradual rollout for changes? It seems like their updates go out everywhere all at once, and this sounds absolutely insane for a company at this scale.
My understanding is they basically deployed a configuration file. It seems like these files might be akin to virus signatures or other frequently updated run-time configuration. I actually don't think it's outrageous that these files are rolled out globally, simultaneously. I'm guessing they're updated frequently and _should_ be largely benign. What stands out to me is the fact that a bad config file can crash the sy…
> I actually don't think it's outrageous that these files are rolled out globally, simultaneously.
Anyone competent that manages software at scale should generally hold the opposite opinion to this.
Re: Technical Details on Today's Outage
#60Earlier quoted context omitted.
The kernel driver reads the channel files. It choked on this one, and crashed.
Which implies that any malware capable of replacing these channel files can crash their kernel driver. I wonder if there's a non-crashing way to exploit this & get kernel-space code execution.
IIRC, there were some security software exploits, that trigger RCE (or DoS) of the scanning engine by malicious file?