Why the CrowdStrike bug hit banks hard

Post by nappsec » Wed, Jul 31, 2024, 4:04 PM UTC

tootie wrote: post #33

btbuildem wrote: post #12

The takeaway from this article seems to be: buy crowdstrike shares, because major corps are unable to make any changes, and will continue to pay licensing fees for this "service" for the foreseeable future.

This is going to crush their sales pipeline and lead to at least a few attempting a migration off. Crowdstrike is unlikely to go out of business, but this is not a good time to buy.

Post by marcosdumay » Wed, Jul 31, 2024, 4:05 PM UTC

toddmorey wrote: post #45

Was anyone else surprised how little disruption they personally experienced? I had braced for impact that weekend. But all my flights were perfectly on time, all my banking worked, providers worked, and sites & resources were available. I don’t know if I somehow just have little exposure to Windows in my life or if there’s an untold resiliency story for the global internet in the face of such a massive outage. All I…

Post by jabroni_salad » Wed, Jul 31, 2024, 4:06 PM UTC

candiddevmike wrote: post #29

pantulis wrote: post #2

This is a good writeup, but to be fair it's just not a matter of banking regulations. Basically all big companies are under similar obligations regarding endpoint protection.

Should endpoint protection require kernel level access? At what point does it stop becoming protection and start becoming a liability? Obligatory who watches/protects the watchmen/protector...

Post by SoftTalker » Wed, Jul 31, 2024, 4:07 PM UTC

shadowgovt wrote: post #31

imiric wrote: post #26

Earlier quoted context omitted.

To be fair, AFAIK the CrowdStrike driver was WHQL-certified. The loophole is that the driver loaded files at runtime, which made it impossible to predict every failure scenario. Maybe this is the loophole that needs closing. You can't claim a driver is certified for Windows if the manufacturer can push arbitrary files that change its behavior. Especially if that manufacturer has sloppy development practices. I unders…

Ironically, this is exactly the failure pattern that the changes in Chrome extensions to manifest v3 try to prevent. You can't provide a guarantee to the end-user of pre-vetted safety when the application is downloading and executing arbitrary code from a third-party source. That's like expecting a static code verifier to prevent all runtime errors. It is, perhaps, a guarantee that no vendor should be expected to mak…

Post by Macha » Wed, Jul 31, 2024, 4:09 PM UTC

ghusto wrote: post #56

Macha wrote: post #34

Earlier quoted context omitted.

They probably had to, in the same way that banks had to use crowdstrike. Much as it's easy for banks to say "we use crowdstrike, like everyone else" rather than implement a bespoke and accountable framework for risk assessment and mitigation for every type of endpoint use case (and argue that case to both the auditor and regular). In this case it's easier for Microsoft to say "see, they can run in kernel space" rathe…

Exactly this. Microsoft did this poorly, so they were forced to allow others to do things poorly too.