Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the CrowdStrike bug hit banks hard

bitsaboutmoney.com

Post reply on HN
Print view View original

61–70 of 250 posts

Re: Why the CrowdStrike bug hit banks hard

#61

Post by ghusto »

ortusdux wrote: post #13
deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

Is there any merit to Microsoft's argument that the EU forced them into keeping their kernel accessible by 3rd parties? https://www.theregister.com/2024/07/22/windows_crowdstrike_k...

Yes and no. As others have pointed out above, it is factually correct that they were forced by the EU to give access to kernelspace. However, it is also true that the only reason for that was that _they_ were using kernelspace for the same things (instead of creating a framework and API into the features needed).

Re: Why the CrowdStrike bug hit banks hard

#62

Post by nerdponx »

tootie wrote: post #33
btbuildem wrote: post #12

The takeaway from this article seems to be: buy crowdstrike shares, because major corps are unable to make any changes, and will continue to pay licensing fees for this "service" for the foreseeable future.

This is going to crush their sales pipeline and lead to at least a few attempting a migration off. Crowdstrike is unlikely to go out of business, but this is not a good time to buy.

Seems ideal. Get in while the price is discounted relative to the overall market.

Re: Why the CrowdStrike bug hit banks hard

#63

Post by adrr »

candiddevmike wrote: post #29
pantulis wrote: post #2

This is a good writeup, but to be fair it's just not a matter of banking regulations. Basically all big companies are under similar obligations regarding endpoint protection.

Should endpoint protection require kernel level access? At what point does it stop becoming protection and start becoming a liability? Obligatory who watches/protects the watchmen/protector...

How else would you monitor a windows box? EU won't allow Microsoft to lock down their kernel and provide MacOS type solution with APIs for trust publishers.

Re: Why the CrowdStrike bug hit banks hard

#64

Post by marcosdumay »

Cthulhu_ wrote: post #7
deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

In the article it states that Microsoft HAD to allow Crowdstrike to run in kernelspace by EU laws, because else MS would have the monopoly on kernel-level security solutions / integrations.

They had to allow the same kind of access they have on their own "security" software.

Nothing in that means they need ring-0 access.

Re: Why the CrowdStrike bug hit banks hard

#65

Post by __MatrixMan__ »

I like the technical stuff here.

I'm not so sure about this:

> money is core societal infrastructure, like the power grid and transportation systems are. It would be really bad if hackers working for a foreign government could just turn off money.

Sure, it would be inconvenient in the short term. But I think the current design is holding us back.

I suspect that most of us would have more to gain than to lose if we managed to shut off money-as-we-know-it and keep it off for long enough to iterate on alternatives. Any design that even tried to step beyond "well that's how we've always done it" would likely land somewhere better than what we're doing. Much has changed since Alexander Hamilton.

Re: Why the CrowdStrike bug hit banks hard

#66

Post by candiddevmike »

btbuildem wrote: post #12

The takeaway from this article seems to be: buy crowdstrike shares, because major corps are unable to make any changes, and will continue to pay licensing fees for this "service" for the foreseeable future.

The lawsuits alone are going to be eyewatering. But sure, buy those shares.

Re: Why the CrowdStrike bug hit banks hard

#67

Post by btilly »

ghusto wrote: post #41
greenn wrote: post #37

Earlier quoted context omitted.

With the current model kernel level access is required. Real security products have to be able to operate above userland. Ideally in the future there can be a layer in between userland and kernel for this sort of thing. Maybe we use some of those extra protection rings?

Couldn't you just ask some OS APIs provided by something in kernelspace for what you need? In fact, isn't this how macOS does things?

You could, and in fact this is what Microsoft wanted to do. The EU said that they couldn't.

And the reason why not is simple. Anything that Microsoft thinks is a good thing to add to the API, they'll add for themselves. When the new API is released, their software is released with it. This gives them a competitive advantage over competitors who have to wait for Microsoft to have the idea that they want, and then scramble to implement it after Microsoft does.

The EU is suspicious of this for the simple reason that Microsoft has a several decade history of doing exactly that. Repeatedly. My favorite example being the release of Windows 95 with Microsoft Word available at the same time, and with WordPerfect unable to run. By the time WordPerfect had figured out how to port their software to Windows 95, they were no longer the market leader.

Re: Why the CrowdStrike bug hit banks hard

#68

Post by SirMittens »

hpen wrote: post #46

We blame car manufacturers for defects from suppliers, but we don't blame platform manufacturers (Microsoft) for holes in their architecture?

I think that's the wrong analogy. A more correct one would be "Should we blame a car company for a broken engine, that was modified after it was sold to you?".

A kernel level driver from a 3rd party is something that you willingly add to the OS, it wasn't there.

Just because windows allow you to do it, doesn't mean you should.

I mean, you can apply some dangerous mods to your car's engine, but you probably shouldn't, and if you do, it's your responsibility, not the car company.

Re: Why the CrowdStrike bug hit banks hard

#69

Post by [deleted] »

ctxc wrote: post #20
deepsun wrote: post #3

I'm still amazed how the blame shifted from Microsoft to CrowdStrike. Yes, CrowdStrike update caused that -- but applications fail all the time. It was Microsoft's oversight to put it on Windows critical path. And banks/airlines etc were hit hard because their _Windows_ didn't boot, not because of an application crash on a perfectly working Windows.

The application (Crowdstrike) was part of Windows' booting process. Windows cannot simply "skip" failed drivers. Say Crowdstrike driver failed as a one time thing, Windows skipped it instead of retrying which led to the endpoint being vulnerable and a ransomware happens. We'd be saying the opposite now. This is a high-impact ability Windows offers to applications - and applications should take responsibility and trea…

[deleted]

Re: Why the CrowdStrike bug hit banks hard

#70

Post by davio »

toddmorey wrote: post #45

Was anyone else surprised how little disruption they personally experienced? I had braced for impact that weekend. But all my flights were perfectly on time, all my banking worked, providers worked, and sites & resources were available. I don’t know if I somehow just have little exposure to Windows in my life or if there’s an untold resiliency story for the global internet in the face of such a massive outage. All I…

I was unaffected on my work laptop. One of my coworkers is a long-timer and said when the company first got laptops there was a huge "OMG leave your laptops on overnight" push to make sure updates were applied. I always at least sleep if not shut-down after work so I guess I missed out
Post reply on HN