Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike ex-employees: 'Quality control was not part of our process'

semafor.com

Post reply on HN
Print view View original

71–80 of 311 posts

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#71

Post by gruez »

worik wrote: post #57
apimade wrote: post #43

Earlier quoted context omitted.

Is this really a criticism? Because this has been the case forever with all security and SIEM tools. It’s one of the reasons why the SIEM is the most locked down pieces of software in the business. Realistically, secrets alone shouldn’t allow an attacker access - they should need access to infrastructure or a certificates in machines as well. But unfortunately that’s not the case for many SaaS vendors.

> Because this has been the case forever with all security and SIEM tools. Why? There is no need to send your environment variables.

Otherwise malware can hide in environment variables

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#73

Post by wbl »

apimade wrote: post #43
st3fan wrote: post #36

Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…

Is this really a criticism? Because this has been the case forever with all security and SIEM tools. It’s one of the reasons why the SIEM is the most locked down pieces of software in the business. Realistically, secrets alone shouldn’t allow an attacker access - they should need access to infrastructure or a certificates in machines as well. But unfortunately that’s not the case for many SaaS vendors.

What do you think grants the access to the infra or ability to get a certificate?

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#74

Post by skewer99 »

st3fan wrote: post #36

Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…

The monitoring and collection isn't the problem, that's what modern EDR does - collect, analyze, compare, and do statistics on all of the things.

The plaintext part is not okay.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#75

Post by ants_everywhere »

apimade wrote: post #43
st3fan wrote: post #36

Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…

Is this really a criticism? Because this has been the case forever with all security and SIEM tools. It’s one of the reasons why the SIEM is the most locked down pieces of software in the business. Realistically, secrets alone shouldn’t allow an attacker access - they should need access to infrastructure or a certificates in machines as well. But unfortunately that’s not the case for many SaaS vendors.

Ideally secrets never leave secure enclaves and humans at the organization can't even access them.

It's totally insane to send them to a remote service controlled by another organization.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#76

Post by skewer99 »

x3n0ph3n3 wrote: post #37
st3fan wrote: post #36

Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…

Can you provide some more info on this? How do you know? Is this documented somewhere? I'm sure this is going to raise red-flags in my IT department.

AKIDs... ugh. They'll be there if you use AWS + Mac.

Again, the plaintext is the problem.

These environment variables get loaded from the command line, scripts, etc. - CrowdStrike and all of the best EDRs also collect and send home all of that, but probably in an encrypted stream?

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#78

Post by Natsu »

ants_everywhere wrote: post #75
apimade wrote: post #43

Earlier quoted context omitted.

Is this really a criticism? Because this has been the case forever with all security and SIEM tools. It’s one of the reasons why the SIEM is the most locked down pieces of software in the business. Realistically, secrets alone shouldn’t allow an attacker access - they should need access to infrastructure or a certificates in machines as well. But unfortunately that’s not the case for many SaaS vendors.

Ideally secrets never leave secure enclaves and humans at the organization can't even access them. It's totally insane to send them to a remote service controlled by another organization.

I mean it's right there in the name. They're not really secrets any longer if you're sharing them in plaintext with another company.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#79

Post by llm_trw »

gruez wrote: post #71
worik wrote: post #57

Earlier quoted context omitted.

> Because this has been the case forever with all security and SIEM tools. Why? There is no need to send your environment variables.

Otherwise malware can hide in environment variables

Ok, suppose you're right.

Why are they only doing it for macs then?

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#80

Post by btilly »

st3fan wrote: post #44
apimade wrote: post #43

Earlier quoted context omitted.

Is this really a criticism? Because this has been the case forever with all security and SIEM tools. It’s one of the reasons why the SIEM is the most locked down pieces of software in the business. Realistically, secrets alone shouldn’t allow an attacker access - they should need access to infrastructure or a certificates in machines as well. But unfortunately that’s not the case for many SaaS vendors.

But why only forced on MacOS? I think some configurability would be great. I would like to provide an allow list or the ability to redact. Or exclude specific host groups. We all have different levels of acceptable risk

Conspiracy theory time. Because Apple is the only OS company that has reliably proven that it won't decrypt hard drives at government request.
Post reply on HN