971–980 of 1001 posts
security is a great business - you play on people's fears, your product does not have to deliver the goods.
like the lock maker, you sell a lock, the thief breaks it, but it is not your problem, and you sell a bigger badder lock the next year which promptly gets broken.
as a business, you dont have any consequences for how your product works or doesnt work, what a great business to be in !!
Chances if Microsoft or Crowdstrike will be held liable for financial losses caused by this outage?
Was it really a botched update? Or was it a test run for holding the world hostage prior to a coup?
I work for a diesel truck repair facility and just locked up the doors after a 40 minute day :( . - lifts wont operate. - cant disarm the building alarms. (have been blaring nonstop...) - cranes are all locked in standby/return/err. - laser aligners are all offline. - lathe hardware runs but controllers are all down. - cant email suppliers. - phones are all down. - HVAC is also down for some reason (its getting hot i…
Holy cow...
Who on earth requires a Windows-based backend (or whatever else had CrowdStrike, in the shop or outside) for regular (VoIP) phone calls.
This should really lead to some learnings for anyone providing any kind of phone infrastructure.
What do we do next week ? So assuming everyone uses sneaker-net to restart what’s looking like millions of windows boxes, there comes recriminations but then … what? I think we need to look at minimum viable PC - certain things are protected more than others. Phones are a surprisingly good example - there is a core set of APIs and no fucker is ever allowed to do anything except through those. No matter how painful. A…
So what we need in 95% of boxes is not a fully capable PC - we need a really locked down OS. Or rather we can get by with a locked down OS.
I would put good money on there already being a tiny OS from the ground up in MSFT that could be relabelled windows-locked-Down(13) and sold exclusively to large corporates (and maybe small ones who sign a special piece of marketing paper)
The thing is once you do that you are breaking the idea that windows can run everywhere (or rather we claim Linux runs everywhere but the thing that’s on my default unbuntu install and the thing on my router are different
Throwaway account... CrowdStrike in this context is a NT kernel loadable module (a .sys file) which does syscall level interception and logs then to a separate process on the machine. It can also STOP syscalls from working if they are trying to connect out to other nodes and accessing files they shouldn't be (using some drunk ass heuristics). What happened here was they pushed a new kernel driver out to every client…
"Although Channel Files end with the SYS extension, they are not kernel drivers."
https://www.crowdstrike.com/blog/technical-details-on-todays...
Why are so many mission critical hardware connected systems connected to the internet at all or getting automatic updates? This is just basic IT common sense. You only do updates during a planned outage, after doing an easily reversible backup, or you have two redundant systems in rotation and update and test the spare first. Critical systems connected to things like medical equipment should have no internet connecti…
https://www.theverge.com/2024/7/20/24202527/crowdstrike-micr...
Wow, this hits close to home. Doing a page fault where you can't in the kernel is exactly what I did with my very first patch I submitted after I joined the Microsoft BitLocker team in 2009. I added a check on the driver initialization path and didn't annotate the code as non-paged because frankly I didn't know at the time that the Windows kernel was paged. All my kernel development experience up to that point was wi…
that they don't even do staged/A-B pushes was also
But the most.... ironical was: https://www.theregister.com/2024/07/18/security_review_failu...