11 ms·

Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor

317 points by detaro 4y ago

tgv 4y ago
That doesn't give me the impression of a company focussed on security. That they marked the installer of the PoC as "malicious" shows they do have a process, but don't take it seriously.
- jupp0r 4y ago
  It’s the snake oil industry. They don’t sell security, they sell CISO get out of jail cards in the form of client agents that constantly remind you of their divine presence by being on top of the CPU utilization sorted process list.
  - TecoAndJix 4y ago
    There is a LOT of snake oil in the industry, but endpoint protection IS useful. Not every person is a Hacker News reading tech enthusiast. People download and do dumb shit. That is not to say every device needs it and at a max “check every process/file activity” level, though.
    - nikanj 4y ago
      10% of Falcon is blocking dumb shit people do. 90% is blocking things people are supposed to be doing, and have been doing successfully so far. Nothing starts your week better than "After the latest definitions update, Falcon heuristic started quarantining your core business tools as suspicious".
      - pja 4y ago
        Nobody else is running your binaries, so they don’t match the hashes of any of the trusted binaries in the database. Obviously they’re suspect & should be quarantined immediately!
      - boondaburrah 4y ago
        They fixed it with an update this month, but CrowdStrike was hooking /every/ single call to NtCreateUserProcess on my work machine last month, and you /know/ how electron-based apps work. VSCode took so long to launch its sub processes it would pop up a crash reporter. "Hello World" compiled from C++ would take a minute to launch sometimes. WSL straight up could not be started because the TTY timed out waiting for it. For some reason java.exe startup was A-OK though so I started using JEdit again. Aggravatingly, it would occasionally disappear my builds and then flag me to IT. My dude, I am hired as a developer of native windows C++ applications why the hell is this trash on my would-be workstation-class machine?
        nikanj 4y ago
        Because your organization's customers demanded your employer get some security certificate, and part of that certification is hoisting that BS on all users
        deleted 4y ago
        [deleted]
        politician 4y ago
        Your organization and your IT department expect you to work around these issues by doing development on your personal machine, and then copying it to your work machine while pretending like you never tunneled to your personal machine from the office. That's what it feels like with some of these policies.
        jupp0r 4y ago
        java.exe was probably excluded.
        wyldfire 4y ago
        I know what I'm calling my next exploit ;)
        4y ago
      - TecoAndJix 4y ago
        I feel your pain at a deep and spiritual level. I have been in charge of at least half a dozen endpoint protection products over the years (deployment, configuration, management, etc.). Once a user experiences what you just described they are (rightfully) suspicious and sour towards endpoint protection. Questions i would ask in your example: 1) Was the core business tool excluded from the more intrusive protection modules or does the tool have a significant risk surface? 2) What was the threshold set for quarantining? Does it make sense in this case? 3) Is/should your device be part of a "Developer" policy that is more permissive? Are all users of the tool impacted? 4) Does this happen frequently? If so, should definitions be manually pushed in batches so everyone is not nerfed at once. 5) What is the process for the developer to report/fix the false positive? Is the response time sufficient? I'm probably forgetting a few. The point is, shit happens (especially with technology). You respond, fix, and hopefully learn. If shit happens a lot, its either because the tool owner doesn't give a shit or the product is shit itself. The delicate balance of security and business operations/innovation is all about weighing and evaluating risk/benefit.
        semi-extrinsic 4y ago
        Can I ask, since you're as a person who has administered endpoint protection products: how much legitimate stuff do they actually catch?
        zdragnar 4y ago
        Not OP, but I've worked for an endpoint protection product company. Part of the onboarding was them loading up a virtual machine with the endpoint installed, then demonstrating several attacks (installing malicious software, running scripts off the internet, etc) and showing the logs of what the endpoint detected, and at what point it shut down the malicious behavior. The examples shown were behavior based, not hash based. It didn't look up a file in a dictionary, it detected priviledge elevations and such. No product is perfect, but if you have a need to be protected (especially if you are at risk from adversaries such as in banking, health care, government work, or against corporate espionage) I'm quite confident in saying that you're much better off with it than without. The same company would also, at random times, attempt to phish us or send us fake emails to get us to click on links, to help educate us on the kinds of threats our customers faced I consider myself fairly savvy, and even I fell for one of them. I ended up leaving for a variety of reasons, but "losing faith in the product" was not one of them.
    - busterarm 4y ago
      Endpoint Protection may be useful but credibility is everything in the industry. CrowdStrike has done loads to damage their own credibility to anyone paying attention, but because they've chosen to be favorable to certain power players along political lines there are folks out there that treat them like the be-all-end-all of the industry. As someone in-industry, hearing people parrot press releases from CrowdStrike has me looking at them sideways. Edit/Addendum: Just to lay bare my opinion of them... CrowdStrike is a clown-ass company run by clown-ass people and with a clown-ass product.
    - outworlder 4y ago
      Endpoint protection is theoretically useful. In practice, most implementations cause more harm than good. Some of them even add vulnerabilities themselves.
  - Melatonic 4y ago
    I would agree for some of the old guard antivirus (looking at you McCrappy) but with the better ones you are also paying for a huge amount of analytics and reporting. If you are dealing with a breach (even a small one) it can be really really nice (and reassuring especially for people at higher levels) to have nice easy to consume data on what the chain of attack was and where it started.
    - jupp0r 4y ago
      Nothing you mentioned on the plus side is actually increasing security. It's really just compliance and potentially containment. Some things that could be done to increase security: - penetration tests paired with employee security training incorporating those results - updating every piece of software and IOT device as frequently as possible - don't use products that execute macros when you open documents and train users to click the allow button - have a functioning SSO system in place and don't rely on something being on the "internal network" as a security measure. Don't have credentials shared between employees, use SSO instead. - universal usage of MFA and password managers
  - galacticaactual 4y ago
    Download and run mimikatz on an endpoint protected by said “snake oil” and one without. Note the difference.
nelox 4y ago
Nothing to see here. Move along.
ehhthing 4y ago
This all seems a bit silly, and could easily be attributed to a communication issue. On CrowdStrike's end, it's much more likely that their systems changed a few heuristics so now it flags certain msiexecs as malicious. Most anti-virus type software are highly nondeterministic in the way they operate, with tiny changes in detection engines able to cause large changes in the way some threats are detected. Even modzero themselves admitted that the vulnerability is not of great severity so the motivation for the security triage team to put more resources in validating a non-severe bug are probably very low. They likely just tried to run the exploit, and didn't think much of it after it didn't work. Also if modzero is not participating in a bug bounty program then CrowdStrike has no obligation in providing them with free trials or such in verifying a vulnerability fix. I'm no fan of CrowdStrike (in fact, one of the more memorable moments for me at my previous job was my boss calling them "ClownStrike"), but it seems as if this is just a bit of overzealous entitlement from modzero as well as not enough testing on CrowdStrike's end.
- FreakLegion 4y ago
  > Even modzero themselves admitted that the vulnerability is not of great severity They're wrong. It's not at all uncommon for companies to give employees admin, and privilege escalation tends to be easy on Windows anyway. > CrowdStrike has no obligation in providing them with free trials or such in verifying a vulnerability fix Sure, and modzero has no obligation to responsibly disclose, and now here we are. I'm sure they'll work it out if this gets noticed. My first direct experience with CrowdStrike was the announcement of VENOM back in 2015 [1], which they coordinated with a few friendlies like FireEye but left most of us in the dark about (I was at Palo Alto Networks, not exactly a small company). Looks like they still struggle with this stuff. 1. https://web.archive.org/web/20150514062749/https://venom.crowdstrike.com/ https://web.archive.org/web/20150514062749/https://venom.cro..., possibly the origin of named and marketed vulnerabilities.
  - vladvasiliu 4y ago
    > privilege escalation tends to be easy on Windows anyway Well, Crowdstrike is supposed to catch and prevent that...
anothernewdude 4y ago
Just sell it and move on with your lives.
jeroenhd 4y ago
Sounds like they expect everyone to be out for a bounty rather than to improve someone else's software so they probably have a contract with HackerOne to let them do all the annoying hard work dealing with security researchers. Personally, I would've released the PoC back in July when they said the problem was resolved. No need to ask if the quote can be used, it's exactly what they told the security researchers after all.
- BeefWellington 4y ago
  What's interesting is there are roles out there where you are not permitted to participate in bug bounty programs. I've worked a few positions where the company outright refused to allow compensation and I wouldn't have been authorized to sign an NDA on behalf of my company just to report issues to a third party. It created a lot of friction but I kind of understand the policy.
- lazyier 4y ago
  Sounds more like these companies are using bounty programs to get researchers to sign NDAs so that they can control public perception of their products. Effectively paying people (and heaping ego gratification on top of that) to be silent about found vulnerabilities.
  - tptacek 4y ago
    Well, sure. That's essentially the trade you're making with a bounty program: you pay people for finding stuff, and get to establish terms for disclosure. If you're not OK with those terms, you can almost always just ignore the bounty and publish directly.
    - jcims 4y ago
      Is there still a safe harbor if you go that route?
      - tptacek 4y ago
mberning 4y ago
Working as a developer inside large enterprise is increasingly intolerable by the day, made possible by tools such as crowdstrike falcon. By the time your workstation is saddled with endpoint security, DLP, zero trust networking, antivirus, etc. it barely functions. And you can get in trouble for doing anything. Installing tree from homebrew can get you flagged on some naughty list where you have to justify why you needed tree of all things.
- mrjin 4y ago
  Exactly. For competent developer, such tool is nothing but wasting time. The reason is simple: if they don't know what they are doing or cannot be trusted, they shouldn't be hired in the first place. But I do understand why those are in place: 1. There are lots of those who have no idea what they are doing in the organization. And/or 2. Some high up who have no idea what they are doing want to show their value. Such move typically happens after someone with Chief Security Officer or similar get hired. Or they do know but simply don't care.
  - mberning 4y ago
    I think there is a lot of value in these tools for the enterprise. Even if it is just CYA insurance. If somebody steals data but you have a DLP tool you can just blame the vendor. My biggest issue with the tools is they have an insanely deleterious impact on performance and the harsh scrutiny applied has a chilling effect on employees. It turns people into drones that do not dare step outside the norm.
    - vladvasiliu 4y ago
      > If somebody steals data but you have a DLP tool you can just blame the vendor. This is just about the main thing that bugs me with this kind of tool: sure you can blame the vendor, but the data is still stolen. And companies are happy to have checked that box and won't bother implementing actually useful policies.
    - bigDinosaur 4y ago
      This is hands down one of the scariest and depressing comments I've ever read on HN.
thisdrunkdane 4y ago
Anybody know their problems with the terms at HackerOne? I admit I don't know HackerOne's term exactly and I'm not that good at reading legalese.
- deleted 4y ago
  [deleted]
- red_trumpet 4y ago
  A bit speculative, but the word "NDA" appears four times in their post.
  - marcinzm 4y ago
    I believe HackerOne has some restrictions on disclosure as with an NDA approval is needed.
  - thisdrunkdane 4y ago
    Yea I noticed that, but what do they specifically not like about the NDA? afaik, HackerOne still makes vulnerability disclosure possible (and automatic if taking too long?)
    - rroot 4y ago
      I guess the specifics are the letters N, D and A and what they stand for. And the fact that there's absolutely nothing in it for them. Would you even consider signing an NDA if I sent you one? I surely hope not.
      - ricardobeat 4y ago
        That’s not an answer to the parent’s question. HackerOne has a disclosure process despite the NDA, so what part of the process is the issue? Or is it simply “hackerone bad”?
        jknoepfler 4y ago
stefantalpalaru 4y ago
tjpnz 4y ago
>modzero's Sr Leadership What planet did they get their MBA from?
mrjin 4y ago
Somehow I feel those security companies are the source of the security problems.
- nopcode 4y ago
  There's very little incentive to actually "solve" the problem.
- Thorrez 4y ago
  Well in this case the vulnerability is the ability to uninstall the program when you're not supposed to be able to uninstall it. So yes, if the program didn't exist at all, there would be no way to uninstall it in an unauthorized manor. So the vulnerability wouldn't exist. You wouldn't necessarily be any more secure though. If you have 10 layers of security and 5 have holes in them, you have 5 vulnerabilities, but you're reasonably secure. If you have 0 layers of security and thus 0 holes in them, you might arguably say you have 0 vulnerabilities, but you would be less secure than the 5 vulnerability system. In the early days of computing you would log in with your username only, no password. Their threat model didn't consider intentional attacks, thus there were no vulnerabilities, but anyone could use anyone else's account.
  - fisf 4y ago
    What is the vulnerability here? An admin user can do admin stuff. Shocking.
    - ImPostingOnHN 4y ago
      if you believe you know the answer to the question, why ask it?
    - Thorrez 4y ago
      Yeah, I'm not 100% sure. I'm not sure what the threat model for Uninstall Protection is. The official description page isn't completely clear. >Uninstall protection prevents unauthorized users from uninstalling the Falcon Agent >The “Maintenance Manager” role is available which grants permission to access the maintenance tokens. This role must be enabled against the Falcon user’s account in order to obtain maintenance tokens or manage policy related to Uninstall Protection. Putting those 2 sentences together seems to lead to the conclusion that if someone doesn't have the "Maintenance Manager" role, that person will be prevented from uninstalling the Falcon Agent. It's unclear to me if all admin users are considered to have the Maintenance Manager role. https://www.crowdstrike.com/blog/tech-center/uninstall-protection-for-the-falcon-agent/ https://www.crowdstrike.com/blog/tech-center/uninstall-prote...
cr3ative 4y ago
Refusing to interact with an existing security process (HackerOne) and demanding a personal contact instead for a minor issue is certainly an interesting take.
- denton-scratch 4y ago
  "Hey neighbour, you left your front-door open". "Can you notify my lawyer by FAX, please? And can you get the document notarized first? Kthxbai".
- mdbug 4y ago
  You find "interesting" that someone just wants to report a security vulnerability without having to accept any conditions first? Funny, I find it interesting that they want to pay a bugbounty even though nobody asked for it. But I guess paying hush money is just cheaper than having to seriously fix the issue.
  - malaya_zemlya 4y ago
    >But I guess paying hush money is just cheaper than having to seriously fix the issue. They did fix the issue, though.
    - Anunayj 4y ago
      They just marked something the way exploit was done as "malacious", without fixing the root problem, or informing the the reporter that they "fixed" it. Instead claiming it was never there. That is very unprofessional! And if these guys were to go though the NDA route, The company may choose just not to fix it at all, and tell these researchers to be quiet about it. And you'd never know there was such a exploit ever.
- CoastalCoder 4y ago
  I don't get the impression that the researchers were simply being lazy or attention-seeking. They objected to having to sign an NDA, when there was no clear incentive to legally bind themselves in that manner.
arminiusreturns 4y ago
The same Crowdstrike that was a key player in Russiagate? Colour me shocked that they do things dumbly. Anyone still using them after that fiasco and its impact on the US should be ashamed. https://thegrayzone.com/2021/10/30/crowdstrike-one-of-russiagates-biggest-culprits-ex-house-investigator/ https://thegrayzone.com/2021/10/30/crowdstrike-one-of-russia... https://thegrayzone.com/2020/05/11/bombshell-crowdstrike-admits-no-evidence-russia-stole-emails-from-dnc-server/ https://thegrayzone.com/2020/05/11/bombshell-crowdstrike-adm...
- pnemonic 4y ago
  Your sources are from thegrayzone? You should learn to consider your sources...
  - arminiusreturns 4y ago
    The GrayZone has been impeccable in their reporting, with any errors quickly being admitted and disclosed. Of course many people disagree with them, and love to try character assassination and other ad hominems, but I've found them informative and having integrity. Maybe you should elaborate your reasoning. To elaborate further: "Leaked emails reveal British journalist Paul Mason plotting with an intel contractor to destroy The Grayzone through “relentless deplatforming” and a “full nuclear legal” attack. The scheme is part of a wider planned assault on the UK left." https://thegrayzone.com/2022/06/07/paul-masons-covert-intelligence-grayzone/ https://thegrayzone.com/2022/06/07/paul-masons-covert-intell...
    - philipwhiuk 4y ago
      Paul Mason isn't a journalist. He was a journalist, then he left and swerved hard left into Momentum. He's previously been members of groups best described as Marxist or at least radical left.
      - pessimizer 4y ago
        He's a spy. edit: cleared by MI5 just like every other BBC journalist in Britain, but moreso, seeing as he was the economics editor for BBC Newsnight, then for Channel 4 News. https://www.cambridgeclarion.org/press_cuttings/mi5.bbc.staff_obs_18aug1985.html https://www.cambridgeclarion.org/press_cuttings/mi5.bbc.staf... https://www.cambridgeclarion.org/press_cuttings/mi5.bbc.page9_obs_18aug1985.html https://www.cambridgeclarion.org/press_cuttings/mi5.bbc.page... https://www.bbc.com/news/stories-43754737 https://www.bbc.com/news/stories-43754737 edit: to be clear, when I say he's a spy, I mean that he is being paid by British intelligence to report on the operations of left wing organizations, sabotage them, push them into doing extreme and unpopular things which also hopefully constitute grounds for arresting targeted individuals, and to say obnoxious things that piss normies off as a representative of "the left" in mainstream media. edit: allegedly.
tptacek 4y ago
This seems extremely tame by vulnerability disclosure fuckup standards.
- bsamuels 4y ago
  Seriously. I don't think the researcher realizes how many people try to bypass hackerone because H1 would have flagged their finding as invalid. Using h1 isn't about bug bounties, it's about not having to spend a 1-2 of your team's full time engineers triaging security researcher reports.
  - thaeli 4y ago
    If H1 was willing to take and triage reports without requiring acceptance of their terms and NDA, that would be fine. We also need to be very clear that the moment a company, or it's authorized representative, flags something as a wontfix or "not a security issue", full and immediate disclosure is fair game.
    - tptacek 4y ago
      I think that clarity already exists.
  - RHSeeger 4y ago
    Then they should provide a path that doesn't involve arbitrary NDAs if you're willing to forego the reward.
    - tptacek 4y ago
      That path already exists: it's called "email security@vendor, tell them what you found, ask when a patch is expected, and then tell them they have 60 days".
  - 0x457 4y ago
    We had some of the dumbest H1 "findings" at some companies that I worked: - Service that is explicitly out of scope of program is "leaking" default CloudFront headers. - Android application can be decompiled (that's it, not secret is there, just the fact that it's possible) - "I can do something bad IF I had a way to load malicious JavaScript" (no, CSRF protection was one and correctly implemented) (there is also no way to upload your own JavaScript) - "I can do things if I open a console in a browser" (can't do anything because CORS policy only allowed for read-only endpoints) - "You can make requests with CURL and not official client" Every week, there was at least one variation of one of those reports. "Hackers" also got very defensive about their "findings" and acted like we don't want to pay them for some "mega hack of the year 0day total domination of user device" vulnerabilities. Not once has anyone found even a minor vulnerability, just wannabes trying to get quick cash. Until we had H1 we had zero reports, with H1 we had moronic reports every other day.
xbar 4y ago
Clownish of CrowdStrike. Take your vulnerability and address it.
balentio 4y ago
Remove lawyers from the composite picture. Is there any rational reason for a NDA in that case? If the answer is no, then in one way or another they are trying to limit liability by limiting the researcher's ability to be paid for their discovery and then communicating that to the wider world.
- thaeli 4y ago
  This isn't about liability. It's about shifting the decision of whether to disclose, and on what timetable, entirely back on the vendor.
  - balentio 4y ago
    Great. Imagine I sell a security product and I make a tidy sum telling you how secure that product is. Turns out, there's a security hole in my product that costs your company 100 million in lawsuits as customer data gets stolen via this hole. Now, you'd like to sue me on my claim on the basis that my security product was in fact, flawed. How's that not about liability?
guardiangod 4y ago
> The PoC that has been sent to CrowdStrike was flagged as malicious. The msiexec call of the deinstaller was also flagged as malicious. As someone who was once part of an endpoint security team, I wouldn't be so quick to judge. If CrowdStrike operates like any anti-virus software company, there are multiple teams. There would be a small engine team, a team that deals with Windows integration, then there would be a much much bigger malware analyst team(s), then another team that deals with 'active machine learning' (CrowdStrike's bread and butter). Then some senior managers oversee them all. It's possible that the engine team and the analyst team have a case of 'left hand doesn't know what the right hand is doing.' They both got the report, and they behave differently as the engine team has a different goal from the analyst's team. From the analyst team's point of view, their job is to detect all potentially malicious threat, sources be damned. While the engine team takes their sweet time, the analyst team just figures "hey this binary attacks our software. We don't know if the engine team would have fix the bug then, or if the bug is even real. We should blacklist it just-in-case or else when the binary in the public, some joker with an auto scanner will use this binary to show they got around our detection. Then our team would get blame for it. Better be safe than sorry." Yes we all know detecting binary PoC are close to useless, but if you don't do it, then you'd get a flood of (useless) reports later...
- detaro 4y ago
  This doesn't really address the part where they then said the issue doesn't exist.
  - guardiangod 4y ago
    I am not defending CrowdStrike here (my work laptop, that I am typing this on, is molasse-like thanks to them), but their PSIRT team (they have one right?) is just another team in the corp machinery. What PSIRT team and the engine team decide to respond have no effect on what the analyst team decides to do. Do no harm and cover your ass. No one is going to complain a false positive on a custom PoC binary....right? Everything else, yeah those are pretty shitty.
    - 4y ago
deleted 4y ago
[deleted]
Exuma 4y ago
Is it weird that I read this as ClowdStrike like a dozen times before realizing it was Crowd?
- 0xbadcafebee 4y ago
  I've heard them referred to as ClownStrike...
  - Exuma 4y ago
    Lmao! Even better. I envision a custard pie as their logo
throwaway034271 4y ago
josephcsible 4y ago
I hate that the component the vulnerability was in even exists. As far as I'm concerned, if a program tries to keep a local administrator from uninstalling it, for any reason, it's malware.
- warhorse10_9 4y ago
  Sorry, but I disagree. You have to look at the customer base crowdstrike is serving which can be wide and varied. There exist environments where the user "needs" admin privileges but should not be able to uninstall the sensor. Think corp where users code etc, but they dont have the admin staff to do some more complicated IT security. In that instance this is just what is needed. Also, privilege escalation exist and these sensor server to help prevent do IR for real malware.
  - joshspankit 4y ago
    Agreed. Windows just does not have the permission granularity necessary for non-standard usecases
broknbottle 4y ago
I’m so sick of dealing with these snake oil salesmen products. CrowdStrike, Trend Micro Deep Shit, McAfee, SentinelOne, BlackBerry Cylance, etc. They are all pushing their users to install proprietary kernel modules and low quality effort solutions. They market this crap as low on resource usage that just hums along.. if you want to introduce random performance issues and crashes, then I would recommend using one of these trash solutions.

317 points by detaro 4y ago

tgv 4y ago

That doesn't give me the impression of a company focussed on security. That they marked the installer of the PoC as "malicious" shows they do have a process, but don't take it seriously.

jupp0r 4y ago
It’s the snake oil industry. They don’t sell security, they sell CISO get out of jail cards in the form of client agents that constantly remind you of their divine presence by being on top of the CPU utilization sorted process list.
- TecoAndJix 4y ago
  There is a LOT of snake oil in the industry, but endpoint protection IS useful. Not every person is a Hacker News reading tech enthusiast. People download and do dumb shit. That is not to say every device needs it and at a max “check every process/file activity” level, though.
  - nikanj 4y ago
    10% of Falcon is blocking dumb shit people do. 90% is blocking things people are supposed to be doing, and have been doing successfully so far. Nothing starts your week better than "After the latest definitions update, Falcon heuristic started quarantining your core business tools as suspicious".
    - pja 4y ago
      Nobody else is running your binaries, so they don’t match the hashes of any of the trusted binaries in the database. Obviously they’re suspect & should be quarantined immediately!
    - boondaburrah 4y ago
      They fixed it with an update this month, but CrowdStrike was hooking /every/ single call to NtCreateUserProcess on my work machine last month, and you /know/ how electron-based apps work. VSCode took so long to launch its sub processes it would pop up a crash reporter. "Hello World" compiled from C++ would take a minute to launch sometimes. WSL straight up could not be started because the TTY timed out waiting for it. For some reason java.exe startup was A-OK though so I started using JEdit again. Aggravatingly, it would occasionally disappear my builds and then flag me to IT. My dude, I am hired as a developer of native windows C++ applications why the hell is this trash on my would-be workstation-class machine?
      - nikanj 4y ago
        Because your organization's customers demanded your employer get some security certificate, and part of that certification is hoisting that BS on all users
        deleted 4y ago
        [deleted]
      - politician 4y ago
        Your organization and your IT department expect you to work around these issues by doing development on your personal machine, and then copying it to your work machine while pretending like you never tunneled to your personal machine from the office. That's what it feels like with some of these policies.
      - jupp0r 4y ago
        java.exe was probably excluded.
        wyldfire 4y ago
        I know what I'm calling my next exploit ;)
        4y ago
    - TecoAndJix 4y ago
      I feel your pain at a deep and spiritual level. I have been in charge of at least half a dozen endpoint protection products over the years (deployment, configuration, management, etc.). Once a user experiences what you just described they are (rightfully) suspicious and sour towards endpoint protection. Questions i would ask in your example: 1) Was the core business tool excluded from the more intrusive protection modules or does the tool have a significant risk surface? 2) What was the threshold set for quarantining? Does it make sense in this case? 3) Is/should your device be part of a "Developer" policy that is more permissive? Are all users of the tool impacted? 4) Does this happen frequently? If so, should definitions be manually pushed in batches so everyone is not nerfed at once. 5) What is the process for the developer to report/fix the false positive? Is the response time sufficient? I'm probably forgetting a few. The point is, shit happens (especially with technology). You respond, fix, and hopefully learn. If shit happens a lot, its either because the tool owner doesn't give a shit or the product is shit itself. The delicate balance of security and business operations/innovation is all about weighing and evaluating risk/benefit.
      - semi-extrinsic 4y ago
        Can I ask, since you're as a person who has administered endpoint protection products: how much legitimate stuff do they actually catch?
        zdragnar 4y ago
        Not OP, but I've worked for an endpoint protection product company. Part of the onboarding was them loading up a virtual machine with the endpoint installed, then demonstrating several attacks (installing malicious software, running scripts off the internet, etc) and showing the logs of what the endpoint detected, and at what point it shut down the malicious behavior. The examples shown were behavior based, not hash based. It didn't look up a file in a dictionary, it detected priviledge elevations and such. No product is perfect, but if you have a need to be protected (especially if you are at risk from adversaries such as in banking, health care, government work, or against corporate espionage) I'm quite confident in saying that you're much better off with it than without. The same company would also, at random times, attempt to phish us or send us fake emails to get us to click on links, to help educate us on the kinds of threats our customers faced I consider myself fairly savvy, and even I fell for one of them. I ended up leaving for a variety of reasons, but "losing faith in the product" was not one of them.
  - busterarm 4y ago
    Endpoint Protection may be useful but credibility is everything in the industry. CrowdStrike has done loads to damage their own credibility to anyone paying attention, but because they've chosen to be favorable to certain power players along political lines there are folks out there that treat them like the be-all-end-all of the industry. As someone in-industry, hearing people parrot press releases from CrowdStrike has me looking at them sideways. Edit/Addendum: Just to lay bare my opinion of them... CrowdStrike is a clown-ass company run by clown-ass people and with a clown-ass product.
  - outworlder 4y ago
    Endpoint protection is theoretically useful. In practice, most implementations cause more harm than good. Some of them even add vulnerabilities themselves.
- Melatonic 4y ago
  I would agree for some of the old guard antivirus (looking at you McCrappy) but with the better ones you are also paying for a huge amount of analytics and reporting. If you are dealing with a breach (even a small one) it can be really really nice (and reassuring especially for people at higher levels) to have nice easy to consume data on what the chain of attack was and where it started.
  - jupp0r 4y ago
    Nothing you mentioned on the plus side is actually increasing security. It's really just compliance and potentially containment. Some things that could be done to increase security: - penetration tests paired with employee security training incorporating those results - updating every piece of software and IOT device as frequently as possible - don't use products that execute macros when you open documents and train users to click the allow button - have a functioning SSO system in place and don't rely on something being on the "internal network" as a security measure. Don't have credentials shared between employees, use SSO instead. - universal usage of MFA and password managers
- galacticaactual 4y ago
  Download and run mimikatz on an endpoint protected by said “snake oil” and one without. Note the difference.

nelox 4y ago

Nothing to see here. Move along.

ehhthing 4y ago

This all seems a bit silly, and could easily be attributed to a communication issue. On CrowdStrike's end, it's much more likely that their systems changed a few heuristics so now it flags certain msiexecs as malicious. Most anti-virus type software are highly nondeterministic in the way they operate, with tiny changes in detection engines able to cause large changes in the way some threats are detected. Even modzero themselves admitted that the vulnerability is not of great severity so the motivation for the security triage team to put more resources in validating a non-severe bug are probably very low. They likely just tried to run the exploit, and didn't think much of it after it didn't work. Also if modzero is not participating in a bug bounty program then CrowdStrike has no obligation in providing them with free trials or such in verifying a vulnerability fix. I'm no fan of CrowdStrike (in fact, one of the more memorable moments for me at my previous job was my boss calling them "ClownStrike"), but it seems as if this is just a bit of overzealous entitlement from modzero as well as not enough testing on CrowdStrike's end.

FreakLegion 4y ago
> Even modzero themselves admitted that the vulnerability is not of great severity They're wrong. It's not at all uncommon for companies to give employees admin, and privilege escalation tends to be easy on Windows anyway. > CrowdStrike has no obligation in providing them with free trials or such in verifying a vulnerability fix Sure, and modzero has no obligation to responsibly disclose, and now here we are. I'm sure they'll work it out if this gets noticed. My first direct experience with CrowdStrike was the announcement of VENOM back in 2015 [1], which they coordinated with a few friendlies like FireEye but left most of us in the dark about (I was at Palo Alto Networks, not exactly a small company). Looks like they still struggle with this stuff. 1. https://web.archive.org/web/20150514062749/https://venom.crowdstrike.com/ https://web.archive.org/web/20150514062749/https://venom.cro..., possibly the origin of named and marketed vulnerabilities.
- vladvasiliu 4y ago
  > privilege escalation tends to be easy on Windows anyway Well, Crowdstrike is supposed to catch and prevent that...

anothernewdude 4y ago

Just sell it and move on with your lives.

jeroenhd 4y ago

Sounds like they expect everyone to be out for a bounty rather than to improve someone else's software so they probably have a contract with HackerOne to let them do all the annoying hard work dealing with security researchers. Personally, I would've released the PoC back in July when they said the problem was resolved. No need to ask if the quote can be used, it's exactly what they told the security researchers after all.

BeefWellington 4y ago
What's interesting is there are roles out there where you are not permitted to participate in bug bounty programs. I've worked a few positions where the company outright refused to allow compensation and I wouldn't have been authorized to sign an NDA on behalf of my company just to report issues to a third party. It created a lot of friction but I kind of understand the policy.
lazyier 4y ago
Sounds more like these companies are using bounty programs to get researchers to sign NDAs so that they can control public perception of their products. Effectively paying people (and heaping ego gratification on top of that) to be silent about found vulnerabilities.
- tptacek 4y ago
  Well, sure. That's essentially the trade you're making with a bounty program: you pay people for finding stuff, and get to establish terms for disclosure. If you're not OK with those terms, you can almost always just ignore the bounty and publish directly.
  - jcims 4y ago
    Is there still a safe harbor if you go that route?
    - tptacek 4y ago

mberning 4y ago

Working as a developer inside large enterprise is increasingly intolerable by the day, made possible by tools such as crowdstrike falcon. By the time your workstation is saddled with endpoint security, DLP, zero trust networking, antivirus, etc. it barely functions. And you can get in trouble for doing anything. Installing tree from homebrew can get you flagged on some naughty list where you have to justify why you needed tree of all things.

mrjin 4y ago
Exactly. For competent developer, such tool is nothing but wasting time. The reason is simple: if they don't know what they are doing or cannot be trusted, they shouldn't be hired in the first place. But I do understand why those are in place: 1. There are lots of those who have no idea what they are doing in the organization. And/or 2. Some high up who have no idea what they are doing want to show their value. Such move typically happens after someone with Chief Security Officer or similar get hired. Or they do know but simply don't care.
- mberning 4y ago
  I think there is a lot of value in these tools for the enterprise. Even if it is just CYA insurance. If somebody steals data but you have a DLP tool you can just blame the vendor. My biggest issue with the tools is they have an insanely deleterious impact on performance and the harsh scrutiny applied has a chilling effect on employees. It turns people into drones that do not dare step outside the norm.
  - vladvasiliu 4y ago
    > If somebody steals data but you have a DLP tool you can just blame the vendor. This is just about the main thing that bugs me with this kind of tool: sure you can blame the vendor, but the data is still stolen. And companies are happy to have checked that box and won't bother implementing actually useful policies.
  - bigDinosaur 4y ago
    This is hands down one of the scariest and depressing comments I've ever read on HN.

thisdrunkdane 4y ago

Anybody know their problems with the terms at HackerOne? I admit I don't know HackerOne's term exactly and I'm not that good at reading legalese.

deleted 4y ago
[deleted]
red_trumpet 4y ago
A bit speculative, but the word "NDA" appears four times in their post.
- marcinzm 4y ago
  I believe HackerOne has some restrictions on disclosure as with an NDA approval is needed.
- thisdrunkdane 4y ago
  Yea I noticed that, but what do they specifically not like about the NDA? afaik, HackerOne still makes vulnerability disclosure possible (and automatic if taking too long?)
  - rroot 4y ago
    I guess the specifics are the letters N, D and A and what they stand for. And the fact that there's absolutely nothing in it for them. Would you even consider signing an NDA if I sent you one? I surely hope not.
    - ricardobeat 4y ago
      That’s not an answer to the parent’s question. HackerOne has a disclosure process despite the NDA, so what part of the process is the issue? Or is it simply “hackerone bad”?
      - jknoepfler 4y ago

stefantalpalaru 4y ago

tjpnz 4y ago

>modzero's Sr Leadership What planet did they get their MBA from?

mrjin 4y ago

Somehow I feel those security companies are the source of the security problems.

nopcode 4y ago
There's very little incentive to actually "solve" the problem.
Thorrez 4y ago
Well in this case the vulnerability is the ability to uninstall the program when you're not supposed to be able to uninstall it. So yes, if the program didn't exist at all, there would be no way to uninstall it in an unauthorized manor. So the vulnerability wouldn't exist. You wouldn't necessarily be any more secure though. If you have 10 layers of security and 5 have holes in them, you have 5 vulnerabilities, but you're reasonably secure. If you have 0 layers of security and thus 0 holes in them, you might arguably say you have 0 vulnerabilities, but you would be less secure than the 5 vulnerability system. In the early days of computing you would log in with your username only, no password. Their threat model didn't consider intentional attacks, thus there were no vulnerabilities, but anyone could use anyone else's account.
- fisf 4y ago
  What is the vulnerability here? An admin user can do admin stuff. Shocking.
  - ImPostingOnHN 4y ago
    if you believe you know the answer to the question, why ask it?
  - Thorrez 4y ago
    Yeah, I'm not 100% sure. I'm not sure what the threat model for Uninstall Protection is. The official description page isn't completely clear. >Uninstall protection prevents unauthorized users from uninstalling the Falcon Agent >The “Maintenance Manager” role is available which grants permission to access the maintenance tokens. This role must be enabled against the Falcon user’s account in order to obtain maintenance tokens or manage policy related to Uninstall Protection. Putting those 2 sentences together seems to lead to the conclusion that if someone doesn't have the "Maintenance Manager" role, that person will be prevented from uninstalling the Falcon Agent. It's unclear to me if all admin users are considered to have the Maintenance Manager role. https://www.crowdstrike.com/blog/tech-center/uninstall-protection-for-the-falcon-agent/ https://www.crowdstrike.com/blog/tech-center/uninstall-prote...

cr3ative 4y ago

Refusing to interact with an existing security process (HackerOne) and demanding a personal contact instead for a minor issue is certainly an interesting take.

denton-scratch 4y ago
"Hey neighbour, you left your front-door open". "Can you notify my lawyer by FAX, please? And can you get the document notarized first? Kthxbai".
mdbug 4y ago
You find "interesting" that someone just wants to report a security vulnerability without having to accept any conditions first? Funny, I find it interesting that they want to pay a bugbounty even though nobody asked for it. But I guess paying hush money is just cheaper than having to seriously fix the issue.
- malaya_zemlya 4y ago
  >But I guess paying hush money is just cheaper than having to seriously fix the issue. They did fix the issue, though.
  - Anunayj 4y ago
    They just marked something the way exploit was done as "malacious", without fixing the root problem, or informing the the reporter that they "fixed" it. Instead claiming it was never there. That is very unprofessional! And if these guys were to go though the NDA route, The company may choose just not to fix it at all, and tell these researchers to be quiet about it. And you'd never know there was such a exploit ever.
CoastalCoder 4y ago
I don't get the impression that the researchers were simply being lazy or attention-seeking. They objected to having to sign an NDA, when there was no clear incentive to legally bind themselves in that manner.

arminiusreturns 4y ago

The same Crowdstrike that was a key player in Russiagate? Colour me shocked that they do things dumbly. Anyone still using them after that fiasco and its impact on the US should be ashamed. https://thegrayzone.com/2021/10/30/crowdstrike-one-of-russiagates-biggest-culprits-ex-house-investigator/ https://thegrayzone.com/2021/10/30/crowdstrike-one-of-russia... https://thegrayzone.com/2020/05/11/bombshell-crowdstrike-admits-no-evidence-russia-stole-emails-from-dnc-server/ https://thegrayzone.com/2020/05/11/bombshell-crowdstrike-adm...

pnemonic 4y ago
Your sources are from thegrayzone? You should learn to consider your sources...
- arminiusreturns 4y ago
  The GrayZone has been impeccable in their reporting, with any errors quickly being admitted and disclosed. Of course many people disagree with them, and love to try character assassination and other ad hominems, but I've found them informative and having integrity. Maybe you should elaborate your reasoning. To elaborate further: "Leaked emails reveal British journalist Paul Mason plotting with an intel contractor to destroy The Grayzone through “relentless deplatforming” and a “full nuclear legal” attack. The scheme is part of a wider planned assault on the UK left." https://thegrayzone.com/2022/06/07/paul-masons-covert-intelligence-grayzone/ https://thegrayzone.com/2022/06/07/paul-masons-covert-intell...
  - philipwhiuk 4y ago
    Paul Mason isn't a journalist. He was a journalist, then he left and swerved hard left into Momentum. He's previously been members of groups best described as Marxist or at least radical left.
    - pessimizer 4y ago
      He's a spy. edit: cleared by MI5 just like every other BBC journalist in Britain, but moreso, seeing as he was the economics editor for BBC Newsnight, then for Channel 4 News. https://www.cambridgeclarion.org/press_cuttings/mi5.bbc.staff_obs_18aug1985.html https://www.cambridgeclarion.org/press_cuttings/mi5.bbc.staf... https://www.cambridgeclarion.org/press_cuttings/mi5.bbc.page9_obs_18aug1985.html https://www.cambridgeclarion.org/press_cuttings/mi5.bbc.page... https://www.bbc.com/news/stories-43754737 https://www.bbc.com/news/stories-43754737 edit: to be clear, when I say he's a spy, I mean that he is being paid by British intelligence to report on the operations of left wing organizations, sabotage them, push them into doing extreme and unpopular things which also hopefully constitute grounds for arresting targeted individuals, and to say obnoxious things that piss normies off as a representative of "the left" in mainstream media. edit: allegedly.

tptacek 4y ago

This seems extremely tame by vulnerability disclosure fuckup standards.

bsamuels 4y ago
Seriously. I don't think the researcher realizes how many people try to bypass hackerone because H1 would have flagged their finding as invalid. Using h1 isn't about bug bounties, it's about not having to spend a 1-2 of your team's full time engineers triaging security researcher reports.
- thaeli 4y ago
  If H1 was willing to take and triage reports without requiring acceptance of their terms and NDA, that would be fine. We also need to be very clear that the moment a company, or it's authorized representative, flags something as a wontfix or "not a security issue", full and immediate disclosure is fair game.
  - tptacek 4y ago
    I think that clarity already exists.
- RHSeeger 4y ago
  Then they should provide a path that doesn't involve arbitrary NDAs if you're willing to forego the reward.
  - tptacek 4y ago
    That path already exists: it's called "email security@vendor, tell them what you found, ask when a patch is expected, and then tell them they have 60 days".
- 0x457 4y ago
  We had some of the dumbest H1 "findings" at some companies that I worked: - Service that is explicitly out of scope of program is "leaking" default CloudFront headers. - Android application can be decompiled (that's it, not secret is there, just the fact that it's possible) - "I can do something bad IF I had a way to load malicious JavaScript" (no, CSRF protection was one and correctly implemented) (there is also no way to upload your own JavaScript) - "I can do things if I open a console in a browser" (can't do anything because CORS policy only allowed for read-only endpoints) - "You can make requests with CURL and not official client" Every week, there was at least one variation of one of those reports. "Hackers" also got very defensive about their "findings" and acted like we don't want to pay them for some "mega hack of the year 0day total domination of user device" vulnerabilities. Not once has anyone found even a minor vulnerability, just wannabes trying to get quick cash. Until we had H1 we had zero reports, with H1 we had moronic reports every other day.

xbar 4y ago

Clownish of CrowdStrike. Take your vulnerability and address it.

balentio 4y ago

Remove lawyers from the composite picture. Is there any rational reason for a NDA in that case? If the answer is no, then in one way or another they are trying to limit liability by limiting the researcher's ability to be paid for their discovery and then communicating that to the wider world.

thaeli 4y ago
This isn't about liability. It's about shifting the decision of whether to disclose, and on what timetable, entirely back on the vendor.
- balentio 4y ago
  Great. Imagine I sell a security product and I make a tidy sum telling you how secure that product is. Turns out, there's a security hole in my product that costs your company 100 million in lawsuits as customer data gets stolen via this hole. Now, you'd like to sue me on my claim on the basis that my security product was in fact, flawed. How's that not about liability?

guardiangod 4y ago

> The PoC that has been sent to CrowdStrike was flagged as malicious. The msiexec call of the deinstaller was also flagged as malicious. As someone who was once part of an endpoint security team, I wouldn't be so quick to judge. If CrowdStrike operates like any anti-virus software company, there are multiple teams. There would be a small engine team, a team that deals with Windows integration, then there would be a much much bigger malware analyst team(s), then another team that deals with 'active machine learning' (CrowdStrike's bread and butter). Then some senior managers oversee them all. It's possible that the engine team and the analyst team have a case of 'left hand doesn't know what the right hand is doing.' They both got the report, and they behave differently as the engine team has a different goal from the analyst's team. From the analyst team's point of view, their job is to detect all potentially malicious threat, sources be damned. While the engine team takes their sweet time, the analyst team just figures "hey this binary attacks our software. We don't know if the engine team would have fix the bug then, or if the bug is even real. We should blacklist it just-in-case or else when the binary in the public, some joker with an auto scanner will use this binary to show they got around our detection. Then our team would get blame for it. Better be safe than sorry." Yes we all know detecting binary PoC are close to useless, but if you don't do it, then you'd get a flood of (useless) reports later...

detaro 4y ago
This doesn't really address the part where they then said the issue doesn't exist.
- guardiangod 4y ago
  I am not defending CrowdStrike here (my work laptop, that I am typing this on, is molasse-like thanks to them), but their PSIRT team (they have one right?) is just another team in the corp machinery. What PSIRT team and the engine team decide to respond have no effect on what the analyst team decides to do. Do no harm and cover your ass. No one is going to complain a false positive on a custom PoC binary....right? Everything else, yeah those are pretty shitty.
  - 4y ago

deleted 4y ago

[deleted]

Exuma 4y ago

Is it weird that I read this as ClowdStrike like a dozen times before realizing it was Crowd?

0xbadcafebee 4y ago
I've heard them referred to as ClownStrike...
- Exuma 4y ago
  Lmao! Even better. I envision a custard pie as their logo

throwaway034271 4y ago

josephcsible 4y ago

I hate that the component the vulnerability was in even exists. As far as I'm concerned, if a program tries to keep a local administrator from uninstalling it, for any reason, it's malware.

warhorse10_9 4y ago
Sorry, but I disagree. You have to look at the customer base crowdstrike is serving which can be wide and varied. There exist environments where the user "needs" admin privileges but should not be able to uninstall the sensor. Think corp where users code etc, but they dont have the admin staff to do some more complicated IT security. In that instance this is just what is needed. Also, privilege escalation exist and these sensor server to help prevent do IR for real malware.
- joshspankit 4y ago
  Agreed. Windows just does not have the permission granularity necessary for non-standard usecases

broknbottle 4y ago

I’m so sick of dealing with these snake oil salesmen products. CrowdStrike, Trend Micro Deep Shit, McAfee, SentinelOne, BlackBerry Cylance, etc. They are all pushing their users to install proprietary kernel modules and low quality effort solutions. They market this crap as low on resource usage that just hums along.. if you want to introduce random performance issues and crashes, then I would recommend using one of these trash solutions.