4 ms·

Somehow I feel those security companies are the source of the security problems.

by mrjin 4y ago

nopcode 4y ago
There's very little incentive to actually "solve" the problem.
Thorrez 4y ago
Well in this case the vulnerability is the ability to uninstall the program when you're not supposed to be able to uninstall it. So yes, if the program didn't exist at all, there would be no way to uninstall it in an unauthorized manor. So the vulnerability wouldn't exist. You wouldn't necessarily be any more secure though. If you have 10 layers of security and 5 have holes in them, you have 5 vulnerabilities, but you're reasonably secure. If you have 0 layers of security and thus 0 holes in them, you might arguably say you have 0 vulnerabilities, but you would be less secure than the 5 vulnerability system. In the early days of computing you would log in with your username only, no password. Their threat model didn't consider intentional attacks, thus there were no vulnerabilities, but anyone could use anyone else's account.
- fisf 4y ago
  What is the vulnerability here? An admin user can do admin stuff. Shocking.
  - ImPostingOnHN 4y ago
    if you believe you know the answer to the question, why ask it?
  - Thorrez 4y ago
    Yeah, I'm not 100% sure. I'm not sure what the threat model for Uninstall Protection is. The official description page isn't completely clear. >Uninstall protection prevents unauthorized users from uninstalling the Falcon Agent >The “Maintenance Manager” role is available which grants permission to access the maintenance tokens. This role must be enabled against the Falcon user’s account in order to obtain maintenance tokens or manage policy related to Uninstall Protection. Putting those 2 sentences together seems to lead to the conclusion that if someone doesn't have the "Maintenance Manager" role, that person will be prevented from uninstalling the Falcon Agent. It's unclear to me if all admin users are considered to have the Maintenance Manager role. https://www.crowdstrike.com/blog/tech-center/uninstall-protection-for-the-falcon-agent/ https://www.crowdstrike.com/blog/tech-center/uninstall-prote...
  - Sohcahtoa82 4y ago
    On Windows, there are things that even the Administrator user can't do, at least not directly. One example I know off the top of my head because I know from experience is accessing Bluetooth encryption keys in the registry. Even if you launched Regedit as Administrator, you'll get ACCESS DENIED reading them. But if you use `psexec` to start Regedit as the SYSTEM user, you'll have access. My guess is that CrowdStrike installs itself with permissions that prevent Administrator from uninstalling it.

Somehow I feel those security companies are the source of the security problems.

by mrjin 4y ago

Somehow I feel those security companies are the source of the security problems.

nopcode 4y ago

There's very little incentive to actually "solve" the problem.

Thorrez 4y ago

Well in this case the vulnerability is the ability to uninstall the program when you're not supposed to be able to uninstall it. So yes, if the program didn't exist at all, there would be no way to uninstall it in an unauthorized manor. So the vulnerability wouldn't exist. You wouldn't necessarily be any more secure though. If you have 10 layers of security and 5 have holes in them, you have 5 vulnerabilities, but you're reasonably secure. If you have 0 layers of security and thus 0 holes in them, you might arguably say you have 0 vulnerabilities, but you would be less secure than the 5 vulnerability system. In the early days of computing you would log in with your username only, no password. Their threat model didn't consider intentional attacks, thus there were no vulnerabilities, but anyone could use anyone else's account.

fisf 4y ago
What is the vulnerability here? An admin user can do admin stuff. Shocking.
- ImPostingOnHN 4y ago
  if you believe you know the answer to the question, why ask it?
- Thorrez 4y ago
  Yeah, I'm not 100% sure. I'm not sure what the threat model for Uninstall Protection is. The official description page isn't completely clear. >Uninstall protection prevents unauthorized users from uninstalling the Falcon Agent >The “Maintenance Manager” role is available which grants permission to access the maintenance tokens. This role must be enabled against the Falcon user’s account in order to obtain maintenance tokens or manage policy related to Uninstall Protection. Putting those 2 sentences together seems to lead to the conclusion that if someone doesn't have the "Maintenance Manager" role, that person will be prevented from uninstalling the Falcon Agent. It's unclear to me if all admin users are considered to have the Maintenance Manager role. https://www.crowdstrike.com/blog/tech-center/uninstall-protection-for-the-falcon-agent/ https://www.crowdstrike.com/blog/tech-center/uninstall-prote...
- Sohcahtoa82 4y ago
  On Windows, there are things that even the Administrator user can't do, at least not directly. One example I know off the top of my head because I know from experience is accessing Bluetooth encryption keys in the registry. Even if you launched Regedit as Administrator, you'll get ACCESS DENIED reading them. But if you use `psexec` to start Regedit as the SYSTEM user, you'll have access. My guess is that CrowdStrike installs itself with permissions that prevent Administrator from uninstalling it.