3 ms·
> The PoC that has been sent to CrowdStrike was flagged as malicious. The msiexec call of the deinstaller was also flagged as malicious. As someon
by guardiangod 4y ago
> The PoC that has been sent to CrowdStrike was flagged as malicious. The msiexec call of the deinstaller was also flagged as malicious.
As someone who was once part of an endpoint security team, I wouldn't be so quick to judge.
If CrowdStrike operates like any anti-virus software company, there are multiple teams. There would be a small engine team, a team that deals with Windows integration, then there would be a much much bigger malware analyst team(s), then another team that deals with 'active machine learning' (CrowdStrike's bread and butter). Then some senior managers oversee them all.
It's possible that the engine team and the analyst team have a case of 'left hand doesn't know what the right hand is doing.' They both got the report, and they behave differently as the engine team has a different goal from the analyst's team.
From the analyst team's point of view, their job is to detect all potentially malicious threat, sources be damned. While the engine team takes their sweet time, the analyst team just figures "hey this binary attacks our software. We don't know if the engine team would have fix the bug then, or if the bug is even real. We should blacklist it just-in-case or else when the binary in the public, some joker with an auto scanner will use this binary to show they got around our detection. Then our team would get blame for it. Better be safe than sorry."
Yes we all know detecting binary PoC are close to useless, but if you don't do it, then you'd get a flood of (useless) reports later...
- detaro 4y agoThis doesn't really address the part where they then said the issue doesn't exist.
- guardiangod 4y agoI am not defending CrowdStrike here (my work laptop, that I am typing this on, is molasse-like thanks to them), but their PSIRT team (they have one right?) is just another team in the corp machinery. What PSIRT team and the engine team decide to respond have no effect on what the analyst team decides to do. Do no harm and cover your ass. No one is going to complain a false positive on a custom PoC binary....right? Everything else, yeah those are pretty shitty.
- ImPostingOnHN 4y agoyou're dancing around the issue though, which is crowdstrike lying in saying there's no vulnerability when they clearly tested it and found there was one
- guardiangod 4y agoI didn't address anything except for the quoted line from the blog post, which is the binary PoC detection part. From the blog post- >The PoC that has been sent to CrowdStrike was flagged as malicious. The msiexec call of the deinstaller was also flagged as malicious. Everything else I have no opinion I wish to share. There are many posters in this thread that would satisfy your desire to engage on the other issues.
- dont__panic 4y agoSeriously, what does CrowdStrike Falcon do to slow down work computers so much? I recently switched gigs and no longer use Crowdstrike, and I didn't realize just how bad it was until I no longer had to deal with it. I've heard there are workarounds to disable or remove CrowdStrike, but I was too concerned that the IT overlords would come after me at my previous employer.