6 ms·
Does CS actually offer any real protection? I always thought it was just feel-good software, that Windows had caught up to separating permissions since after XP
by the_gipsy 2y ago
Does CS actually offer any real protection? I always thought it was just feel-good software, that Windows had caught up to separating permissions since after XP or so. Either one is lying/scamming, but which one?
- padjo 2y agoEvery company I’ve ever worked at has wound up having to install antivirus software to pass audits. The software only ever caused problems and never caught anything. But hey, we passed the audit so we’re good right?
- fvold 2y agoThe real scam is the audit. Many moons ago, I failed a "security audit" because `/sbin/iptables --append INPUT --in-interface lo --jump ACCEPT` "This leaves the interface completely unfiltered" Since then, I've not trusted any security expert until I've personally witnessed their competence.
- gonium 2y agoThe dreaded exposed loopback interface... I'm an (internal) auditor, and I see huge variations in competence. Not sure what to do about it, since most technical people don't want to be in an auditor role.
- irusensei 2y agoThe companies I had the displeasure of dealing with were basically run by mindless people with a shell script.
- l33t7332273 2y agoI agree completely. It makes me wonder if other engineering disciplines have this same competency issue.
- finaard 2y agoLong time ago I was working for a web hoster, and had to help customers operating web shops to pass audits required for credit card processing. Doing so regularly involved allowing additonal ciphers for SSL we deemed insecure, and undoing other configurations for hardening the system. Arguing about it is pointless - either you make your system more insecure, or you don't pass the audit. Typically we ended up configuring it in a way that we can easily toggle those two states, and reverted it back to a secure configuration once the customer got their certificate, and flipped it back to insecure when it was time to reapply for the certification.
- jfyi 2y agoThis tracks for me. PA-DSS was a pain with ssl and early tls... our auditor was telling us to disable just about everything (and he was right) and the gateways took forever to move to anything that wasn't outdated. Then our dealerships would just disable the configuration anyway. It's been better in recent years.
- drewlander 2y agoWe did this at one place I used to work at. We had lots of Linux systems. We installed clamAV but kept the service disabled. The audit checkbox said “installed” and it fulfilled the checkbox…
- saagarjha 2y agoEDR vendors are generally lying unless they tell you anything but "install us if you want to pass certification".
- therein 2y agoMy contacts abroad are saying "that software US government mandated us to install on our clients and servers to do business with US companies is crashing our machines". When did Crowdstrike get this gold standard super seal of approval? What could they be referring to?
- 0xedd 2y ago[flagged]
- saagarjha 2y agoNah, more like your security/usability/reliability tradeoff needs to be better.
- wwtrv 2y ago> if it's not 100% secure It's 100% broken though... I guarantee you that the damage caused by Crowdstrike today will significantly outweigh any security benefits/savings that using their software might have had over the years.
- ta1243 2y agoThe benefits include 1) Nice trips to golf courses before contract renewal 2) Nice meals at fancy restaurants before contract renewal 3) Someone for the CTO to blame when something goes wrong
- CaliforniaKarl 2y agoYes, from experience, I can say that CS does offer real protection.
- tecleandor 2y agoAFAIK, most of the people I know that deploy CrowdStrike (including us) just do it to check a box for audits and certifications. They don't care much about protections and will happily add exceptions on places where it gives problems (and that's a lot of places)
- conradfr 2y agoWhat a dream business.
- adamhp 2y agoYou're so right. Pay us ludicrous sums to make your auditors feel good. Crazy.
- ibejoeb 2y agoSo much of regulation is just a round-about to creating business for regulatory compliance.
- CoastalCoder 2y agoGood for profits, but it bet there are some employees who feel a distinct lack of joy about their work.
- TeMPOraL 2y agoIt's not about checking the boxes themselves, but the shifting of liability that enables. Those security companies are paid well not for actually providing security, but for providing a way to say, "we're not at fault, we adhered to the best security practices, there's nothing we could've done to prevent the problem".
- saganus 2y agoSo in essence just a flavor of insurance? Shouldn't that hit Crowdstrike's stock price much more than it has then? (so far I see ~11% down which is definitely a lot but it looks like they will survive).
- _8j50 2y agoYes, it offers very real protection. Crowdstrike in particular is the best in the market, speaking from experience and having worked with their competitor's products as well and responded to real world compromises.
- arjunaaqa 2y agoHow did they fail to test such a critical bug then ? Clearly shows lack of testing. If intially good, probably culture & products have rotten. Not fit to be in security domain, if like this.
- deleted 2y ago[deleted]
- l33t7332273 2y agoI think this is more of a failure on the software development side than the domain specific functionality side.
- jellykid 2y agoHubris. Clearly they have no form of internal testing for updates because this should have been caught immediately.
- scblock 2y ago"best in the market" I think the evidence shows that no, they aren't.
- hello_moto 2y agoGo buy the second-best in the market then. Red Team would love you to do that.
- lucasRW 2y agoAs a redteamer I guarantee you that a Windows endpoint without EDR is caviar for us...
- echoangle 2y agoAre there publicly known exploits which allow RCE or data extraction on a default windows installation?
- mr_mitm 2y agoNot on a fully patched system. 0-days are relatively rare and fixed pretty quickly by Microsoft.
- zokier 2y agoRemember WannaCry? The vuln it used was patched by MS two months prior the attack. Yet it took the world by storm.
- mr_mitm 2y agoNot sure what you want from me, I simply answered the question. Yes I remember WannaCry.
- deleted 2y ago[deleted]
- superidiot1932 2y agoHow is it caviar then?
- mr_mitm 2y agoNot the same poster, but one phase of a typical attack inside a corporate network is lateral movement. You find creds on one system and want to use them to log on to a second system. Often, these creds have administrative privileges on the second system. No vulnerabilities are necessary to perform lateral movement. Just as an example: you use a mechanism similar to psexec to execute commands on the remote system using the SMB service. If the remote system has a capable EDR, it will shut that down and report the system from which the connection came from to the SOC, perhaps automatically isolate it. If it doesn't, an attacker moves laterally through your entire network with ease in no time until they have domain admin privs.
- mr_mitm 2y agoJust adding my two cents: I work as a pentester and arguably all of my colleagues agree that engagements where Crowdstrike is deployed are the worst because it's impossible to bypass.
- ajscanlan 2y agovaluable 2 cents is there any writeups from the pentesting side of things that we can read to learn more?
- l33t7332273 2y agoI’ll say this: I did a small lab in college for a hardware security class and I got a scary email from IT because CrowdStrike noticed there was some program using speculative execution/cache invalidation to leak data on my account - they recognized my small scale example leaking a couple of bytes. Pretty impressive to be honest.
- apitman 2y agoDid you have CrowdStrike installed on your personal machine, or did they detect it over the network somehow?
- l33t7332273 2y agoWe ran our code on our own accounts on the school’s system.
- kelsey98765431 2y agoThose able to write and use FUD malware do not create public documentation. Crowdstrike is not impossible to bypass, but for a junior security journeyman known as a pentester, working for corporate interests with no budget and absurdly limited scopes under contract for n-hours a week for 3 weeks will never be able to do anything as simple as an EDR evasion, however if you wish to actually learn the basics the common practitioner of this art please go study the offsec evasion class. Then go read a lot of code and syscall documentation and learn assembly.
- dhjhdskj 2y agoAnyone who claims CS is nothing but a compliance checkbox has never worked as an actual analyst, of course it's effective...no, dur, its worth 50bn for no reason...god some people are stupid AND loud
- ta1243 2y ago> Does CS actually offer any real protection? I always thought it was just feel-good software, that Windows had caught up to separating permissions since after XP or so. Either one is lying/scamming, but which one? Our ZScaler rep (basically, they technically work for us) come out with massive impressive looking numbers of the thousands of threats they detect and eliminate every month Oddly before we had zscaler we didn't seem to have any actual problems. Now we have it and while we have lots of zscaler caused problems around performance and location, we still don't have any actual problems. Feels very much like a tiger repelling rock. But I'm sure the corporate hospitality is fun.