4 ms·

I contracted for a company that gave me a company issued macbook with crowdstrike. It logged my execve() or something, because I did a curl from rustup | sh, an

I contracted for a company that gave me a company issued macbook with crowdstrike. It logged my execve() or something, because I did a curl from rustup | sh, and this alerted an admin who then contacted me to ask if this was legitimate behaviour.

ta2457626246 2y ago
Worked for a fairly largish org (~40k emps), and one of the "security" gurus roped me into a conversation because he found a batch file in my Teams shared files. The contents: set JAVA_HOME="what_ever_path" and asked me to explain this egregious hacking attempt.
romanovcode 2y ago
My company had a mandatory req of installing it. If you look into it - it logs and spies on everything you do, every dns req, every website, every application etc. Now my m3-ultra MacBook work computer that they gave is a 4000 USD teams/email machine since I prefer to work on computers without spyware.
- wcski 2y ago
  I understand your preference. I have two questions: 1) Do you think that an organization should have no protections in place? 2) Why not just work from the machine they provided you, and do everything else on a personal machine?
  - hulitu 2y ago
    > 1) Do you think that an organization should have no protections in place? Do you think Crowdstrike offers protection ?
    - wcski 2y ago
      I assume from your rhetorical question that you don't. I personally don't know enough about it to say whether it does or not - but, I will make what I believe is a reasonable assumption and say that all else being equal, yes, a fleet of machines with a EDR sensor installed is more "protected" than a fleet without. If you have a point to make, why not just say what you are trying to say; it will be more effective discourse. I am genuinely curious.
    - briffle 2y ago
      They key to tools like crowdstrike is not so much protection, and being able to trace an attack through the infrastructure. They can see that your credentials were comprimised on your machine, and which systems you then connected to (or that bad process did) so they can trace the attack and make sure get it all cleaned up.

ta2457626246 2y ago

Worked for a fairly largish org (~40k emps), and one of the "security" gurus roped me into a conversation because he found a batch file in my Teams shared files. The contents: set JAVA_HOME="what_ever_path" and asked me to explain this egregious hacking attempt.

romanovcode 2y ago

My company had a mandatory req of installing it. If you look into it - it logs and spies on everything you do, every dns req, every website, every application etc. Now my m3-ultra MacBook work computer that they gave is a 4000 USD teams/email machine since I prefer to work on computers without spyware.

wcski 2y ago
I understand your preference. I have two questions: 1) Do you think that an organization should have no protections in place? 2) Why not just work from the machine they provided you, and do everything else on a personal machine?
- hulitu 2y ago
  > 1) Do you think that an organization should have no protections in place? Do you think Crowdstrike offers protection ?
  - wcski 2y ago
    I assume from your rhetorical question that you don't. I personally don't know enough about it to say whether it does or not - but, I will make what I believe is a reasonable assumption and say that all else being equal, yes, a fleet of machines with a EDR sensor installed is more "protected" than a fleet without. If you have a point to make, why not just say what you are trying to say; it will be more effective discourse. I am genuinely curious.
  - briffle 2y ago
    They key to tools like crowdstrike is not so much protection, and being able to trace an attack through the infrastructure. They can see that your credentials were comprimised on your machine, and which systems you then connected to (or that bad process did) so they can trace the attack and make sure get it all cleaned up.