8 ms·

Microsoft needs to apologize too... they recommended CrowdStrike to customers. See for example: https://learn.microsoft.com/en-us/mem/intune/protect/crowdstrike

Microsoft needs to apologize too... they recommended CrowdStrike to customers. See for example: https://learn.microsoft.com/en-us/mem/intune/protect/crowdstrike-falcon-mtd-connector-integration https://learn.microsoft.com/en-us/mem/intune/protect/crowdst... Apparently there was no vetting of this company before allowing them to mess with the Windows kernel. Apple has more vetting before they will let even a TODO list app into their app store. What should Microsoft have done? Require CrowdStrike to have documented processes, and require periodic (like every 6 months) third-party auditing that they have the right processes, and they are complying with their own processes. SOC 2 requires this, see https://en.wikipedia.org/wiki/System_and_Organization_Controls https://en.wikipedia.org/wiki/System_and_Organization_Contro...

Neywiny 2y ago
I guess I agree Microsoft shouldn't be endorsing like this, but access to the kernel is a good thing for other developers. What IT overall should've done was even 1 day of rolling updates. Just something to test it before deploying world-wide. I feel for my company's IT but if (and idk how it's deployed, maybe they can't) they could not deploy updated to everyone at the same time, that would've fixed this.
iscoelho 2y ago
Microsoft allows kernel modules freely [1]. Microsoft does have a process for signing kernel modules, but it is aimed against malware and does not discriminate on the nature of the module [2]. Apple removed support for kernel extensions in Big Sur [3]. Before that, you could sign kernel extensions as long as your Developer ID was permitted, without any requirement to submit the kernel extension to Apple for review [4]. Ironically, the main justification for Apple removing kexts was system stability, because a majority of companies are incapable of writing stable kernel extensions. Nonetheless, Microsoft is historically more restrictive here than Apple. [1] https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/ https://learn.microsoft.com/en-us/windows-hardware/drivers/k... [2] https://learn.microsoft.com/en-us/windows-hardware/drivers/install/kernel-mode-code-signing-requirements--windows-vista-and-later- https://learn.microsoft.com/en-us/windows-hardware/drivers/i... [3] https://support.apple.com/en-us/120363 https://support.apple.com/en-us/120363 [4] https://developer.apple.com/help/account/reference/supported-capabilities-macos https://developer.apple.com/help/account/reference/supported... edit: I would like to add, Windows can't just remove kernel modules. It would be a bloodbath. Apple can only get away with it because they're Apple.
- breadwinner 2y ago
  Apple removed kernel extensibility because a majority of companies are incapable of writing stable kernel extensions? That's exactly the right thing to do. Microsoft may have very stringent controls on how kernel code is tested... but then then they allow a company that does not have similarly stringent controls to extend the kernel... what good is the care with which Microsoft tests kernel code? You can't just blame the third party in this situation. Microsoft gets the blame at the end of the day, see: https://www.washingtonpost.com/technology/2024/07/20/microsoft-outage-crowdstrike-regulatory-scrutiny/ https://www.washingtonpost.com/technology/2024/07/20/microso...
  - iscoelho 2y ago
    You don't need to be in kernel space to brick a computer- you can easily do it from user space! You also don't need to be using Windows. Linux has kernel modules with no restrictions whatsoever (not even signing!), yet we run manage to run Linux stable in mission critical environments that we rely on every day. I don't believe in the fear mongering here. Every competent engineer knew that security/antivirus vendors develop absolute trash code since the start of the century, and that extends to their kernel modules. It is no surprise- so why pretend to be surprised? With that said, I believe everyone is trying to pass blame, but at the end of the day, the blame resides solely with the organizations that purchased their product, or, the industry pressures that necessitated it.
    - breadwinner 2y ago
      > organizations that purchased their product I wouldn't blame the victim here. Microsoft endorses CrowdStrike's product so why would they not purchase it? > or, the industry pressures that necessitated it Those "industry pressures" are under Microsoft's control. The guy who used to run Windows division at Microsoft now says: "From now, the only strategy that is not negligence is to move critical infrastructure to mobile devices." [1] Why can't Windows be just as safe as those mobile devices? It is Microsoft's fault that it isn't. [1] https://x.com/stevesi/status/1814711163860754564 https://x.com/stevesi/status/1814711163860754564
blackeyeblitzar 2y ago
SOC 2 and other similar certifications are just bare minimum checklists. More often than not, they distract teams by making them chase unimportant things just to say they’re certified. If you have been through the process this is very obvious. I’ll also note the SOC standards come from an accounting organization not a technical one.

Neywiny 2y ago

I guess I agree Microsoft shouldn't be endorsing like this, but access to the kernel is a good thing for other developers. What IT overall should've done was even 1 day of rolling updates. Just something to test it before deploying world-wide. I feel for my company's IT but if (and idk how it's deployed, maybe they can't) they could not deploy updated to everyone at the same time, that would've fixed this.

iscoelho 2y ago

Microsoft allows kernel modules freely [1]. Microsoft does have a process for signing kernel modules, but it is aimed against malware and does not discriminate on the nature of the module [2]. Apple removed support for kernel extensions in Big Sur [3]. Before that, you could sign kernel extensions as long as your Developer ID was permitted, without any requirement to submit the kernel extension to Apple for review [4]. Ironically, the main justification for Apple removing kexts was system stability, because a majority of companies are incapable of writing stable kernel extensions. Nonetheless, Microsoft is historically more restrictive here than Apple. [1] https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/ https://learn.microsoft.com/en-us/windows-hardware/drivers/k... [2] https://learn.microsoft.com/en-us/windows-hardware/drivers/install/kernel-mode-code-signing-requirements--windows-vista-and-later- https://learn.microsoft.com/en-us/windows-hardware/drivers/i... [3] https://support.apple.com/en-us/120363 https://support.apple.com/en-us/120363 [4] https://developer.apple.com/help/account/reference/supported-capabilities-macos https://developer.apple.com/help/account/reference/supported... edit: I would like to add, Windows can't just remove kernel modules. It would be a bloodbath. Apple can only get away with it because they're Apple.

breadwinner 2y ago
Apple removed kernel extensibility because a majority of companies are incapable of writing stable kernel extensions? That's exactly the right thing to do. Microsoft may have very stringent controls on how kernel code is tested... but then then they allow a company that does not have similarly stringent controls to extend the kernel... what good is the care with which Microsoft tests kernel code? You can't just blame the third party in this situation. Microsoft gets the blame at the end of the day, see: https://www.washingtonpost.com/technology/2024/07/20/microsoft-outage-crowdstrike-regulatory-scrutiny/ https://www.washingtonpost.com/technology/2024/07/20/microso...
- iscoelho 2y ago
  You don't need to be in kernel space to brick a computer- you can easily do it from user space! You also don't need to be using Windows. Linux has kernel modules with no restrictions whatsoever (not even signing!), yet we run manage to run Linux stable in mission critical environments that we rely on every day. I don't believe in the fear mongering here. Every competent engineer knew that security/antivirus vendors develop absolute trash code since the start of the century, and that extends to their kernel modules. It is no surprise- so why pretend to be surprised? With that said, I believe everyone is trying to pass blame, but at the end of the day, the blame resides solely with the organizations that purchased their product, or, the industry pressures that necessitated it.
  - breadwinner 2y ago
    > organizations that purchased their product I wouldn't blame the victim here. Microsoft endorses CrowdStrike's product so why would they not purchase it? > or, the industry pressures that necessitated it Those "industry pressures" are under Microsoft's control. The guy who used to run Windows division at Microsoft now says: "From now, the only strategy that is not negligence is to move critical infrastructure to mobile devices." [1] Why can't Windows be just as safe as those mobile devices? It is Microsoft's fault that it isn't. [1] https://x.com/stevesi/status/1814711163860754564 https://x.com/stevesi/status/1814711163860754564

blackeyeblitzar 2y ago

SOC 2 and other similar certifications are just bare minimum checklists. More often than not, they distract teams by making them chase unimportant things just to say they’re certified. If you have been through the process this is very obvious. I’ll also note the SOC standards come from an accounting organization not a technical one.