5 ms·

Massive computer outage, worldwide affecting enterprises with Windows machines running CrowdStrike, a very popular software that is sold as hacking protection b

Massive computer outage, worldwide affecting enterprises with Windows machines running CrowdStrike, a very popular software that is sold as hacking protection but which is, in reality, used by C-suite execs to spy on employee behavior. It is installed with extraordinary permissions and is difficult to fix or remove by design. I wonder if this will teach absolutely anyone a lesson about anything.

BodyCulture 2y ago
Can we please get more information about the spying features? Some screenshots would be great! Thanks!
- spydum 2y ago
  Not as evil as they make it sound. Process Execution, detailed timestamps, and network metadata capture are core features of every EDR tool (CrowdStrike, MDE, SentinelOne, etc) that exists. They can just be abused to monitor user behavior, in addition to threat hunting or malicious activity. Telemetry isn't inherently evil, but organizations need to establish privacy and usage governance around security tools to prohibit abuse.
skynr 2y ago
I think it will. MS has published a number that it was 8.5 million machines, which I don't believe, bur seeing the effort that's gone into the response even at my own relatively mid sized org, there are super simple questions like how the heck do we even get to these devices when hald the crew work remote. The response is and always will be - how much will this cost. We now have the opposing figure, how much will this cost if we don't do it.
- echoangle 2y ago
  Do you believe it was more or less than 8.5 million machines?
  - skynr 2y ago
    I suspect more.
    - smileybarry 2y ago
      I'm sure it was more, MS's crash statistics come from a long pipeline of WER reports. I know for a fact that some organizations disable WER or even blackhole it along with other diagnostics.
      - echoangle 2y ago
        Wasn’t the 8.5 million an estimation? I thought microsoft took the telemetry they got and then adjusted it based on the estimated ratio of machines where telemetry is disabled.

BodyCulture 2y ago

Can we please get more information about the spying features? Some screenshots would be great! Thanks!

spydum 2y ago
Not as evil as they make it sound. Process Execution, detailed timestamps, and network metadata capture are core features of every EDR tool (CrowdStrike, MDE, SentinelOne, etc) that exists. They can just be abused to monitor user behavior, in addition to threat hunting or malicious activity. Telemetry isn't inherently evil, but organizations need to establish privacy and usage governance around security tools to prohibit abuse.

skynr 2y ago

I think it will. MS has published a number that it was 8.5 million machines, which I don't believe, bur seeing the effort that's gone into the response even at my own relatively mid sized org, there are super simple questions like how the heck do we even get to these devices when hald the crew work remote. The response is and always will be - how much will this cost. We now have the opposing figure, how much will this cost if we don't do it.

echoangle 2y ago
Do you believe it was more or less than 8.5 million machines?
- skynr 2y ago
  I suspect more.
  - smileybarry 2y ago
    I'm sure it was more, MS's crash statistics come from a long pipeline of WER reports. I know for a fact that some organizations disable WER or even blackhole it along with other diagnostics.
    - echoangle 2y ago
      Wasn’t the 8.5 million an estimation? I thought microsoft took the telemetry they got and then adjusted it based on the estimated ratio of machines where telemetry is disabled.