6 ms·

Shows the dangers of infrastructure running on Windows. There are ways to build resilient systems that can survive shit like this. Look at the internet. Look at

Shows the dangers of infrastructure running on Windows. There are ways to build resilient systems that can survive shit like this. Look at the internet. Look at the phone system.

gjsman-1000 2y ago
Last month; SSH was nearly backdoored with nobody noticing. SSH, open source software, and one of the most important pieces of software ever written for security, was extremely close to failure. If that had happened, an attacker very well could have ended the entire internet as we know it. Imagine if that hacker merely used that backdoor to get into Windows Update servers, Google Play servers, or sent out a CrowdStrike update. We were within weeks of nothing being safe.
- undebuggable 2y ago
  A round decade after Heartbleed... it just periodically reminds that it needs some attention and love. People just use it paying nothing.
- hypeatei 2y ago
  No security vulnerability, even an OpenSSH bug, would result in the internet being taken down overnight. There are organizations and people who apply "security in layers" mindset so that one slip up doesn't result in a complete takeover of systems.
connor4312 2y ago
Crowdstrike could have deployed the same broken code in their Linux or macOS agents. Nothing much for Windows to do if a kernel driver is segfaulting (when disabling it could be dangerous for users.)
- whalesalad 2y ago
  macOS and Linux do not have nearly as much a need for ridiculous endpoint security tools like this to begin with. The world running on Windows is a monumental waste of resources and a huge security threat. This will happen over and over again. The fact that even dummy little terminals that are strictly responsible for showing flight arrivals and departures was impacted by this is hysterical. Why was that not an android or chromeos device with an immutable filesystem, A/B blue green update strategies etc.
  - hypeatei 2y ago
    > The fact that even dummy little terminals that are strictly responsible for showing flight arrivals and departures Exactly. It seems like we're deploying very capable and complex devices for a simple task which is showing a couple pages of text in a table format.
- vbezhenar 2y ago
  So the question is why we need CrowdStrike software in the first place? Why our systems are not secure enough that companies feel the need to install additional security software? Obviously demand for secure operating system is there. CrowdStrike company valued at $80B, so lots of money for Microsoft and other operating software vendors to grab. I do understand that main driver behind CrowdStrike installations is compliance checkbox. It still keeps the question, unless we assume pure corruption. But I've heard opinion from security experts, that this software really improves Windows security.
  - deleted 2y ago
    [deleted]
- photonthug 2y ago
  serious question, does anyone really think Linux antivirals are good or necessary, particularly if they are active measure kernel things and not just passive scanners? I have only seen people use them when windows it departments suddenly have to pretend to be cloud savvy, or when enterprisey infosec teams are looking for more vendors to bloat up their budgets. If it’s written in contracts, it’s not the customers demanding av on ephemeral cloud servers, it’s the home team bloating costs so they can cut them later for a raise and applause. Aaaand whenever it goes that way, antivirals affect performance and stability with random problems, always hurting more than they help
  - whalesalad 2y ago
    Nine times out of ten it’s not even for security it’s for checking some kind of auditing compliance box. We’re perpetuating this nightmare quagmire of shit and no one understand how it works.
    - photonthug 2y ago
      Any details on what compliance regime specifically requires it for Linux tho, and whether it differentiates static servers from ephemeral? I’m just curious since you always hear “compliance” but I’ve never actually seen the requirement coming from anywhere except windows sysadmins who are out of their element
      - whalesalad 2y ago
        Part of the issue is that compliance is so broad and will vary from industry to industry, state to state and country to country. If you’re in defense and work with the government you’re requirements will be different versus healthcare or the education sector. The baseline is NIST guidelines but even that is a huge can of worms. It’s difficult to simply say “yes we’re compliant” especially in large organizations. https://www.cuicktrac.com/nist-compliance/nist-800-171-compliance-checklist/ https://www.cuicktrac.com/nist-compliance/nist-800-171-compl... A lot of orgs get overwhelmed by this, and so they outsource the effort to a third party.
      - 2y ago
dafelst 2y ago
Crowdstrike also managed to take down a bunch of Debian boxes not too long ago - this is not a Windows problem, this is a problem with a vendor product auto deploying bad kernel modules.
- whalesalad 2y ago
  It’s actually a problem with the implementor allowing software to update itself blindly like this. I’d never enable “auto-update” in critical infrastructure. Completely laughable minor league move.

Shows the dangers of infrastructure running on Windows. There are ways to build resilient systems that can survive shit like this. Look at the internet. Look at the phone system.

gjsman-1000 2y ago

Last month; SSH was nearly backdoored with nobody noticing. SSH, open source software, and one of the most important pieces of software ever written for security, was extremely close to failure. If that had happened, an attacker very well could have ended the entire internet as we know it. Imagine if that hacker merely used that backdoor to get into Windows Update servers, Google Play servers, or sent out a CrowdStrike update. We were within weeks of nothing being safe.

undebuggable 2y ago
A round decade after Heartbleed... it just periodically reminds that it needs some attention and love. People just use it paying nothing.
hypeatei 2y ago
No security vulnerability, even an OpenSSH bug, would result in the internet being taken down overnight. There are organizations and people who apply "security in layers" mindset so that one slip up doesn't result in a complete takeover of systems.

connor4312 2y ago

Crowdstrike could have deployed the same broken code in their Linux or macOS agents. Nothing much for Windows to do if a kernel driver is segfaulting (when disabling it could be dangerous for users.)

whalesalad 2y ago
macOS and Linux do not have nearly as much a need for ridiculous endpoint security tools like this to begin with. The world running on Windows is a monumental waste of resources and a huge security threat. This will happen over and over again. The fact that even dummy little terminals that are strictly responsible for showing flight arrivals and departures was impacted by this is hysterical. Why was that not an android or chromeos device with an immutable filesystem, A/B blue green update strategies etc.
- hypeatei 2y ago
  > The fact that even dummy little terminals that are strictly responsible for showing flight arrivals and departures Exactly. It seems like we're deploying very capable and complex devices for a simple task which is showing a couple pages of text in a table format.
vbezhenar 2y ago
So the question is why we need CrowdStrike software in the first place? Why our systems are not secure enough that companies feel the need to install additional security software? Obviously demand for secure operating system is there. CrowdStrike company valued at $80B, so lots of money for Microsoft and other operating software vendors to grab. I do understand that main driver behind CrowdStrike installations is compliance checkbox. It still keeps the question, unless we assume pure corruption. But I've heard opinion from security experts, that this software really improves Windows security.
- deleted 2y ago
  [deleted]
photonthug 2y ago
serious question, does anyone really think Linux antivirals are good or necessary, particularly if they are active measure kernel things and not just passive scanners? I have only seen people use them when windows it departments suddenly have to pretend to be cloud savvy, or when enterprisey infosec teams are looking for more vendors to bloat up their budgets. If it’s written in contracts, it’s not the customers demanding av on ephemeral cloud servers, it’s the home team bloating costs so they can cut them later for a raise and applause. Aaaand whenever it goes that way, antivirals affect performance and stability with random problems, always hurting more than they help
- whalesalad 2y ago
  Nine times out of ten it’s not even for security it’s for checking some kind of auditing compliance box. We’re perpetuating this nightmare quagmire of shit and no one understand how it works.
  - photonthug 2y ago
    Any details on what compliance regime specifically requires it for Linux tho, and whether it differentiates static servers from ephemeral? I’m just curious since you always hear “compliance” but I’ve never actually seen the requirement coming from anywhere except windows sysadmins who are out of their element
    - whalesalad 2y ago
      Part of the issue is that compliance is so broad and will vary from industry to industry, state to state and country to country. If you’re in defense and work with the government you’re requirements will be different versus healthcare or the education sector. The baseline is NIST guidelines but even that is a huge can of worms. It’s difficult to simply say “yes we’re compliant” especially in large organizations. https://www.cuicktrac.com/nist-compliance/nist-800-171-compliance-checklist/ https://www.cuicktrac.com/nist-compliance/nist-800-171-compl... A lot of orgs get overwhelmed by this, and so they outsource the effort to a third party.
    - 2y ago

dafelst 2y ago

Crowdstrike also managed to take down a bunch of Debian boxes not too long ago - this is not a Windows problem, this is a problem with a vendor product auto deploying bad kernel modules.

whalesalad 2y ago
It’s actually a problem with the implementor allowing software to update itself blindly like this. I’d never enable “auto-update” in critical infrastructure. Completely laughable minor league move.