6 ms·

I'd say no. Kolide is one such attempt, and their practices, and how it's used in companies, are as insidious as those from a proprietary product. As a user, it

• pxc 2y ago
  I'm curious about this bad 'news' about Kolide. Could you tell me more about your experience with it?
  • imiric 2y ago
    I don't have first-hand experience with Kolide, as I refused to install it when it was pushed upon everyone in a company I worked for. Complaints voiced by others included false positives (flagging something as a threat when it wasn't, or alerting that a system wasn't in place when it was), being too intrusive and affecting their workflow, and privacy concerns (reading and reporting all files, web browsing history, etc.). There were others I'm not remembering, as I mostly tried to stay away from the discussion, but it was generally disliked by the (mostly technical) workforce. Everyone just accepted it as the company deemed it necessary to secure some enterprise customers. Also, Kolide's whole spiel about "honest security"[1] reeks of PR mumbo jumbo whose only purpose is to distance themselves from other "bad" solutions in the same space, when in reality they're not much different. It's built by Facebook alumni, after all, and relies on FB software (osquery). [1]: https://honest.security/ https://honest.security/
    • DrRobinson 2y ago
      I think some of the information here is misleading and a bit unfair. > being too intrusive and affecting their workflow Kolide is a reporting tool, it doesn't for example remove files or put them in quarantine. You also cannot execute commands remotely like in Crowdstrike. As you mentioned, it's based on osquery which makes it possible to query machine information using SQL. Usually, Kolide is configured to send a Slack message or email if there is a finding, which I guess can be seen as intrusive but IMO not very. > reading and reporting all files It does not read and report all files as far as I know, but I think it's possible to make SQL queries to read specific files. But all files or file names aren't stored in Kolide or anything like that. And that live query feature is audited (ens users can see all queries run against their machines) and can be disabled by administrators. > web browsing history This is not directly possible as far as I know, but maybe via a file read query but it's not something built-in out of the box/default. And again, custom queries are transparent to users and can be disabled. > Kolide's whole spiel about "honest security"[1] reeks of PR mumbo jumbo whose only purpose is to distance themselves from other "bad" solutions in the same space While it's definitely a PR thing, they might still believe in it and practice what they preach. To me it sounds like a good thing to differentiate oneself from bad actors. Kolide gives users full transparency of what data is collected via their Privacy Center, and they allow end users to make decisions about what to do about findings (if anything) rather than enforcing them. > It's built by Facebook alumni, after all, and relies on FB software (osquery). For example React and Semgrep is also built by Facebook/Facebook alumni, but I don't really see the relevance other than some ad-hominem. Full disclosure: No association with Kolide, just a happy user.
      • madeofpalk 2y ago
        Great news - Kolide has a new integration with Okta that'll prevent you from logging into anything if Kolide has a problem with your device!
      • imiric 2y ago
        I concede that I may be unreasonably biased against Kolide because of the type of software it is, but I think you're minimizing some of these issues. My memory may be vague on the specifics, but there were certainly many complaints in the areas I mentioned in the company I worked at. That said, since Kolide/osquery is a very flexible product, the complaints might not have been directed at the product itself, but at how it was configured by the security department as well. There are definitely some growing pains until the company finds the right balance of features that everyone finds acceptable. Re: intrusiveness, it doesn't matter that Kolide is a report-only tool. Although, it's also possible to install extensions[1,2] that give it a deeper control over the system. The problem is that the policies it enforces can negatively affect people's workflow. For example, forcing screen locking after a short period of inactivity has dubious security benefits if I'm working from a trusted environment like my home, yet it's highly disruptive. (No, the solution is not to track my location, or give me a setting I have to manage...) Forcing automatic system updates is also disruptive, since I want to update and reboot at my own schedule. Things like this add up, and the combination of all of them is equivalent to working in a babyproofed environment where I'm constantly monitored and nagged about issues that don't take any nuance into account, and at the end of the day do not improve security in the slightest. Re: web browsing history, I do remember one engineer looking into this and noticing that Kolide read their browser's profile files, and coming up with a way to read the contents of the history data in SQLite files. But I am very vague on the details, so I won't claim that this is something that Kolide enables by default. osquery developers are clearly against this kind of use case[3]. It is concerning that the product can, in theory, be exploited to do this. It's also technically possible to pull any file from endpoints[4], so even if this is not directly possible, it could easily be done outside of Kolide/osquery itself. > Kolide gives users full transparency of what data is collected via their Privacy Center Honestly, why should I trust what that says? Facebook and Google also have privacy policies, yet have been caught violating their users' privacy numerous times. Trust is earned, not assumed based on "trust me, bro" statements. > For example React and Semgrep is also built by Facebook/Facebook alumni, but I don't really see the relevance other than some ad-hominem. Facebook has historically abused their users' privacy, and even has a Wikipedia article about it.[5] In the context of an EDR system, ensuring trust from users and handling their data with the utmost care w.r.t. their privacy are two of the most paramount features. Actually, it's a bit silly that Kolide/osquery is so vocal in favor of preserving user privacy, when this goes against working with employer-owned devices where employee privacy is definitely not expected. In any case, the fact this product is made by people who worked at a company built by exploiting its users is very relevant considering the type of software it is. React and Semgrep have an entirely different purpose. [1]: https://github.com/trailofbits/osquery-extensions https://github.com/trailofbits/osquery-extensions [2]: https://github.com/hippwn/osquery-exec https://github.com/hippwn/osquery-exec [3]: https://github.com/osquery/osquery/issues/7177 https://github.com/osquery/osquery/issues/7177 [4]: https://osquery.readthedocs.io/en/stable/deployment/file-carving/ https://osquery.readthedocs.io/en/stable/deployment/file-car... [5]: https://en.wikipedia.org/wiki/Privacy_concerns_with_Facebook https://en.wikipedia.org/wiki/Privacy_concerns_with_Facebook
• chii 2y ago
  whether you morally agree with surveillance software's purpose is not the same as whether a particular piece of surveillence software works well or not. I would imagine an open source version of crowdstrike would not have had such a bad outcome.
  • imiric 2y ago
    I disagree with the concept of surveillance altogether. Computer users should be educated about security, given control of their devices, and trusted that they will do the right thing. If a company can't do that, that's a sign that they don't have good security practices to begin with, and don't do a good job at hiring and training. The only reason this kind of software is used is so that companies can tick a certification checkbox that gives the appearance of running a tight ship. I realize it's the easy way out, and possibly the only practical solution for a large corporation, but then this type of issues is unavoidable. Whether the product is free or proprietary makes no difference.
    • sooper 2y ago
      Most people do not understand, or care to understand, what "security" means. You highlight training as a control. Training is expensive - to reduce cost and enhanced effectiveness, how do you focus training on those that need it without any method to identify those that do things in insecure ways? Additionally, I would say a major function of these systems is not surveillance at all - it is preventive controls to prevent compromise of your systems. Overall, your comment strikes me a naive and not based on operational experience.
      • TeMPOraL 2y ago
        This type of software is notorious for severely degrading employees' ability to do their jobs, occasionally preventing it entirely. It's a main reason why "shadow IT" is a thing - bullshit IT restrictions and endpoint security malware can't reach third-party SaaS' servers. This is to say, there are costs and threats caused by deploying these systems too, and they should be considered when making security decisions.
• WA 2y ago
  > Companies that use it don't understand security What should these companies understand about security exactly? And aren’t they kinda right to not trust their employees if they employ 50,000 people with different skills and intentions?
  • Voultapher 2y ago
    Security is a process not a product. Anyone selling you security as a product is scamming you. These endpoint security companies latch onto people making decisions, those people want security and these software vendors promise to make the process as easy as possible. No need to change the way a company operates, just buy our stuff and you're good. That's the scam.
    • imiric 2y ago
      Exactly, well said. Truthfully, it must be practically infeasible to transform security practices of a large company overnight. Most of the time they buy into these products because they're chasing a security certification (ISO 27001, SOC2, etc.), and by just deploying this to their entire fleet they get to sidestep the actually difficult part. The irony is that at the end of this they're not anymore "secure" than they were before, but since they have the certification, their customers trust that they are. It's security theater 101.
  • InsideOutSanta 2y ago
    "And aren’t they kinda right to not trust their employees if they employ 50,000 people with different skills and intentions?" Yes, in a 50k employee company, the CEO won't know every single employee and be able to vouch for their skills and intentions. But in a non-dysfunctional company, you have a hierarchy of trust, where each management level knows and trusts the people above and below them. You also have siloed data, where people have access to the specific things they need to do their jobs. And you have disaster mitigation mechanisms for when things go wrong. Having worked in companies of different sizes and with different trust cultures, I do think that problems start to arise when you add things like individual monitoring and control. You're basically telling people that you don't trust them, which makes them see their employer in an adversarial role, which actually makes them start to behave less trustworthy, which further diminishes trust across the company, harms collaboration, and eventually harms productivity and security.
• echoangle 2y ago
  If your company is large enough, you can’t really trust your employees. Do you really think google can trust their employees that not a single user does something stupid or even is actively malicious?
  • iforgotpassword 2y ago
    Limit their abilities using OS features? Have the vendor fix security issues rather than a third party incompetently slapping on band-aid? It's like you let one company build your office building and then bring in another contractor to randomly add walls and have others removed while having never looked at the blueprints and then one day "whoopsie, that was a supporting wall I guess". Why is it not just completely normal but even expected that an OS vendor can't build an OS properly, or that the admins can't properly configure it, but instead you need to install a bunch of crap that fucks around with OS internals in batshit crazy ways? I guess because it has a nice dashboard somewhere that says "you're protected". Checkbox software.
    • lyu07282 2y ago
      The sensor basically monitors everything that's happening on the system and then uses heuristics and known attack vectors and behavior to for example then lock compromised systems down. For example a fileless malware that connects to a c&c and then begins to upload all local documents and stored passwords, then slowly enumerates every service the employee has access to for vulnerabilities. If you manage a fleet of tens of thousands of systems and you need to protect against well funded organized crime? Employees running malicious code under their user is a given and can't be prevented. Buying crowdstrike sensor doesn't seem like such a bad idea to me. What would you do instead?
      • iforgotpassword 2y ago
        > What would you do instead? As said, limit the user's abilities as much as possible with features of the OS and software in use. Maybe if you want those other metrics, use a firewall, but not a Tls-breaking virus scanning abomination that has all the same problems, but a simple one that can warn you on unusual traffic patterns. If soneone from accounting starts uploading a lot of data, connects to Google cloud when you don't use any of their products, that should be odd. If we're talking about organized crime, I'm not convinced crowdstrike in particular doesn't actually enlarge the attack surface. So we had what now as the cause, a malformed binary ruleset that the parser, running with kernel privileges, choked on and crashed the system. Because of course the parsing needs to happen in kernel space and not a sandboxed process. That's enough for me to make assumptions about the quality of the rest of the software, and answer the question regarding attack surface. Before this incident nobody ever really looked at this product at all from a security standpoint, maybe because it is (supposed to be) a security product and thus cannot have any flaws. But it seems now security researchers all over the planet start looking at this thing and are having a field day. Bill gates sent that infamous email in the early 2000s, I think after sasser hit the world, that security should be made the no1 priority for Windows. As much as I dislike windows for various reasons, I think overall Microsoft does a rather good job about this. Maybe it's time those companies behind these security products start taking security serious too?
• ironbound 2y ago
  Next you'll be saying "I dont need an immune system..." Fun fact an attacker only needs to steal credentials from the home directory to jump into a companies AWS account where all the juicy customer data lives, so there are reasons we want this control. Frankly I'd like to see the smart people complaining help write better solutions rather than hinder.
  • pavel_pt 2y ago
    If that’s all it takes an attacker, you’re doing AWS wrong.
    • snotrockets 2y ago
      Problem is that many do. Doing it right requires very capable individuals and a significant effort. Less than it used to take, more than most companies are ready to invest.
    • ironbound 2y ago
      people get lazy
    • hello_moto 2y ago
      This is the real world, everyone is doing something wrong. The alternative is to replace you with AI yes?