8 ms·
"Any sufficiently bad software update is indistinguishable from a cyberattack"
- deleted 2y ago[deleted]
- Proven 2y ago[dead]
- deleted 2y ago[deleted]
- mjw_byrne 2y agoThese statements always feel a bit circular to me. Sufficiently bad for what? Sufficiently bad to be indistinguishable from a cyberattack. So, "a software update bad enough to look like a cyberattack looks like a cyberattack". Well, yes.
- pdpi 2y agoSoftware updates and cyberattacks are, at first glance, categorically different things. The idea that a sufficiently bad update is indistinguishable from a cyber attack is a statement that they're not, in fact, categorically different. E.g. supply chain attacks have become a hot topic in the last few years. This event suggests that your threat model for supply chain attacks should include catastrophic vendor cockups.
- AmericanChopper 2y agoFrom a risk management perspective they’re different things, and are managed differently. This tweet is just a dumb rehash of an old platitude that’s trying to bandwagon some social media engagement. Nothing interesting to see here, unless you’re itching to dump on CS some more.
- nhinck3 2y agoIt's just a play on any sufficiently advanced technology is indistinguishable from magic. I don't think you need to think about it too much.
- anon-3988 2y agoWell, we live in a world where we allow this kind of things to happen. Imagine if we live in a world where you still have to manually push and pop the stack (because functions are deemed too academic and not optimized exactly the way I want it). That is what I feels like watching critical infrastructures written in C or these older languages. Having to manually push and pop stack is not something to proud of, only do that out of necessity. There's a very reasonable option between C or C++ and Python (or whatever is deemed slow). Using C doesn't prevent you from designing a shitty application that uses shitty algorithms. "Ooohhhh I get it, this pointer is no longer valid because the array have been reallocated because that function have this side effect after that commit", he said as he gave out a small smirk at the hilarity of this bug. I wonder if he would find it as amusing if his coworker regularly rolls his sleeves and randomly regularly writes assemblies directly in the source code because compilers aren't smart enough to perform a particular parameter passing optimization that he really loves to do.
- MaxBarraclough 2y agoThe US government agrees with you than unnecessary use of very unsafe languages is a serious cybersecurity problem. [0][1] A slight aside: Rust is typically held up as the obvious safer alternative to C/C++, as if Ada never existed. [0] https://stackoverflow.blog/2024/03/04/in-rust-we-trust-white-house-office-urges-memory-safety/ https://stackoverflow.blog/2024/03/04/in-rust-we-trust-white... [1] https://news.ycombinator.com/item?id=33560227 https://news.ycombinator.com/item?id=33560227
- teeheelol 2y agoI Would also like to add: “Any security product which has a rootkit, remote command and control and egresses data is indistinguishable from malware”.
- chrisjj 2y ago... unless it is approved by MS. :)
- tomohawk 2y agoThe US government has given it's stamp of approval, and a big push to install such solutions. FedRAMP-authorized: CrowdStrike's cloud-delivered solution meets the strictest federal standards. DoD IL5-authorized: CrowdStrike's solution is approved for use on the Department of Defense’s (DoD) Impact Level 5 (IL5) systems. JAB High-ready: CrowdStrike's solution is validated, tested, and certified for use in hybrid, multi-cloud environments, meeting the Joint Authorization Board (JAB) High requirements. OMB Memo M-22-09: The Office of Management and Budget (OMB) mandates a Zero Trust security approach for Federal Civilian Executive Branch (FCEB) and DoD systems. OMB Memo M-21-31: The OMB directs investigative and remediation capability improvements.
- teeheelol 2y agoWell now we know those agencies are either morons or in on something we don’t know about.
- hhh 2y agoWhat are they in on? The fact that bad actors are constantly targeting government infrastructure and that this kind of antimalware is a key part of the tools for defending against it?
- zozbot234 2y agoIf you run a properly designed operating system your anti-malware will not need ring-0 access. See mac OS which has now deprecated kexts altogether and will only load them if you explicitly turn off system integrity settings.
- bobnamob 2y agoIsn't that just a reformulation of Hanlon's Razor [1] [1] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- ClearAndPresent 2y agoMore a reformulation of Clark's third law: https://en.wikipedia.org/wiki/Clarke%27s_three_laws https://en.wikipedia.org/wiki/Clarke%27s_three_laws
- surfingdino 2y agoAny anti-malware software will become malware itself. You become the enemy you fight.
- fuzzfactor 2y ago"Any sufficiently bad software update is indistinguishable from a cyberattack" Who says that? Probably a wise lawmaker. Who's law is this? Leigh's Law? Sounds right to me :)
- trte9343r4 2y agoYou will not notice good cyber-attack, it is completely stealth. Control over machine has a value, so attacker may even patch security holes (to prevent other attacks), and remove other malware! There is a story from early 2000s, when some guy from East Europe did network administration, in exchange for fast connectivity and warez hosting. "Customers" had no idea, and he kept their servers running for a few years longer.
- Share6323 2y agoDo you have more Infos on the story?
- nonrandomstring 2y agoIntent matters, but that's only one half of a problem. Improperly implied permission is an equal issue. There are bad software updates that are not malicious, just inept, or an unfortunate accident that cause havoc. I think the Crowdstrike event was such a mishap. And there are plenty of software updates that are plain malicious but hiding behind the "legitimacy" of an update. I'm thinking here about Amazon deleting the 1984 book, or printer 'updates' that lock-out third-party ink etc. These are really violations of computer misuse acts and ought to be prosecuted - because they are indeed vandalism indistinguishable from a attack. Maybe they're worse than a cyberattack, because they are harms that abuse a privilege. Because companies have not been prosecuted but allowed to get away with this sort of crap for decades were in a sticky situation now. There's a whole spectrum of intent between sincere security updates that go wrong and spiteful for-profit sabotage. People need educating that if you allow anyone remote access to your computing property, no matter what their credentials and bona-fides, they are in a position to massively abuse that trust. Just because someone sold you some hardware or software doesn't mean they continue to have your best interests at heart or any rights to interfere with your property. All software and hardware should by law come with the ability to lock out the original vendor, supplier and to reliably stop egress and your device from "phoning home with telemetry". The customer is buying a product not a relationship.
- aaron695 2y ago[dead]
- chad1n 2y agoThe real thing I've learned from this is that most malware doesn't get ring 0 access, but these "antiviruses" solutions can shutdown the whole critical infrastructure everywhere. I've never seen malware that infected millions of devices in seconds and made them unusable for days and maybe weeks to come.
- chgs 2y agoI saw it a couple of days ago…
- Aeolun 2y agoMost people do not (deliberately) give malware root access to their PC
- karlgkk 2y ago> I've never seen malware that infected millions of devices in seconds and made them unusable for days and maybe weeks to come. Yes, well, that's because we have built much more resilient systems, of which anti-virus is a substantial part of. You could start with the Morris worm, but a more recent example would be the Stuxnet cleanup efforts (largely done with AV). AV is (thankfully) becoming less and less relevant, but it's still a valid layer of defense for many platforms.
- cqqxo4zV46cp 2y agoYeah, this logic is absolutely deranged and 100% stems from a hate of forced AV on work machines or something. Pretty much every common modern-day security defensive is reactive, in that you can point to a point in time where we didn’t have it, and can pretty easily see the consequences of that.
- constantcrying 2y agoClearly the problem is that software with the system access, many security packages need, makes it nearly indistinguishable from malware and is an obvious risk factor in the supply chain. Of course having the cause and supposed solution for the safety and operational capabilities be the same piece of software leaves open quite a few questions.
- a-dub 2y agono, it is not. beyond overall poor software choices, there is no notion of persistence in a bad software update.
- mry2048 2y agoEveryone knows the only thing that can stop a bad guy with a rootkit is a good guy with a rootkit.
- irusensei 2y agoNow that this is being discussed and nvidia is finally phasing to an open source kernel implementation can we get MS and mainstream Linux distributions to shun away kernel extensions like Apple did? Software like crowdstrike, anti cheat and all operate like rootkits and basically own your machine. Go user space or go home. Allow it but make it hard. Put lots of warnings. Require enrolling custom keys.
- cqqxo4zV46cp 2y agoThat doesn’t fix the issue being discussed at all though. All you’re doing is making it harder for the corporate IT departments that are going to install this anyway.
- irusensei 2y agoI don’t think so because doing so will mean those IT departments will lose OS support which is more critical. This will force those “benign rootkit” companies to implement their software properly to remain on the market. For reference crowdstrike on current MacOS is a network extension.
- zozbot234 2y agoYes, please shun away kernel extensions for all real-world production settings. You'll probably always need to run kernel-level anti-cheat malware on your gaming rig, but a production machine is not a toy and should not be subject to the same standards.
- danielPort9 2y agoIt’s easier than that: do not trust non open source software no matter how many “seals of approval” it has. Now let’s spread the voice so that in 10 years companies start to think the same way.
- cqqxo4zV46cp 2y agoYep, because open-source code never has issues. So many idealists looking to make this a “closed-source bad!!!” thing and in the process muddying the waters enough to take attention away from remedies that might actually work. All while they sit there getting paid $500k/yr to write closed-source software at FAANG or a startup, which to them is Technically Okay because they work on some sort of SaaS product, thereby alleviating them of the economic realities of Everything Being Open-Source.
- danielPort9 2y agoWho said anything about open source not having issues? I talked about trust. Open source can be trusted simply because the code is scrutinised by many if the software is that important. CS cannot be trusted by anyone, because you simply don’t know how they develop their software. Yes, I do work for a private company because otherwise I cannot pay the bills. Companies on the other hand do have the privilege to choose what kind of software they can use (unless the regulation says otherwise, which is in itself something to fix too, but I do lack knowledge in that field to suggest anything)
- AlienRobot 2y agoYou have a weird definition of "trust." I keep asking this, but how would open sourcing the software prevent the global rollout? "Open source" doesn't mean "no auto-updates." Strictly, it doesn't even mean that you are legally allowed to modify the source code to make it not update automatically.
- ivanbakel 2y ago>Strictly, it doesn't even mean that you are legally allowed to modify the source code to make it not update automatically. Most definitions of open-source (e.g. OSI) include rights to modification. Without modification and distribution rights, programs are normally referred to as source-available instead. This is a common complaint on this very forum when companies misleadingly market their SA code as OS.
- bitwize 2y agoIt took corporate America this long to realize this. I once worked at a facility that handled classified information, and the shit they addled my PC with... it was clear that the idea was not security, i.e., preventing attacks. It was having an audit trail so they knew whom to call on the carpet/arrest if/when attacks eventually occurred. It relied heavily on backdoors into the system so that the CPU state, RAM, network, disk, etc. could be snapshotted and analyzed at any time -- and of course, once you have a backdoor, so does an attacker. Granted, my computer was not cleared to handle actual classified info, but what was on it was still sensitive from a national-security standpoint. When the Clownstrike incident occurred, the phrase "fucking for virginity" popped into my head to describe what software like that does in the name of "security".
- Szpadel 2y agoI simply don't understand one thing: why such company didn't have/used staged rollout? it's normal that from time to time someone will fuck up, but if they would rollout this update to only 1% and see that nothing that updated is coming back and bailed out this would be literally 100x less disruptive that what happened
- dataflow 2y agoI've been wondering the same, then wondering: is it possible that they did do a staged rollout, but the cadence was insufficient? The only way for them to receive feedback would be out of band, so they might not have budgeted for the reaction time they should expect.
- another-dave 2y agoThey'd also have feedback in the sense of "an update was pushed out and none of the updated machines have given us an ACK of 'health: OK' after rebooting".
- noduerme 2y agoGiven the fact that the software itself allows basically unfettered remote access to the "endpoint" machines it's installed on, one would think they'd get more than just an ACK when one boots up. But yeah, that would be a reasonably low bar to check on a few dozen devices before bricking everything in the world.
- notepad0x90 2y agoit was a data/content update, not code, so more than likely it may not crash immediately. how long would the test vm/container wait before it gives the green light on uptime? The buggy code would have to process it after some time/trigger and other factors for the bsod to show. They may have not done any testing at all because they were adding a named pipe to be monitored, kind of like adding a domain or ip to be monitored.
- dannyw 2y ago
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- Puts 2y agoSometimes we forget that cybersecurity is not just about protecting against hackers. There is a bunch of threats from the inside – and they don't have to be malicious. Failing hardware, bad software updates, human errors are also threats that needs to be considered.
- undebuggable 2y agoOne of my favorites personal anti-virus anecdotes in enterprise environment is when its file watcher looped with development environment and IDE file watchers and the machine was consuming maybe 60-70% of RAM and CPU in idle state.
- throwaway48476 2y agoAny sufficiently bad data leak is indistinguishable from a cyber attack.
- bithead 2y agoYeah they are, as in this case.