3 ms·

What really blew my mind about this story is learning that a single company (CrowdStrike) has the power to push random kernel code to a large part of the world'

What really blew my mind about this story is learning that a single company (CrowdStrike) has the power to push random kernel code to a large part of the world's IT infrastructure, at any time, at their will. Correct me if I'm wrong but isn't kernel-level access essentially God Mode on every computer their software is installed on? Including spying on the entire memory, running any code, deleting data, installing ransomware? This feels like an insane amount of power concentrated into the hands of a single entity, on the level of a nuclear submarine. Wouldn't that make them a prime target for all sorts of nation-state actors? This time the damage was (likely) unintentional and no data was lost (save for lost BitLocker keys), but were we really all this time one compromised employee away from the largest-ever ransomware attack, or even worse?

andix 2y ago
It's not perfectly clear yet if CrowdStrike is able to push executable code via those updates. It looks like they updated some definition files and not the kernel driver itself. But the kernel driver obviously contains some bugs, so it's possible that those definition updates can inject code. There might be a bug inside the driver that allows code execution (it happens all the time that some file parsing code can be tricked into executing parts of the data). I'm not sure, but I guess a lot of kernel memory is not fully protected by NX bits. I still have the gut feeling, that this incident was connected to some kind of attack. Maybe a distraction from another attack while everyone is busy about fixing all the clients. During this incident security measures were for sure lowered, lists with BitLocker keys printed out for service technicians to fix the systems. Even the fix itself was to remove some parts of the CroudStrike protection. I would really like to know what was inside the C-00000291*.sys file before the update replaced it with all zeros. Maybe it was a cleanup job to remove something concerning that went wrong. But Hanlon's razor tells me not to trust my gut: "Never attribute to malice that which is adequately explained by stupidity."
- neom 2y ago
  For what it's worth, I 10000% agree with your gut feeling, and mine is a gut feeling too so I didn't mention it on HN because we typically don't talk about these types of guts feelings because of the directions they become speculative in (+the razor), but what you wrote is exactly what is in my head, fwiw.
- milkshakes 2y ago
  falcon absolutely has a remote code execution function as a part of Falcon Response
  - andix 2y ago
    So CrowdStrike has direct access to a lot of critical infrastructure? LOL.
neom 2y ago
Well kernel agents and drivers are not uncommon, however anyone doing anything at scale where there is anything touching a kernel is typically well understood in the system you're implementing it on. That aside, I gather from skimming around (so might be wrong here) - seems people were specifically implementing this because of a business case not a technical case, I read it's mostly used to create compliance (I think via shifted liability) - so I think it was probably too easy to happen and so it happened - in that - someone in the bizniz dept said "if we run this software we are compliant with whatever, enabling XYZ multiple of new revenue, clear business case!!!" and the tech people probably went "bizniz people want this, bizniz case is clear, this seems like a relatively advanced business who know what they're doing, it doesn't really do much on my system and I'm mostly deploying it to innocuous edge user systems, so seems fine shrug" - and then a bad push happened and lots and lots of IT departments had had the same convo aforementioned. Could be wrong here so if anyone knows better and can correct me...plz do!
- hello_moto 2y ago
  A lot of people, especially the non cybersecurity ones, are way off the mark so you're not the only one.
- lyu07282 2y ago
  > implementing this because of a business case not a technical case there are some certification requirements to do pentests/red teaming and then those security folk will all tell them to install an EDR so they picked crowdstrike, but the security people have a very valid technical case for that recommendation. it doesn't shift liability to crowdstrike, thats not how this works. In this specific case they are very likely liable due to gross negligence, but that is different
nightowl_games 2y ago
> no data was lost Data was lost in the knock on effects of this, I assure you. > largest-ever ransomware attack A ransomware attack would be a terrible use of this power. A terrorist attack or cover while a country invades another country is a more appropriate scale of potential damage here. Perhaps even worse.
wellknownfakts 2y ago
It is a well known fact that these companies who hold huge sway on the world's IT landscape are commonly infiltrated at the top levels by Intel agents.
deleted 2y ago
[deleted]
ChoGGi 2y ago
"What really blew my mind about this story is learning that a single company (CrowdStrike) has the power to push random kernel code to a large part of the world's IT infrastructure, at any time, at their will." Isn't that every antivirus software and game anticheat?
SoftTalker 2y ago
The OS vendors themselves (Microsoft, Apple, all the linux distros) have this power as well via their automatic update channels. As do many others who have automatically-updating applications. So it's not a single company, it's many companies.
- Gazoche 2y ago
  That's true; I suppose it doesn't feel as bad because they're much larger companies and more in the public's eye. It's still scary to think about the amount of power they yield.
Shorel 2y ago
What blew my mind is that a single company has such a good sales team to sell an unnecessary product to a large part of the world's IT. And if any part of it is necessary, then that's a failure of the operating system. It should be a feature of Active Directory or Windows. So, great job sales team, you earned your commissions, now get ready to jump ship, 'cause this one is sinking.
deleted 2y ago
[deleted]
vimbtw 2y ago
This is the mini existential crisis I have randomly. The attack area for a modern IT computer is mind bogglingly massive. Computers are pulling and executing code from a vast array of “trusted” sources without a sandbox. If any one of those “trusted” sources are compromised (package managers, cdns, OS updates, security software updates, just app updates in general, even specific utilities like xz) then you’re absolutely screwed. It’s hard not to be a little nihilistic about security.

andix 2y ago

It's not perfectly clear yet if CrowdStrike is able to push executable code via those updates. It looks like they updated some definition files and not the kernel driver itself. But the kernel driver obviously contains some bugs, so it's possible that those definition updates can inject code. There might be a bug inside the driver that allows code execution (it happens all the time that some file parsing code can be tricked into executing parts of the data). I'm not sure, but I guess a lot of kernel memory is not fully protected by NX bits. I still have the gut feeling, that this incident was connected to some kind of attack. Maybe a distraction from another attack while everyone is busy about fixing all the clients. During this incident security measures were for sure lowered, lists with BitLocker keys printed out for service technicians to fix the systems. Even the fix itself was to remove some parts of the CroudStrike protection. I would really like to know what was inside the C-00000291*.sys file before the update replaced it with all zeros. Maybe it was a cleanup job to remove something concerning that went wrong. But Hanlon's razor tells me not to trust my gut: "Never attribute to malice that which is adequately explained by stupidity."

neom 2y ago
For what it's worth, I 10000% agree with your gut feeling, and mine is a gut feeling too so I didn't mention it on HN because we typically don't talk about these types of guts feelings because of the directions they become speculative in (+the razor), but what you wrote is exactly what is in my head, fwiw.
milkshakes 2y ago
falcon absolutely has a remote code execution function as a part of Falcon Response
- andix 2y ago
  So CrowdStrike has direct access to a lot of critical infrastructure? LOL.

neom 2y ago

Well kernel agents and drivers are not uncommon, however anyone doing anything at scale where there is anything touching a kernel is typically well understood in the system you're implementing it on. That aside, I gather from skimming around (so might be wrong here) - seems people were specifically implementing this because of a business case not a technical case, I read it's mostly used to create compliance (I think via shifted liability) - so I think it was probably too easy to happen and so it happened - in that - someone in the bizniz dept said "if we run this software we are compliant with whatever, enabling XYZ multiple of new revenue, clear business case!!!" and the tech people probably went "bizniz people want this, bizniz case is clear, this seems like a relatively advanced business who know what they're doing, it doesn't really do much on my system and I'm mostly deploying it to innocuous edge user systems, so seems fine shrug" - and then a bad push happened and lots and lots of IT departments had had the same convo aforementioned. Could be wrong here so if anyone knows better and can correct me...plz do!

hello_moto 2y ago
A lot of people, especially the non cybersecurity ones, are way off the mark so you're not the only one.
lyu07282 2y ago
> implementing this because of a business case not a technical case there are some certification requirements to do pentests/red teaming and then those security folk will all tell them to install an EDR so they picked crowdstrike, but the security people have a very valid technical case for that recommendation. it doesn't shift liability to crowdstrike, thats not how this works. In this specific case they are very likely liable due to gross negligence, but that is different

nightowl_games 2y ago

> no data was lost Data was lost in the knock on effects of this, I assure you. > largest-ever ransomware attack A ransomware attack would be a terrible use of this power. A terrorist attack or cover while a country invades another country is a more appropriate scale of potential damage here. Perhaps even worse.

wellknownfakts 2y ago

It is a well known fact that these companies who hold huge sway on the world's IT landscape are commonly infiltrated at the top levels by Intel agents.

deleted 2y ago

[deleted]

ChoGGi 2y ago

"What really blew my mind about this story is learning that a single company (CrowdStrike) has the power to push random kernel code to a large part of the world's IT infrastructure, at any time, at their will." Isn't that every antivirus software and game anticheat?

SoftTalker 2y ago

The OS vendors themselves (Microsoft, Apple, all the linux distros) have this power as well via their automatic update channels. As do many others who have automatically-updating applications. So it's not a single company, it's many companies.

Gazoche 2y ago
That's true; I suppose it doesn't feel as bad because they're much larger companies and more in the public's eye. It's still scary to think about the amount of power they yield.

Shorel 2y ago

What blew my mind is that a single company has such a good sales team to sell an unnecessary product to a large part of the world's IT. And if any part of it is necessary, then that's a failure of the operating system. It should be a feature of Active Directory or Windows. So, great job sales team, you earned your commissions, now get ready to jump ship, 'cause this one is sinking.

deleted 2y ago

[deleted]

vimbtw 2y ago

This is the mini existential crisis I have randomly. The attack area for a modern IT computer is mind bogglingly massive. Computers are pulling and executing code from a vast array of “trusted” sources without a sandbox. If any one of those “trusted” sources are compromised (package managers, cdns, OS updates, security software updates, just app updates in general, even specific utilities like xz) then you’re absolutely screwed. It’s hard not to be a little nihilistic about security.