4 ms·

I had read reports of this earlier which is what makes me speculate that the Windows Crowdstrike issue is more than "just a update error" i.e. there might be so

I had read reports of this earlier which is what makes me speculate that the Windows Crowdstrike issue is more than "just a update error" i.e. there might be some nefarious hand behind this. Given that they were already aware of the Linux issue it boggles my mind that they did not take extra precautions when it came to Windows updates. We will have to wait and see for further trustworthy info. Btw - The article mentions Dave Plummer's analysis of the issue which might be easier for people to understand and worth a watch. - https://www.youtube.com/watch?v=wAzEJxOo1ts https://www.youtube.com/watch?v=wAzEJxOo1ts

bawolff 2y ago
Some part of a company already aware of an issue but different part still ships is a pretty common tale and seems much more likely than some nefarious conspiracy theory. (And that is even assuming this is the same issue, which seems questionable) After all, who exactly would benefit from such a nefarious scheme to crash windows computers? Certainly not Crowdstrike.
- tgv 2y ago
  Wrt trying to get something out of the crash: https://www.theregister.com/2024/07/19/cyber_criminals_quickly_exploit_crowdstrike/?td=rt-9cp https://www.theregister.com/2024/07/19/cyber_criminals_quick.... The conspiracy-minded could be suspicious of the quick response to this outage. "They must have known in advance!" Or they could suspect an overeager account manager at Crowdstrike, who wanted to show how important the product is. But indeed, this really sounds like it was an internal error.
- logicchains 2y ago
  >After all, who exactly would benefit from such a nefarious scheme to crash windows computers? Russia or China would certainly benefit from the ability to do this at a time of their choosing, and it's possible they could have an agent inside Crowdstrike, especially given China's history of industrial espionage.
  - bawolff 2y ago
    You think russia or china would benefit more from this then having a stealthy rootkit on basically every important computer in the world? I think russia or china are probably the least likely purpotrators possible. Their incentives strongly disalign with this.
- rramadass 2y ago
  > who exactly would benefit from such a nefarious scheme State Actors, given the current Geo-Political tensions. You have to take a all-in-all broader view. I remember a while ago Kaspersky was accused of data-siphoning/spying from computers it was installed on and other nefarious activities. See New Government Ban on Kaspersky Would Prevent Company from Updating Malware Signatures in U.S. - https://www.zetter-zeroday.com/new-government-ban-on-kaspersky-would-prevent-malware-signature-updates/ https://www.zetter-zeroday.com/new-government-ban-on-kaspers... As for your opening statement "Some part of a company already aware of an issue but different part still ships is a pretty common tale" is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app. As Dave Plummer points out in his analysis Microsoft Kernel Drivers are signed and certified after an exhaustive testing process. Even if Crowdstrike wrote their drivers as an interpreter and the data update files were actually programs in some p-code, Microsoft would have definitely known of it and its inherent vulnerabilities. I would bet money that Microsoft knows all about preventing threats/vulnerabilities than any other company simply because of their long experience and large userbase and thus would not have allowed Crowdstrike such a free hand.
  - bawolff 2y ago
    > State Actors, given the current Geo-Political tensions. I disagree. If state actors had this type of capability they would use it to spy on big companies. The espionage potential is huge. They wouldn't waste it on causing a minor inconvinence. > is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app Lol. What next? Politicians always tell the truth? Everyone gets a free unicorn? This is just obviously not how the world works. There is a long history of anti-virus software being kind of crap.
    - rramadass 2y ago
      > If state actors had this type of capability they would use it to spy on big companies. Who says that is not ongoing? You just don't hear about it that much because the companies downplay/hide it for obvious reasons. > They wouldn't waste it on causing a minor inconvinence. This is not a "minor" inconvenience. The losses to the Economy are already running into billions and counting. See for example https://www.youtube.com/watch?v=YedowOtznNo https://www.youtube.com/watch?v=YedowOtznNo > Lol. What next? Politicians always tell the truth? Everyone gets a free unicorn? This is just obviously not how the world works. There is a long history of anti-virus software being kind of crap. Snark/Glibness is not an argument. I have worked in Network Security and know for a fact that Kernel mode code is treated differently than User mode code in terms of scrutiny/testing/staging/release. Second, Crowdstrike is not just another anti-virus software; they are far more broader in scope/complex and hence their wide user base. Microsoft with their wide experience would have definitely processes in place to validate them comprehensively. Hence one should be cautious in taking this incident at face value and investigate everything thoroughly. I am almost sure multiple lawsuits are in the offing but am not so sure whether the full story will come out.
rsynnott 2y ago
I mean, what’s more likely, realistically? Shadowy saboteurs, or a cybersecurity company being poorly run, like, well, all other cybersecurity companies ever? Like, this is not new. They, as an industry, have been a byword for shoddy nonsense for literally decades.
- michaelt 2y ago
  I mean, hypothetically you might think computer security companies would be full of passionate computer security enthusiasts. And as security tools break a lot of security norms - like sandboxing, least privilege, and running in userspace - you might think such enthusiasts would make sure they were coded with the utmost care. That this team of secure coding all-stars would be code reviewing, managing scope, fuzz testing, static analysing, formally validating and suchlike, as befits code running with the highest privilege levels. Surely huge multinational corporations wouldn't grant unlimited privileges to kernel modules written by clowns.... would they? If you believe the crowdstrike marketing, I can see how you might think shadowy saboteurs are the only plausible explanation.
  - rsynnott 2y ago
    > I mean, hypothetically you might think computer security companies would be full of passionate computer security enthusiasts. Eh, I mean, you might think that, absent any other information about the industry, but they're largely not.
Muromec 2y ago
Indeed, the issue could have been planted there by some nefarious occult hand

bawolff 2y ago

Some part of a company already aware of an issue but different part still ships is a pretty common tale and seems much more likely than some nefarious conspiracy theory. (And that is even assuming this is the same issue, which seems questionable) After all, who exactly would benefit from such a nefarious scheme to crash windows computers? Certainly not Crowdstrike.

tgv 2y ago
Wrt trying to get something out of the crash: https://www.theregister.com/2024/07/19/cyber_criminals_quickly_exploit_crowdstrike/?td=rt-9cp https://www.theregister.com/2024/07/19/cyber_criminals_quick.... The conspiracy-minded could be suspicious of the quick response to this outage. "They must have known in advance!" Or they could suspect an overeager account manager at Crowdstrike, who wanted to show how important the product is. But indeed, this really sounds like it was an internal error.
logicchains 2y ago
>After all, who exactly would benefit from such a nefarious scheme to crash windows computers? Russia or China would certainly benefit from the ability to do this at a time of their choosing, and it's possible they could have an agent inside Crowdstrike, especially given China's history of industrial espionage.
- bawolff 2y ago
  You think russia or china would benefit more from this then having a stealthy rootkit on basically every important computer in the world? I think russia or china are probably the least likely purpotrators possible. Their incentives strongly disalign with this.
rramadass 2y ago
> who exactly would benefit from such a nefarious scheme State Actors, given the current Geo-Political tensions. You have to take a all-in-all broader view. I remember a while ago Kaspersky was accused of data-siphoning/spying from computers it was installed on and other nefarious activities. See New Government Ban on Kaspersky Would Prevent Company from Updating Malware Signatures in U.S. - https://www.zetter-zeroday.com/new-government-ban-on-kaspersky-would-prevent-malware-signature-updates/ https://www.zetter-zeroday.com/new-government-ban-on-kaspers... As for your opening statement "Some part of a company already aware of an issue but different part still ships is a pretty common tale" is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app. As Dave Plummer points out in his analysis Microsoft Kernel Drivers are signed and certified after an exhaustive testing process. Even if Crowdstrike wrote their drivers as an interpreter and the data update files were actually programs in some p-code, Microsoft would have definitely known of it and its inherent vulnerabilities. I would bet money that Microsoft knows all about preventing threats/vulnerabilities than any other company simply because of their long experience and large userbase and thus would not have allowed Crowdstrike such a free hand.
- bawolff 2y ago
  > State Actors, given the current Geo-Political tensions. I disagree. If state actors had this type of capability they would use it to spy on big companies. The espionage potential is huge. They wouldn't waste it on causing a minor inconvinence. > is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app Lol. What next? Politicians always tell the truth? Everyone gets a free unicorn? This is just obviously not how the world works. There is a long history of anti-virus software being kind of crap.
  - rramadass 2y ago
    > If state actors had this type of capability they would use it to spy on big companies. Who says that is not ongoing? You just don't hear about it that much because the companies downplay/hide it for obvious reasons. > They wouldn't waste it on causing a minor inconvinence. This is not a "minor" inconvenience. The losses to the Economy are already running into billions and counting. See for example https://www.youtube.com/watch?v=YedowOtznNo https://www.youtube.com/watch?v=YedowOtznNo > Lol. What next? Politicians always tell the truth? Everyone gets a free unicorn? This is just obviously not how the world works. There is a long history of anti-virus software being kind of crap. Snark/Glibness is not an argument. I have worked in Network Security and know for a fact that Kernel mode code is treated differently than User mode code in terms of scrutiny/testing/staging/release. Second, Crowdstrike is not just another anti-virus software; they are far more broader in scope/complex and hence their wide user base. Microsoft with their wide experience would have definitely processes in place to validate them comprehensively. Hence one should be cautious in taking this incident at face value and investigate everything thoroughly. I am almost sure multiple lawsuits are in the offing but am not so sure whether the full story will come out.

rsynnott 2y ago

I mean, what’s more likely, realistically? Shadowy saboteurs, or a cybersecurity company being poorly run, like, well, all other cybersecurity companies ever? Like, this is not new. They, as an industry, have been a byword for shoddy nonsense for literally decades.

michaelt 2y ago
I mean, hypothetically you might think computer security companies would be full of passionate computer security enthusiasts. And as security tools break a lot of security norms - like sandboxing, least privilege, and running in userspace - you might think such enthusiasts would make sure they were coded with the utmost care. That this team of secure coding all-stars would be code reviewing, managing scope, fuzz testing, static analysing, formally validating and suchlike, as befits code running with the highest privilege levels. Surely huge multinational corporations wouldn't grant unlimited privileges to kernel modules written by clowns.... would they? If you believe the crowdstrike marketing, I can see how you might think shadowy saboteurs are the only plausible explanation.
- rsynnott 2y ago
  > I mean, hypothetically you might think computer security companies would be full of passionate computer security enthusiasts. Eh, I mean, you might think that, absent any other information about the industry, but they're largely not.

Muromec 2y ago

Indeed, the issue could have been planted there by some nefarious occult hand