3 ms·

Some part of a company already aware of an issue but different part still ships is a pretty common tale and seems much more likely than some nefarious conspirac

Some part of a company already aware of an issue but different part still ships is a pretty common tale and seems much more likely than some nefarious conspiracy theory. (And that is even assuming this is the same issue, which seems questionable) After all, who exactly would benefit from such a nefarious scheme to crash windows computers? Certainly not Crowdstrike.

tgv 2y ago
Wrt trying to get something out of the crash: https://www.theregister.com/2024/07/19/cyber_criminals_quickly_exploit_crowdstrike/?td=rt-9cp https://www.theregister.com/2024/07/19/cyber_criminals_quick.... The conspiracy-minded could be suspicious of the quick response to this outage. "They must have known in advance!" Or they could suspect an overeager account manager at Crowdstrike, who wanted to show how important the product is. But indeed, this really sounds like it was an internal error.
logicchains 2y ago
>After all, who exactly would benefit from such a nefarious scheme to crash windows computers? Russia or China would certainly benefit from the ability to do this at a time of their choosing, and it's possible they could have an agent inside Crowdstrike, especially given China's history of industrial espionage.
- bawolff 2y ago
  You think russia or china would benefit more from this then having a stealthy rootkit on basically every important computer in the world? I think russia or china are probably the least likely purpotrators possible. Their incentives strongly disalign with this.
rramadass 2y ago
> who exactly would benefit from such a nefarious scheme State Actors, given the current Geo-Political tensions. You have to take a all-in-all broader view. I remember a while ago Kaspersky was accused of data-siphoning/spying from computers it was installed on and other nefarious activities. See New Government Ban on Kaspersky Would Prevent Company from Updating Malware Signatures in U.S. - https://www.zetter-zeroday.com/new-government-ban-on-kaspersky-would-prevent-malware-signature-updates/ https://www.zetter-zeroday.com/new-government-ban-on-kaspers... As for your opening statement "Some part of a company already aware of an issue but different part still ships is a pretty common tale" is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app. As Dave Plummer points out in his analysis Microsoft Kernel Drivers are signed and certified after an exhaustive testing process. Even if Crowdstrike wrote their drivers as an interpreter and the data update files were actually programs in some p-code, Microsoft would have definitely known of it and its inherent vulnerabilities. I would bet money that Microsoft knows all about preventing threats/vulnerabilities than any other company simply because of their long experience and large userbase and thus would not have allowed Crowdstrike such a free hand.
- bawolff 2y ago
  > State Actors, given the current Geo-Political tensions. I disagree. If state actors had this type of capability they would use it to spy on big companies. The espionage potential is huge. They wouldn't waste it on causing a minor inconvinence. > is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app Lol. What next? Politicians always tell the truth? Everyone gets a free unicorn? This is just obviously not how the world works. There is a long history of anti-virus software being kind of crap.
  - rramadass 2y ago
    > If state actors had this type of capability they would use it to spy on big companies. Who says that is not ongoing? You just don't hear about it that much because the companies downplay/hide it for obvious reasons. > They wouldn't waste it on causing a minor inconvinence. This is not a "minor" inconvenience. The losses to the Economy are already running into billions and counting. See for example https://www.youtube.com/watch?v=YedowOtznNo https://www.youtube.com/watch?v=YedowOtznNo > Lol. What next? Politicians always tell the truth? Everyone gets a free unicorn? This is just obviously not how the world works. There is a long history of anti-virus software being kind of crap. Snark/Glibness is not an argument. I have worked in Network Security and know for a fact that Kernel mode code is treated differently than User mode code in terms of scrutiny/testing/staging/release. Second, Crowdstrike is not just another anti-virus software; they are far more broader in scope/complex and hence their wide user base. Microsoft with their wide experience would have definitely processes in place to validate them comprehensively. Hence one should be cautious in taking this incident at face value and investigate everything thoroughly. I am almost sure multiple lawsuits are in the offing but am not so sure whether the full story will come out.
- krisoft 2y ago
  > State Actors, given the current Geo-Political tensions. I love a good conspiracy just like anyone. And i certainly hope the relevant authorities will take a good, deep look at what knocked over the dominoes CrowdStrike set up in a line. But i just don’t see how those state actors would benefit from this. There is damage, both financial and humans harmed, but is that the best a state actor could do? I would have thought they would sync such an action with other measures for maximum impact. > You have to take a all-in-all broader view. That is always wise. Can you tell us more? In particular could you spell out how the Kaspersky ban factors in here in your opinion? > As for your opening statement "Some part of a company already aware of an issue but different part still ships is a pretty common tale" is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app. Are you saying that this scrutiny is somehow enough to overcome companies natural tendency to be disparate and unorganised?

tgv 2y ago

Wrt trying to get something out of the crash: https://www.theregister.com/2024/07/19/cyber_criminals_quickly_exploit_crowdstrike/?td=rt-9cp https://www.theregister.com/2024/07/19/cyber_criminals_quick.... The conspiracy-minded could be suspicious of the quick response to this outage. "They must have known in advance!" Or they could suspect an overeager account manager at Crowdstrike, who wanted to show how important the product is. But indeed, this really sounds like it was an internal error.

logicchains 2y ago

>After all, who exactly would benefit from such a nefarious scheme to crash windows computers? Russia or China would certainly benefit from the ability to do this at a time of their choosing, and it's possible they could have an agent inside Crowdstrike, especially given China's history of industrial espionage.

bawolff 2y ago
You think russia or china would benefit more from this then having a stealthy rootkit on basically every important computer in the world? I think russia or china are probably the least likely purpotrators possible. Their incentives strongly disalign with this.

rramadass 2y ago

> who exactly would benefit from such a nefarious scheme State Actors, given the current Geo-Political tensions. You have to take a all-in-all broader view. I remember a while ago Kaspersky was accused of data-siphoning/spying from computers it was installed on and other nefarious activities. See New Government Ban on Kaspersky Would Prevent Company from Updating Malware Signatures in U.S. - https://www.zetter-zeroday.com/new-government-ban-on-kaspersky-would-prevent-malware-signature-updates/ https://www.zetter-zeroday.com/new-government-ban-on-kaspers... As for your opening statement "Some part of a company already aware of an issue but different part still ships is a pretty common tale" is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app. As Dave Plummer points out in his analysis Microsoft Kernel Drivers are signed and certified after an exhaustive testing process. Even if Crowdstrike wrote their drivers as an interpreter and the data update files were actually programs in some p-code, Microsoft would have definitely known of it and its inherent vulnerabilities. I would bet money that Microsoft knows all about preventing threats/vulnerabilities than any other company simply because of their long experience and large userbase and thus would not have allowed Crowdstrike such a free hand.

bawolff 2y ago
> State Actors, given the current Geo-Political tensions. I disagree. If state actors had this type of capability they would use it to spy on big companies. The espionage potential is huge. They wouldn't waste it on causing a minor inconvinence. > is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app Lol. What next? Politicians always tell the truth? Everyone gets a free unicorn? This is just obviously not how the world works. There is a long history of anti-virus software being kind of crap.
- rramadass 2y ago
  > If state actors had this type of capability they would use it to spy on big companies. Who says that is not ongoing? You just don't hear about it that much because the companies downplay/hide it for obvious reasons. > They wouldn't waste it on causing a minor inconvinence. This is not a "minor" inconvenience. The losses to the Economy are already running into billions and counting. See for example https://www.youtube.com/watch?v=YedowOtznNo https://www.youtube.com/watch?v=YedowOtznNo > Lol. What next? Politicians always tell the truth? Everyone gets a free unicorn? This is just obviously not how the world works. There is a long history of anti-virus software being kind of crap. Snark/Glibness is not an argument. I have worked in Network Security and know for a fact that Kernel mode code is treated differently than User mode code in terms of scrutiny/testing/staging/release. Second, Crowdstrike is not just another anti-virus software; they are far more broader in scope/complex and hence their wide user base. Microsoft with their wide experience would have definitely processes in place to validate them comprehensively. Hence one should be cautious in taking this incident at face value and investigate everything thoroughly. I am almost sure multiple lawsuits are in the offing but am not so sure whether the full story will come out.
krisoft 2y ago
> State Actors, given the current Geo-Political tensions. I love a good conspiracy just like anyone. And i certainly hope the relevant authorities will take a good, deep look at what knocked over the dominoes CrowdStrike set up in a line. But i just don’t see how those state actors would benefit from this. There is damage, both financial and humans harmed, but is that the best a state actor could do? I would have thought they would sync such an action with other measures for maximum impact. > You have to take a all-in-all broader view. That is always wise. Can you tell us more? In particular could you spell out how the Kaspersky ban factors in here in your opinion? > As for your opening statement "Some part of a company already aware of an issue but different part still ships is a pretty common tale" is not applicable here since this code runs in kernel mode (in both OSes) and thus would be subject to far far greater scrutiny and testing than an ordinary app. Are you saying that this scrutiny is somehow enough to overcome companies natural tendency to be disparate and unorganised?