10 ms·

CrowdStrike will be liable for damages in France, based on the OVH precedent

336 points by charlieirish 2y ago

justinclift 2y ago
Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Maybe now ClownStrike will start testing it properly, hopefully thereby fixing the stability and other issues.
- vladvasiliu 2y ago
  Likely not by the people who make the decisions to purchase this. They're usually hearing more from the marketing/sales people than from those actually having to deal with this. Personally, I don't expect this to make much of a difference, if any.
  - justinclift 2y ago
    > Personally, I don't expect this to make much of a difference, if any. While you're probably right, I'm hoping ClownStrike's court results so absolutely dwarf their insurance coverage that it's nearly company ending. ie something to actually get them to improve things, not just generate empty PR platitudes: https://www.youtube.com/watch?v=SiL2AjOtjZI https://www.youtube.com/watch?v=SiL2AjOtjZI
    - vladvasiliu 2y ago
      Meh. We (techies) always knew the risks of running random crap in kernel space, especially when it runs junk it downloads from the internet. So, I expect this to be spun somehow along the lines of "sure all our boxes were down, but look, you've brought them all back up, didn't you? Now think about all the bad guys this protects us against! Of course the risk was worth it!". Also, "everybody does this! we couldn't have known!" "security people" are scared shitless of the whole "the world is ending! there are threats everywhere!" discourse that vendors peddle. The less technical, the more scared they are. Many of these people don't really understand what they're talking about and what compromises their decisions actually imply. Losing a day of work is simply dwarfed by "all your data is gone!".
      - davidmurdoch 2y ago
        I like to poke the security bears at my company by suggesting that the security team is actually a double agent team whose real employer is our competitor. They never find it funny for some reason.
- GoToRO 2y ago
  The problem is that you think that those managers are nice and reasonable people like yourself. They are not. What will happen is that some manager will yell at some other manager that will yell at some other manager that will yell at some tester that works on the cheapest virtual machine possible, on which it takes 5 minutes to log in and it disconnects after 2 minutes of idle. All the while, not changing anything. I'm pretty sure that all their resources are allocated to lawyers right now and their managers try really hard to gaslight their customers by telling them it was not that bad, they came up with the fix really fast (ignoring the fact that the fix was not possible to be applied) and so on.
  - blibble 2y ago
    hopefully the lawyers are demanding payment in advance in many countries there are very strict limits on excluding liability for negligence
- anonzzzies 2y ago
  It's CIO magazine snakeoil. You don't buy it for any other reason than tick off some risk thing without knowing/thinking about it. Everyone does it, so he. Terrible.
- ykonstant 2y ago
  > Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Right, but other commenters call it the best EDR out there; so it is really hard for those of us outside the loop to understand what the hell is going on. Is CS, or any other EDR, actually preventing attacks that would pass through if absent? To what extent? Where are the numbers? Who audits CS code? I have seen no real data, only assertions.
  - justinclift 2y ago
    Yeah, I'm as surprised as you that people have been saying ClownStrike Falcon was good. I guess the people saying that are security folk who look at things from a high level place of some sort (?). Because they don't seem aware of (or don't care about) the many problems it causes on the servers it gets deployed to. As we've now had amply demonstrated. Globally. ;)
siva7 2y ago
It's good to remind people that general liability waivers you often find with license agreements have no meaning outside of US jurisdiction if you're doing business in another jurisdiction.
- GJim 2y ago
  The number of US tech businesses that are surprised they need, or think they can ignore the need, to obey employment and data protection laws when working in other jurisdictions is simply bonkers.
  - xxs 2y ago
    Well, it'd be a lot easier if most US entities understood that M/d/yy(yy) format is rare, or that default to Frankenstein degrees is pretty much the same/awkward (even Microsoft reset their weather widget to F on regular basis). The root of issue, not understanding local laws/culture, is very similar - surrounded by a vast market/culture (US +Canada) dulls your senses for the rest of the globe.
    - ed_elliott_asc 2y ago
      I thought Frankenstein degrees was a clever complaint about us companies wanting degrees for tech jobs
    - cmrdporcupine 2y ago
      > surrounded by a vast market/culture (US +Canada) US companies don't think about Canada as anything but an afterthought, and struggle with the same issues here that you just mentioned. Canada is metric, uses different spellings (closer to UK English.. colour, not color [Chrome just marked my spelling as wrong despite me having Canadian English as my setting]) and is officially bilingual with localization laws requiring companies to provide French versions for certain kinds of services. US companies either don't bother, or usually get this entirely wrong. e.g. It's been how many years? And navigation on Android / Google Maps can't pronounce French names for streets/places while driving around in bilingual places in Canada. Just completely butchers them, their system can't "understand" the concept that you could have your language set to English but still need to hear French place names, or vice versa.
honzaik 2y ago
time to issue 50€ gift cards!
- jeffrallen 2y ago
  ...that "ne fonctionne pas"
- Aachen 2y ago
  Time to settle in a jurisdiction where gift cards are a legal currency and only do business within there
lordnacho 2y ago
Surely, there must be a gigantic number of claimants already taking to their lawyers about how to get compensation? Not just in France but across the planet? I wonder how this kind of thing is organised, since there's all these jurisdictions.
- lukan 2y ago
  "I wonder how this kind of thing is organised, since there's all these jurisdictions." In theory simple. Crowdstrike is doing buisness in state X, so compensation claims will be settled in court in state X. So lots of courts and lawers all around the world, will be quite busy for some time with the case.
  - anonzzzies 2y ago
    I cannot see how they will get over this... It's CIO snakeoil to begin with, but this was not a simple mistake; it shows the entire lack of process and responsibility.
  - b112 2y ago
    And if judgements are found, local to the jurisdiction assets (including and money being forwarded by banks, eg via credit cards, or wire transfers) can be seized. If that doesn't work, judgements can be registered in other courts for collection purposes.
    - WJW 2y ago
      Many countries also have treaties to accommodate this process across borders.
  - sjamaan 2y ago
    It's a B2B tool, which means it's quite likely the contract/license states that all disputes are to be settled in a court appointed by them. This is not valid for consumer disputes, but businesses are free to do what they want. Perhaps this will let them off the hook? OVH is different in that it's actually a French company.
Baguette5242 2y ago
Holy shit (hits the fan). For sure CrowdStrike will be held accountable in several countries, but I believe that some conclusions need to be drawn also from a customer/user perspective. - Is it reasonable to grant such privilege access to a piece of software that ultimately is a black box ? - Is it reasonable to put a Microsoft / Commercial / Closed source OS in critical infrastructure ? If not considered as critical, then “important” infrastructure ? - Is it reasonable to have more than 70% of the computers/servers that run important infrastructure on the same OS / software ? How about the mitigation of the risks etc… I sincerely hope that all of this CrowdStrike mayhem will push stakeholders to draw some conclusions and actions.
- llm_trw 2y ago
  >- Is it reasonable to grant such privilege access to a piece of software that ultimately is a black box ? As I said in the previous thread: explaining to execs that giving root to someone on your machines means they have root is a very difficult concept for them to understand.
  - phito 2y ago
    Then the exec should be held responsible?
    - dotancohen 2y ago
      That responsibility (and associated risk) is often the justification for C compensation. Whether that is a good argument I have no opinion.
    - nichol4s 2y ago
      The exec just follows the instructions provided by their CISO, who adheres to the information security standards used in audits. These standards are influenced not only by actual threats but also by lobbying from Endpoint Detection and Response (EDR) systems like SentinelOne and Crowdstrike. For instance, in 2021, the White House issued Executive Order 14028, which mandates the Federal Government to implement a robust EDR solution. Consequently, standards such as those from NIST and ISO27001 have increasingly emphasized malware detection and response. When onboarding any large enterprise, you will encounter these requirements before the enterprise can proceed with procuring your service. This compels B2B organizations to implement this software to be successful. ^1 https://www.opensecrets.org/federal-lobbying/clients/summary?cycle=2022&id=D000095316 https://www.opensecrets.org/federal-lobbying/clients/summary... ^2 https://www.opensecrets.org/federal-lobbying/clients/summary?cycle=2023&id=D000084079 https://www.opensecrets.org/federal-lobbying/clients/summary...
MaximilianEmel 2y ago
> On 19th July 2019, CrowdStrike pushed an update to their software. I assume the year was meant to be 2024.
bennyelv 2y ago
I was aware of this being the case when dealing with consumers, but had assumed that because B2B contracts are assumed to be between 2 sophisticated parties that there is little legislative protection that could override the terms of the contract. My understanding of law is generally UK based, but I'm not aware of legislation what would supersede a contract term limiting liability when the event that created the liability was one of general diligence/competence in carrying out the contract rather than relating to health and safety or some other area that is heavily legislated. For that reason I'm unconvinced on the article's statement that this isn't just a "French Legal System" thing and that the same kind of judgement might be made in other jurisdictions.
- HeatrayEnjoyer 2y ago
  Well for starters it did impact health and safety domains; hospitals and emergency services were severely degraded. There absolutely will be preventable deaths directly traceable to Crowdstrike.
- consp 2y ago
  As the article already states, in most jurisdictions you cannot void gross negligence liability in contracts. It will probably come down to that in those jurisdictions. If they willfully did not implement staged rollouts that look like negligence to me but ianal. You kill canaries for a reason.
  - smcameron 2y ago
    Kind of looks like they had no canaries. https://securityboulevard.com/2024/07/crowdstrike-pir-canary-bsod-richixbw/ https://securityboulevard.com/2024/07/crowdstrike-pir-canary...
- jltsiren 2y ago
  I think the general idea is that gross negligence is a breach of contract. Every contract implicitly assumes that both parties are making a good faith effort to honor the terms of the contract. If you are not doing that, you may be in breach of contract, and the liability limitations may no longer apply.
udev4096 2y ago
The 10$ gift cards were just hilarious. How could they possibly expect anyone to take them seriously?
- hsbauauvhabzb 2y ago
  Was this possibly some way to influence liability limitation? If you accept a $10 gift card, could that be argued as an acceptance of compensation?
  - switch007 2y ago
    Hopefully judges aren't that stupid / our legal systems so easily gamed
- m2fkxy 2y ago
  wait, that was not a joke?
  - MobileVet 2y ago
    Sure wasn’t. $10 Uber Eats card https://m.slashdot.org/story/431090 https://m.slashdot.org/story/431090
- orlp 2y ago
  Not a lawyer, but the cynic in me assumes that it is legal bait: if someone at the company cashed the $10 gift card one could argue that compensation for damages has been accepted and no further liability applies. At least legally speaking, obviously this is completely morally bankrupt.
  - consp 2y ago
    Any normal legal system should have an option for avoiding this, like "reasonable" compensation (reasonable would then be argued in court but I'm pretty sure you can find a lawyer who can argue a uber gift card is not).
  - 2y ago
dotancohen 2y ago
Can someone explain to me why the protections that Falcon provides, are not provided by the OS itself? I am not completely naive, I've secured quite a few critical Linux servers, but with Windows it seems that there do not exist the same clear roles of security. Contrast with Red Hat or even Canonical, where is feels like I'm (correctly) fighting the security of the systems to get them into a state where my users can use my applications.
- commandersaki 2y ago
  How do you actively detect a malware agent running in user space using stealth or a kernel. Authors of such are fully aware of Linux hardening like SELinux / AppArmor and work around it.
  - amluto 2y ago
    > How do you actively detect a malware agent running in user space using stealth or a kernel. You start with correct design. The system has a root of trust (ideally you skip the insane level of complexity that is Secure Boot + TPM and use something simple, testable, and verifiable — this isn’t actually that hard). Only authorized images will boot, and, more importantly, nothing else on the network trusts the machine until it proves it’s running the right image. Then you make the image immutable. Want to edit a system file? You can’t. Maybe in developer mode you can edit an overlay. All configuration is stored in a designated place, and that configuration is minimized. A stock image from the distro vendor has zero configuration, so there is no incomprehensible soup in /etc to audit. Configuration is also attested. Persistent data is separate from configuration. All persistent data is considered suspect. Any bug that allows malicious persistent data to compromise anything is a blocker, including corrupt filesystem metadata. A root-of-trust attestation has limited lifetime. The system forcibly re-verifies periodically. This either means rebooting or doing a runtime “dynamic root of trust” attenuation. The latter is complex. Complicated messes like kernel “lockdown” and the stock Secure Boot signatures have no place. Usermode root and the kernel are approximately equally trusted. SELinux is barely necessary, if at all, unless the actual user code wants it to control access to persistent data. But there are simpler, better schemes that are easier to reason about. Sadly the industry doesn’t think this way. I’m regularly surprised that Apple hasn’t gone in this direction more aggressively than they are with their MacOS products.
spotirca 2y ago
> "It is not an isolated incident. The same thing happened few weeks earlier with the CrowdStrike agent on Linux, nuking the system and there may be other occurrences before." Is there a link with this incident?
- walterbell 2y ago
  "CrowdStrike broke Debian and Rocky Linux months ago", https://news.ycombinator.com/item?id=41018029 https://news.ycombinator.com/item?id=41018029 "CrowdStrike's Falcon Sensor also linked to Linux kernel panics and crashes", https://news.ycombinator.com/item?id=41030352 https://news.ycombinator.com/item?id=41030352
- mikelovenotwar 2y ago
  https://www.neowin.net/news/crowdstrike-broke-debian-and-rocky-linux-months-ago-but-no-one-noticed/ https://www.neowin.net/news/crowdstrike-broke-debian-and-roc...
praptak 2y ago
I wonder what happens if the damages exceed whatever assets they have in France.
- consp 2y ago
  They have at least a B.V. with assets in the Netherlands and usually that one contains money for "tax reasons" (e.g. avoiding taxes), and they can lay claim on that.
wjnc 2y ago
Sorry, but I feel the author is reaching for a conclusion. From OP, in the OVH-case liability seems to override the contract / waivers when OVH was both the storage And backup provider and did not actively underline that this solution is suboptimal, in a situation where multiple data centers are physically very close. That's a chain of evidence. For CrowdStrike, it is clear that the offering is to more mature counter parties (thus raising the B2B standard of evidence) and that CrowdStrike very essentially did not do / support staging, whatever. This is indeed bad industry practice, but one that can thought to be explicit from the start of the agreement. At least in my locale you either make explicit agreements OR industry standards are leading. We do not do industry standard X is pretty clear. Read the list in OP, replace CrowdStrike with Microsoft and then think of the international liability cases you've heard from where Microsoft was found liable for downtime, hacks and other issues. Look, liabilities will always arise in such situations. But I expect only minor liabilities will arise. Mostly (AFAIK IANAL) the terms & conditions are applied in B2B-cases. This case is pretty obvious: you got what you signed up for. CrowdStrike with full scale access to your machines and no guarantees. On the other hand, Crowdstrike lost 125 billion in market cap. That's an indication of {liabilities + loss of future profits}. Pretty massive event for not being willing to do staging. But I expect it's mostly that CrowdStrike is tainted from now on. A friend of mine had a very bad stint as an employee of CrowdStrike recently and from what I learned from that case, I'm happy that the nature of the firm is somewhat more in the open now.
kierenj 2y ago
> Does CrowdStrike do any testing whatsoever? Obviously they didn’t or the incident wouldn’t have happened. Eh, parts of this article aren't very reasonable. Even if they did a buttload of testing, it only takes one failure in one part of the chain (near the end). They didn't test something they should have, sure, but obviously they didn't do "no testing whatsoever"
- HelloNurse 2y ago
  Deploying untested changes isn't "near the end of the chain", and it voids any buttload of testing of something else.
elAhmo 2y ago
This is the way
- moffkalast 2y ago
  Episode 5: The Crowd Strikes Back
classified 2y ago
Good. Without consequences that hurt the perpetrators nothing will ever change.
pjmlp 2y ago
Great! This kind of stuff will finally make companies start taking quality seriously.
HenryBemis 2y ago
And yet there is no mention on the end-customers Change Management and Patch Management practices. Who pushes an update on 1000-5000-10000 machines without testing it? To whoever does this I have only one quote from Jaws: You go in the cage, cage goes in the water, you go in the water, shark's in the water, our shark. Farewell and adieu to you, fair Spanish ladies. Farewell and adieu, you ladies of Spain.
- chrisjj 2y ago
  > Who pushes an update on 1000-5000-10000 machines without testing it? No-one is seriously claiming CrowdStrike did that.
itunpredictable 2y ago
This headline is kind of misleading. It's actually someone's personal (educated) opinion on a blog, not a statement of fact. Should be something more like "I think CrowdStrike will be liable" or "CrowdStrike should be liable"
- 627467 2y ago
  the full headline (at this time at least) is more nuanced than seen here in hn: CrowdStrike will be liable for damages in France, based on the OVH precedent.
  - crtasm 2y ago
    It's also in the URL. Submitter, please don't remove important parts of headlines.
  - jncfhnb 2y ago
    Doesn’t really make it any less misleading. It is still just an opinion.
    - fennecbutt 2y ago
      No, because the current title can be misinterpreted as a statement of fact. And you know that.
null_investor 2y ago
What is hilarious to me is how the US government or courts doesn't seem to give a shit about this. Corporativism in US is a thing. Companies can brick hospital systems killing patients, drive self-driving cars and run over people but don't get sued, and if they do, they settle for very little. Just look at the recent Boeing incident where people were killed, the company clearly misled the US authorities and settled only a $0.5B fine. Those companies in those scenarios should pay the fine that they should ($20B+), and if it means the company would go bankrupt, do it and form a new company diluting the previous shareholders. Without doing this, shareholders and CEOs will have the incentive to carry on with their unfair practices that leads to dead people and deadlocked systems.
- Tarsul 2y ago
  what if the fine was giving up some shares to the government? With such a rule, after enough fines, the company would basically automatically become a public company.
  - Hamuko 2y ago
    Sounds too much like socialism to go anyhere.
    - withinboredom 2y ago
      It depends on who you want to punish, the shareholders, who have to give up their shares ... or the company, which doesn't really give a crap, as a whole.
  - JumpCrisscross 2y ago
    > what if the fine was giving up some shares to the government? What is the advantage over just fining? We keep trying to reïnvent the fine, which is great for those who would otherwise be fined.
  - onetokeoverthe 2y ago
    [dead]
anonu 2y ago
*might be liable And if France comes down hard on them, they may simply not do business in France.
- croes 2y ago
  If they are liable they maybe go out of business globally.
Retr0id 2y ago
I'm not a lawyer, and I'm definitely not a French lawyer, but I don't think the OVH comparison is valid. In the OVH case, their backup system (as a whole) failed. Many customers were left with 0 data, and per the article "the court ruled the OVH backup service was not operated to a reasonable standard and failed at its purpose". Meanwhile CrowdStrike "just" crashed their customer's kernels, for a duration of about 1 hour (during which they were 100% safe from cyber attacks!). Any remaining delays getting systems back online were (in my view) due to customers not having good enough disaster recovery plans. There's certainly grounds to argue that CrowdStrike's software was "not to a reasonable standard", but the first-order impacts (a software crash) are of a very different magnitude to permanently losing all data in a literal ball of fire (as in the OVH case). Software crashes all the time. For better or for worse, we treat software bugs as an inevitability in most industries (there are exceptions, of course). While software bugs are the "fault" of the software vendor, the job of mitigating the impacts thereof lies with the people deploying it. The only thing that makes the CrowdStrike case newsworthy, compared to all the other software crashes that happen on a daily basis, is that CrowdStrike's many customers had inserted their software into many critical pathways. CrowdStrike sells a playing card, and customers collectively built a house with them. (P.S. Don't treat this as a defense of CrowdStrike. I think their software sucks and was developed sloppily. I think they should face consequences for their sloppiness, I just don't think they will, under current legal frameworks. At best, maybe people will vote with their wallets, going forwards.)
- fabian2k 2y ago
  It didn't just crash, it crashed 100% of computers running it at that time and in a way that required physical intervention to fix. So I think you can considers this quite different from regular crashes because recovery is much more difficult and because it affected a lot of computers simultaneously. On top of that there are companies that had failures of their own in their recovery procedures. But even with good procedures this can be a significant outage because it is not trivially reverted and would typically affect many configurations that are redundant for many other failures.
  - Retr0id 2y ago
r00f 2y ago
Why does article say "On 19th July 2019, CrowdStrike pushed an update" ? Is it another incident in the past, same as OVH, or a typo? I'm kind of lost in context
notepad0x90 2y ago
I'm actually surprised the damage value I'm hearing about is not even $10B , I guess most of the downtime was on the weekend, but such a large scale 1-3 business day outage I'd think would a lot more. or perhaps it is because most small and medium businesses don't have crowdstrike because it is too expensive and they were not affected. Or another reason might be, indirect losses like the impact of delayed flights on individuals is not being considered. I think if the total liability for Crowdstrike is less than a few years worth of revenue, they'll come out unscathed because as I understand, they are still not profitable, their valuation is purely on speculation on future revenue. Their biggest paying customers still care a lot about getting compromised, it isn't just a box checking exercise like many have suggested.
tuetuopay 2y ago
French here, and working for another french CSP. We lived the OVH incident live and saw the whole aftermath. OVH was held liable because of the data loss, not for the service interruption. Data loss is something irremediable, permanent, definitive. Some businesses were basically ruined from this incident because they had no more data to operate. To add insult to injury, they sold offsite backups in the datacenter literally meters away. A service interruption, well, shit happens, and this is handled by SLA contracts that both parties agree to. You don't ruin a business (read: close a company) for a few days of outage. I doubt CrowdStrike will be held liable for much; from corporations at least. They cannot repay the damage done, or they close the door. The healthcare sector is another beast, but I think it will come to more regulations for critical entities.
- altdataseller 2y ago
  If a business closed down because of the OVH incident, how were the damages calculated? 1x annual revenue? Profit? 5x?
- dathinab 2y ago
  IMHO it would send really wrong signals if this doesn't end up with CrowdStrike closing their doors... like if the largest outage in history was caused by you due to a config parser failing and it looks as far as I can tell that they didn't follow industry best practices when it comes to config/parsing handling and probably also didn't follow some best practices when it comes to kernel module programming then honestly it would be really strange if you didn't had to declare bankruptcy due to damage payments (which doesn't mean the software is now gone/unmaintained, there are a lot of ways to make sure that doesn't happen, e.g. MS anyway had interest in buying Falcon).
  - JumpCrisscross 2y ago
    > it would send really wrong signals if this doesn't end up with CrowdStrike closing their doors I thought the same until I saw the damage estimates. They’re in the single-digit billions. That’s well below CrowdStrike’s market cap. Unless we’re going hard for retributive justice, liability should be enough.
hggh 2y ago
> CrowdStrike will be liable for damages in France ...based on the OVH precedent
ChrisArchitect 2y ago
Complete title: CrowdStrike will be liable for damages in France, based on the OVH precedent
threesevenths 2y ago
This article feels like it was written or augmented with an LLM.
- Retr0id 2y ago
  I didn't get that impression. Were there any particular "tells" you spotted?
dathinab 2y ago
not just in France most(all?) EU have laws which limit how much you can opt out of liability _no matter what you write into a contract_ while I'm not sure about the exact boundaries per country but I'm pretty sure that at least all hospitals, emergency call services etc. can sue for a non-negligible part of the damages that outage caused directly private people which where harmed by not getting operations done in time most likely can also sue them for the full damages caused to them (through it's hard to assess the damages and it might need to be indirectly by suing the hospital and the hospital sues for more damages) what you likely will not be able to sue for is the lost opportunity cost, the man power needed to fix it etc. also my guess is that for a lot of cases which are not as sever as human damages or as indirect as lost opportunity cost a huge factor will depend on the degree of negligence judges believe happened. And here "negligence" isn't limited to the specific change which caused the bug but also if they kept they due diligence in choices of tooling, approaches, business processes etc. to reasonable minimize the risk. (like e.g. was their way of parsing configs inadequate/did it follow industry best practices (IMHO it doesn't seem so), or was it adequate to mark the driver as required to allow boot (else windows would have auto disabled it and then restarted) etc.)
pm2222 2y ago
Sounds like a positive one for insurance industry.
deleted 2y ago
[deleted]
jeffrallen 2y ago
Another point against CrowdStrike: they did not have any "try once and if it fails, stop trying" logic. It cannot be the first time any CrowdStrike engineer saw the crash loop phenomenon. And so, a professional would have filed a high priority bug saying, "we need a way to stop crash loops definitively and automatically". That would have been literally the headline I'd choose for the bug. This is incompetence that in a just world would result in the corporate death penalty.
627467 2y ago
How deep does liability of a electricity provider go when they have major power outage? even if due to gross neglicence? would they be liable for all downstream failures including loss of life?
webworker 2y ago
What, the $10 gift certificate for customers isn't enough?
- blitzar 2y ago
  Virtual gift cards offered by Cybersecurity firm CrowdStrike to those who aided customers through the global IT outage have been blocked and flagged for potential fraud by Uber. https://www.abc.net.au/news/2024-07-26/crowdstrike-gift-cards-blocked/104145562 https://www.abc.net.au/news/2024-07-26/crowdstrike-gift-card... I almost feel sorry for CrowdStrike.

336 points by charlieirish 2y ago

Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Maybe now ClownStrike will start testing it properly, hopefully thereby fixing the stability and other issues.

vladvasiliu 2y ago
Likely not by the people who make the decisions to purchase this. They're usually hearing more from the marketing/sales people than from those actually having to deal with this. Personally, I don't expect this to make much of a difference, if any.
- justinclift 2y ago
  > Personally, I don't expect this to make much of a difference, if any. While you're probably right, I'm hoping ClownStrike's court results so absolutely dwarf their insurance coverage that it's nearly company ending. ie something to actually get them to improve things, not just generate empty PR platitudes: https://www.youtube.com/watch?v=SiL2AjOtjZI https://www.youtube.com/watch?v=SiL2AjOtjZI
  - vladvasiliu 2y ago
    Meh. We (techies) always knew the risks of running random crap in kernel space, especially when it runs junk it downloads from the internet. So, I expect this to be spun somehow along the lines of "sure all our boxes were down, but look, you've brought them all back up, didn't you? Now think about all the bad guys this protects us against! Of course the risk was worth it!". Also, "everybody does this! we couldn't have known!" "security people" are scared shitless of the whole "the world is ending! there are threats everywhere!" discourse that vendors peddle. The less technical, the more scared they are. Many of these people don't really understand what they're talking about and what compromises their decisions actually imply. Losing a day of work is simply dwarfed by "all your data is gone!".
    - davidmurdoch 2y ago
      I like to poke the security bears at my company by suggesting that the security team is actually a double agent team whose real employer is our competitor. They never find it funny for some reason.
GoToRO 2y ago
The problem is that you think that those managers are nice and reasonable people like yourself. They are not. What will happen is that some manager will yell at some other manager that will yell at some other manager that will yell at some tester that works on the cheapest virtual machine possible, on which it takes 5 minutes to log in and it disconnects after 2 minutes of idle. All the while, not changing anything. I'm pretty sure that all their resources are allocated to lawyers right now and their managers try really hard to gaslight their customers by telling them it was not that bad, they came up with the fix really fast (ignoring the fact that the fix was not possible to be applied) and so on.
- blibble 2y ago
  hopefully the lawyers are demanding payment in advance in many countries there are very strict limits on excluding liability for negligence
anonzzzies 2y ago
It's CIO magazine snakeoil. You don't buy it for any other reason than tick off some risk thing without knowing/thinking about it. Everyone does it, so he. Terrible.
ykonstant 2y ago
> Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Right, but other commenters call it the best EDR out there; so it is really hard for those of us outside the loop to understand what the hell is going on. Is CS, or any other EDR, actually preventing attacks that would pass through if absent? To what extent? Where are the numbers? Who audits CS code? I have seen no real data, only assertions.
- justinclift 2y ago
  Yeah, I'm as surprised as you that people have been saying ClownStrike Falcon was good. I guess the people saying that are security folk who look at things from a high level place of some sort (?). Because they don't seem aware of (or don't care about) the many problems it causes on the servers it gets deployed to. As we've now had amply demonstrated. Globally. ;)

siva7 2y ago

It's good to remind people that general liability waivers you often find with license agreements have no meaning outside of US jurisdiction if you're doing business in another jurisdiction.

GJim 2y ago
The number of US tech businesses that are surprised they need, or think they can ignore the need, to obey employment and data protection laws when working in other jurisdictions is simply bonkers.
- xxs 2y ago
  Well, it'd be a lot easier if most US entities understood that M/d/yy(yy) format is rare, or that default to Frankenstein degrees is pretty much the same/awkward (even Microsoft reset their weather widget to F on regular basis). The root of issue, not understanding local laws/culture, is very similar - surrounded by a vast market/culture (US +Canada) dulls your senses for the rest of the globe.
  - ed_elliott_asc 2y ago
    I thought Frankenstein degrees was a clever complaint about us companies wanting degrees for tech jobs
  - cmrdporcupine 2y ago
    > surrounded by a vast market/culture (US +Canada) US companies don't think about Canada as anything but an afterthought, and struggle with the same issues here that you just mentioned. Canada is metric, uses different spellings (closer to UK English.. colour, not color [Chrome just marked my spelling as wrong despite me having Canadian English as my setting]) and is officially bilingual with localization laws requiring companies to provide French versions for certain kinds of services. US companies either don't bother, or usually get this entirely wrong. e.g. It's been how many years? And navigation on Android / Google Maps can't pronounce French names for streets/places while driving around in bilingual places in Canada. Just completely butchers them, their system can't "understand" the concept that you could have your language set to English but still need to hear French place names, or vice versa.

honzaik 2y ago

time to issue 50€ gift cards!

jeffrallen 2y ago
...that "ne fonctionne pas"
Aachen 2y ago
Time to settle in a jurisdiction where gift cards are a legal currency and only do business within there

lordnacho 2y ago

Surely, there must be a gigantic number of claimants already taking to their lawyers about how to get compensation? Not just in France but across the planet? I wonder how this kind of thing is organised, since there's all these jurisdictions.

lukan 2y ago
"I wonder how this kind of thing is organised, since there's all these jurisdictions." In theory simple. Crowdstrike is doing buisness in state X, so compensation claims will be settled in court in state X. So lots of courts and lawers all around the world, will be quite busy for some time with the case.
- anonzzzies 2y ago
  I cannot see how they will get over this... It's CIO snakeoil to begin with, but this was not a simple mistake; it shows the entire lack of process and responsibility.
- b112 2y ago
  And if judgements are found, local to the jurisdiction assets (including and money being forwarded by banks, eg via credit cards, or wire transfers) can be seized. If that doesn't work, judgements can be registered in other courts for collection purposes.
  - WJW 2y ago
    Many countries also have treaties to accommodate this process across borders.
- sjamaan 2y ago
  It's a B2B tool, which means it's quite likely the contract/license states that all disputes are to be settled in a court appointed by them. This is not valid for consumer disputes, but businesses are free to do what they want. Perhaps this will let them off the hook? OVH is different in that it's actually a French company.

Baguette5242 2y ago

Holy shit (hits the fan). For sure CrowdStrike will be held accountable in several countries, but I believe that some conclusions need to be drawn also from a customer/user perspective. - Is it reasonable to grant such privilege access to a piece of software that ultimately is a black box ? - Is it reasonable to put a Microsoft / Commercial / Closed source OS in critical infrastructure ? If not considered as critical, then “important” infrastructure ? - Is it reasonable to have more than 70% of the computers/servers that run important infrastructure on the same OS / software ? How about the mitigation of the risks etc… I sincerely hope that all of this CrowdStrike mayhem will push stakeholders to draw some conclusions and actions.

llm_trw 2y ago
>- Is it reasonable to grant such privilege access to a piece of software that ultimately is a black box ? As I said in the previous thread: explaining to execs that giving root to someone on your machines means they have root is a very difficult concept for them to understand.
- phito 2y ago
  Then the exec should be held responsible?
  - dotancohen 2y ago
    That responsibility (and associated risk) is often the justification for C compensation. Whether that is a good argument I have no opinion.
  - nichol4s 2y ago
    The exec just follows the instructions provided by their CISO, who adheres to the information security standards used in audits. These standards are influenced not only by actual threats but also by lobbying from Endpoint Detection and Response (EDR) systems like SentinelOne and Crowdstrike. For instance, in 2021, the White House issued Executive Order 14028, which mandates the Federal Government to implement a robust EDR solution. Consequently, standards such as those from NIST and ISO27001 have increasingly emphasized malware detection and response. When onboarding any large enterprise, you will encounter these requirements before the enterprise can proceed with procuring your service. This compels B2B organizations to implement this software to be successful. ^1 https://www.opensecrets.org/federal-lobbying/clients/summary?cycle=2022&id=D000095316 https://www.opensecrets.org/federal-lobbying/clients/summary... ^2 https://www.opensecrets.org/federal-lobbying/clients/summary?cycle=2023&id=D000084079 https://www.opensecrets.org/federal-lobbying/clients/summary...

MaximilianEmel 2y ago

> On 19th July 2019, CrowdStrike pushed an update to their software. I assume the year was meant to be 2024.

bennyelv 2y ago

I was aware of this being the case when dealing with consumers, but had assumed that because B2B contracts are assumed to be between 2 sophisticated parties that there is little legislative protection that could override the terms of the contract. My understanding of law is generally UK based, but I'm not aware of legislation what would supersede a contract term limiting liability when the event that created the liability was one of general diligence/competence in carrying out the contract rather than relating to health and safety or some other area that is heavily legislated. For that reason I'm unconvinced on the article's statement that this isn't just a "French Legal System" thing and that the same kind of judgement might be made in other jurisdictions.

HeatrayEnjoyer 2y ago
Well for starters it did impact health and safety domains; hospitals and emergency services were severely degraded. There absolutely will be preventable deaths directly traceable to Crowdstrike.
consp 2y ago
As the article already states, in most jurisdictions you cannot void gross negligence liability in contracts. It will probably come down to that in those jurisdictions. If they willfully did not implement staged rollouts that look like negligence to me but ianal. You kill canaries for a reason.
- smcameron 2y ago
  Kind of looks like they had no canaries. https://securityboulevard.com/2024/07/crowdstrike-pir-canary-bsod-richixbw/ https://securityboulevard.com/2024/07/crowdstrike-pir-canary...
jltsiren 2y ago
I think the general idea is that gross negligence is a breach of contract. Every contract implicitly assumes that both parties are making a good faith effort to honor the terms of the contract. If you are not doing that, you may be in breach of contract, and the liability limitations may no longer apply.

udev4096 2y ago

The 10$ gift cards were just hilarious. How could they possibly expect anyone to take them seriously?

hsbauauvhabzb 2y ago
Was this possibly some way to influence liability limitation? If you accept a $10 gift card, could that be argued as an acceptance of compensation?
- switch007 2y ago
  Hopefully judges aren't that stupid / our legal systems so easily gamed
m2fkxy 2y ago
wait, that was not a joke?
- MobileVet 2y ago
  Sure wasn’t. $10 Uber Eats card https://m.slashdot.org/story/431090 https://m.slashdot.org/story/431090
orlp 2y ago
Not a lawyer, but the cynic in me assumes that it is legal bait: if someone at the company cashed the $10 gift card one could argue that compensation for damages has been accepted and no further liability applies. At least legally speaking, obviously this is completely morally bankrupt.
- consp 2y ago
  Any normal legal system should have an option for avoiding this, like "reasonable" compensation (reasonable would then be argued in court but I'm pretty sure you can find a lawyer who can argue a uber gift card is not).
- 2y ago

dotancohen 2y ago

Can someone explain to me why the protections that Falcon provides, are not provided by the OS itself? I am not completely naive, I've secured quite a few critical Linux servers, but with Windows it seems that there do not exist the same clear roles of security. Contrast with Red Hat or even Canonical, where is feels like I'm (correctly) fighting the security of the systems to get them into a state where my users can use my applications.

commandersaki 2y ago
How do you actively detect a malware agent running in user space using stealth or a kernel. Authors of such are fully aware of Linux hardening like SELinux / AppArmor and work around it.
- amluto 2y ago
  > How do you actively detect a malware agent running in user space using stealth or a kernel. You start with correct design. The system has a root of trust (ideally you skip the insane level of complexity that is Secure Boot + TPM and use something simple, testable, and verifiable — this isn’t actually that hard). Only authorized images will boot, and, more importantly, nothing else on the network trusts the machine until it proves it’s running the right image. Then you make the image immutable. Want to edit a system file? You can’t. Maybe in developer mode you can edit an overlay. All configuration is stored in a designated place, and that configuration is minimized. A stock image from the distro vendor has zero configuration, so there is no incomprehensible soup in /etc to audit. Configuration is also attested. Persistent data is separate from configuration. All persistent data is considered suspect. Any bug that allows malicious persistent data to compromise anything is a blocker, including corrupt filesystem metadata. A root-of-trust attestation has limited lifetime. The system forcibly re-verifies periodically. This either means rebooting or doing a runtime “dynamic root of trust” attenuation. The latter is complex. Complicated messes like kernel “lockdown” and the stock Secure Boot signatures have no place. Usermode root and the kernel are approximately equally trusted. SELinux is barely necessary, if at all, unless the actual user code wants it to control access to persistent data. But there are simpler, better schemes that are easier to reason about. Sadly the industry doesn’t think this way. I’m regularly surprised that Apple hasn’t gone in this direction more aggressively than they are with their MacOS products.

spotirca 2y ago

> "It is not an isolated incident. The same thing happened few weeks earlier with the CrowdStrike agent on Linux, nuking the system and there may be other occurrences before." Is there a link with this incident?

walterbell 2y ago
"CrowdStrike broke Debian and Rocky Linux months ago", https://news.ycombinator.com/item?id=41018029 https://news.ycombinator.com/item?id=41018029 "CrowdStrike's Falcon Sensor also linked to Linux kernel panics and crashes", https://news.ycombinator.com/item?id=41030352 https://news.ycombinator.com/item?id=41030352
mikelovenotwar 2y ago
https://www.neowin.net/news/crowdstrike-broke-debian-and-rocky-linux-months-ago-but-no-one-noticed/ https://www.neowin.net/news/crowdstrike-broke-debian-and-roc...

praptak 2y ago

I wonder what happens if the damages exceed whatever assets they have in France.

consp 2y ago
They have at least a B.V. with assets in the Netherlands and usually that one contains money for "tax reasons" (e.g. avoiding taxes), and they can lay claim on that.

wjnc 2y ago

Sorry, but I feel the author is reaching for a conclusion. From OP, in the OVH-case liability seems to override the contract / waivers when OVH was both the storage And backup provider and did not actively underline that this solution is suboptimal, in a situation where multiple data centers are physically very close. That's a chain of evidence. For CrowdStrike, it is clear that the offering is to more mature counter parties (thus raising the B2B standard of evidence) and that CrowdStrike very essentially did not do / support staging, whatever. This is indeed bad industry practice, but one that can thought to be explicit from the start of the agreement. At least in my locale you either make explicit agreements OR industry standards are leading. We do not do industry standard X is pretty clear. Read the list in OP, replace CrowdStrike with Microsoft and then think of the international liability cases you've heard from where Microsoft was found liable for downtime, hacks and other issues. Look, liabilities will always arise in such situations. But I expect only minor liabilities will arise. Mostly (AFAIK IANAL) the terms & conditions are applied in B2B-cases. This case is pretty obvious: you got what you signed up for. CrowdStrike with full scale access to your machines and no guarantees. On the other hand, Crowdstrike lost 125 billion in market cap. That's an indication of {liabilities + loss of future profits}. Pretty massive event for not being willing to do staging. But I expect it's mostly that CrowdStrike is tainted from now on. A friend of mine had a very bad stint as an employee of CrowdStrike recently and from what I learned from that case, I'm happy that the nature of the firm is somewhat more in the open now.

kierenj 2y ago

> Does CrowdStrike do any testing whatsoever? Obviously they didn’t or the incident wouldn’t have happened. Eh, parts of this article aren't very reasonable. Even if they did a buttload of testing, it only takes one failure in one part of the chain (near the end). They didn't test something they should have, sure, but obviously they didn't do "no testing whatsoever"

HelloNurse 2y ago
Deploying untested changes isn't "near the end of the chain", and it voids any buttload of testing of something else.

elAhmo 2y ago

This is the way

moffkalast 2y ago
Episode 5: The Crowd Strikes Back

classified 2y ago

Good. Without consequences that hurt the perpetrators nothing will ever change.

pjmlp 2y ago

Great! This kind of stuff will finally make companies start taking quality seriously.

HenryBemis 2y ago

And yet there is no mention on the end-customers Change Management and Patch Management practices. Who pushes an update on 1000-5000-10000 machines without testing it? To whoever does this I have only one quote from Jaws: You go in the cage, cage goes in the water, you go in the water, shark's in the water, our shark. Farewell and adieu to you, fair Spanish ladies. Farewell and adieu, you ladies of Spain.

chrisjj 2y ago
> Who pushes an update on 1000-5000-10000 machines without testing it? No-one is seriously claiming CrowdStrike did that.

itunpredictable 2y ago

This headline is kind of misleading. It's actually someone's personal (educated) opinion on a blog, not a statement of fact. Should be something more like "I think CrowdStrike will be liable" or "CrowdStrike should be liable"

627467 2y ago
the full headline (at this time at least) is more nuanced than seen here in hn: CrowdStrike will be liable for damages in France, based on the OVH precedent.
- crtasm 2y ago
  It's also in the URL. Submitter, please don't remove important parts of headlines.
- jncfhnb 2y ago
  Doesn’t really make it any less misleading. It is still just an opinion.
  - fennecbutt 2y ago
    No, because the current title can be misinterpreted as a statement of fact. And you know that.

null_investor 2y ago

What is hilarious to me is how the US government or courts doesn't seem to give a shit about this. Corporativism in US is a thing. Companies can brick hospital systems killing patients, drive self-driving cars and run over people but don't get sued, and if they do, they settle for very little. Just look at the recent Boeing incident where people were killed, the company clearly misled the US authorities and settled only a $0.5B fine. Those companies in those scenarios should pay the fine that they should ($20B+), and if it means the company would go bankrupt, do it and form a new company diluting the previous shareholders. Without doing this, shareholders and CEOs will have the incentive to carry on with their unfair practices that leads to dead people and deadlocked systems.

Tarsul 2y ago
what if the fine was giving up some shares to the government? With such a rule, after enough fines, the company would basically automatically become a public company.
- Hamuko 2y ago
  Sounds too much like socialism to go anyhere.
  - withinboredom 2y ago
    It depends on who you want to punish, the shareholders, who have to give up their shares ... or the company, which doesn't really give a crap, as a whole.
- JumpCrisscross 2y ago
  > what if the fine was giving up some shares to the government? What is the advantage over just fining? We keep trying to reïnvent the fine, which is great for those who would otherwise be fined.
- onetokeoverthe 2y ago
  [dead]

anonu 2y ago

*might be liable And if France comes down hard on them, they may simply not do business in France.

croes 2y ago
If they are liable they maybe go out of business globally.

Retr0id 2y ago

I'm not a lawyer, and I'm definitely not a French lawyer, but I don't think the OVH comparison is valid. In the OVH case, their backup system (as a whole) failed. Many customers were left with 0 data, and per the article "the court ruled the OVH backup service was not operated to a reasonable standard and failed at its purpose". Meanwhile CrowdStrike "just" crashed their customer's kernels, for a duration of about 1 hour (during which they were 100% safe from cyber attacks!). Any remaining delays getting systems back online were (in my view) due to customers not having good enough disaster recovery plans. There's certainly grounds to argue that CrowdStrike's software was "not to a reasonable standard", but the first-order impacts (a software crash) are of a very different magnitude to permanently losing all data in a literal ball of fire (as in the OVH case). Software crashes all the time. For better or for worse, we treat software bugs as an inevitability in most industries (there are exceptions, of course). While software bugs are the "fault" of the software vendor, the job of mitigating the impacts thereof lies with the people deploying it. The only thing that makes the CrowdStrike case newsworthy, compared to all the other software crashes that happen on a daily basis, is that CrowdStrike's many customers had inserted their software into many critical pathways. CrowdStrike sells a playing card, and customers collectively built a house with them. (P.S. Don't treat this as a defense of CrowdStrike. I think their software sucks and was developed sloppily. I think they should face consequences for their sloppiness, I just don't think they will, under current legal frameworks. At best, maybe people will vote with their wallets, going forwards.)

fabian2k 2y ago
It didn't just crash, it crashed 100% of computers running it at that time and in a way that required physical intervention to fix. So I think you can considers this quite different from regular crashes because recovery is much more difficult and because it affected a lot of computers simultaneously. On top of that there are companies that had failures of their own in their recovery procedures. But even with good procedures this can be a significant outage because it is not trivially reverted and would typically affect many configurations that are redundant for many other failures.
- Retr0id 2y ago

r00f 2y ago

Why does article say "On 19th July 2019, CrowdStrike pushed an update" ? Is it another incident in the past, same as OVH, or a typo? I'm kind of lost in context

notepad0x90 2y ago

I'm actually surprised the damage value I'm hearing about is not even $10B , I guess most of the downtime was on the weekend, but such a large scale 1-3 business day outage I'd think would a lot more. or perhaps it is because most small and medium businesses don't have crowdstrike because it is too expensive and they were not affected. Or another reason might be, indirect losses like the impact of delayed flights on individuals is not being considered. I think if the total liability for Crowdstrike is less than a few years worth of revenue, they'll come out unscathed because as I understand, they are still not profitable, their valuation is purely on speculation on future revenue. Their biggest paying customers still care a lot about getting compromised, it isn't just a box checking exercise like many have suggested.

tuetuopay 2y ago

French here, and working for another french CSP. We lived the OVH incident live and saw the whole aftermath. OVH was held liable because of the data loss, not for the service interruption. Data loss is something irremediable, permanent, definitive. Some businesses were basically ruined from this incident because they had no more data to operate. To add insult to injury, they sold offsite backups in the datacenter literally meters away. A service interruption, well, shit happens, and this is handled by SLA contracts that both parties agree to. You don't ruin a business (read: close a company) for a few days of outage. I doubt CrowdStrike will be held liable for much; from corporations at least. They cannot repay the damage done, or they close the door. The healthcare sector is another beast, but I think it will come to more regulations for critical entities.

altdataseller 2y ago
If a business closed down because of the OVH incident, how were the damages calculated? 1x annual revenue? Profit? 5x?
dathinab 2y ago
IMHO it would send really wrong signals if this doesn't end up with CrowdStrike closing their doors... like if the largest outage in history was caused by you due to a config parser failing and it looks as far as I can tell that they didn't follow industry best practices when it comes to config/parsing handling and probably also didn't follow some best practices when it comes to kernel module programming then honestly it would be really strange if you didn't had to declare bankruptcy due to damage payments (which doesn't mean the software is now gone/unmaintained, there are a lot of ways to make sure that doesn't happen, e.g. MS anyway had interest in buying Falcon).
- JumpCrisscross 2y ago
  > it would send really wrong signals if this doesn't end up with CrowdStrike closing their doors I thought the same until I saw the damage estimates. They’re in the single-digit billions. That’s well below CrowdStrike’s market cap. Unless we’re going hard for retributive justice, liability should be enough.

hggh 2y ago

> CrowdStrike will be liable for damages in France ...based on the OVH precedent

ChrisArchitect 2y ago

Complete title: CrowdStrike will be liable for damages in France, based on the OVH precedent

threesevenths 2y ago

This article feels like it was written or augmented with an LLM.

Retr0id 2y ago
I didn't get that impression. Were there any particular "tells" you spotted?

dathinab 2y ago

not just in France most(all?) EU have laws which limit how much you can opt out of liability _no matter what you write into a contract_ while I'm not sure about the exact boundaries per country but I'm pretty sure that at least all hospitals, emergency call services etc. can sue for a non-negligible part of the damages that outage caused directly private people which where harmed by not getting operations done in time most likely can also sue them for the full damages caused to them (through it's hard to assess the damages and it might need to be indirectly by suing the hospital and the hospital sues for more damages) what you likely will not be able to sue for is the lost opportunity cost, the man power needed to fix it etc. also my guess is that for a lot of cases which are not as sever as human damages or as indirect as lost opportunity cost a huge factor will depend on the degree of negligence judges believe happened. And here "negligence" isn't limited to the specific change which caused the bug but also if they kept they due diligence in choices of tooling, approaches, business processes etc. to reasonable minimize the risk. (like e.g. was their way of parsing configs inadequate/did it follow industry best practices (IMHO it doesn't seem so), or was it adequate to mark the driver as required to allow boot (else windows would have auto disabled it and then restarted) etc.)

pm2222 2y ago

Sounds like a positive one for insurance industry.

deleted 2y ago

[deleted]

jeffrallen 2y ago

Another point against CrowdStrike: they did not have any "try once and if it fails, stop trying" logic. It cannot be the first time any CrowdStrike engineer saw the crash loop phenomenon. And so, a professional would have filed a high priority bug saying, "we need a way to stop crash loops definitively and automatically". That would have been literally the headline I'd choose for the bug. This is incompetence that in a just world would result in the corporate death penalty.

627467 2y ago

How deep does liability of a electricity provider go when they have major power outage? even if due to gross neglicence? would they be liable for all downstream failures including loss of life?

webworker 2y ago

What, the $10 gift certificate for customers isn't enough?

blitzar 2y ago
Virtual gift cards offered by Cybersecurity firm CrowdStrike to those who aided customers through the global IT outage have been blocked and flagged for potential fraud by Uber. https://www.abc.net.au/news/2024-07-26/crowdstrike-gift-cards-blocked/104145562 https://www.abc.net.au/news/2024-07-26/crowdstrike-gift-card... I almost feel sorry for CrowdStrike.