6 ms·
Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with acce
by st3fan 2y ago
Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text.
Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs.
Only the Mac version does this. There is no way to disable this behaviour or a way to redact things.
Another really odd design decision. They probably have many many thousands of plain text secrets from their customers stored in their SIEM.
- batch12 2y agoAnyone with the right level of access to your Falcon instance can run commands on your endpoints (using RTR) and collect any data not already being collected.
- deleted 2y ago[deleted]
- x3n0ph3n3 2y agoCan you provide some more info on this? How do you know? Is this documented somewhere? I'm sure this is going to raise red-flags in my IT department.
- st3fan 2y agoAsk them to search for the usual env var names like GITHUB_TOKEN or AWS_ACCESS_KEY_ID.
- skewer99 2y agoAKIDs... ugh. They'll be there if you use AWS + Mac. Again, the plaintext is the problem. These environment variables get loaded from the command line, scripts, etc. - CrowdStrike and all of the best EDRs also collect and send home all of that, but probably in an encrypted stream?
- zxexz 2y agoI usually remote dev on an instance in a VPC because of crap like this. If you like terrible ideas (I don't use this except for debugging IAM stuff, occasionally), you can use the IMDS like you were an AWS instance by giving a local loopback device the link-local ipv4 address 169.254.169.254/32 and binding traffic on the instance's 169.254.169.254/32 port 80 to your lo's port 80, and a local AWS SDK will use the IAM instance profile of the instance you're connected to. I'll repeat, this is not a good idea.
- apimade 2y agoIs this really a criticism? Because this has been the case forever with all security and SIEM tools. It’s one of the reasons why the SIEM is the most locked down pieces of software in the business. Realistically, secrets alone shouldn’t allow an attacker access - they should need access to infrastructure or a certificates in machines as well. But unfortunately that’s not the case for many SaaS vendors.
- st3fan 2y agoBut why only forced on MacOS? I think some configurability would be great. I would like to provide an allow list or the ability to redact. Or exclude specific host groups. We all have different levels of acceptable risk
- btilly 2y agoConspiracy theory time. Because Apple is the only OS company that has reliably proven that it won't decrypt hard drives at government request.
- vagrantJin 2y agoThis is a true conspiracy .
- jordanb 2y agoSeriously? Crowdstrike is obviously NSA just like Kaspersky is obviously KGB and Wiz is obviously Mossad. Why else are counties so anxious about local businesses not using agents made by foreign actors?
- smolder 2y agoKGB is not even a thing. Modern equivalent is FSB, no? I'm skeptical. I don't think it's obvious that these are all basically fronts, as much as I'm willing to believe that IC tentacles reach wide and deep.
- skewer99 2y agoThe monitoring and collection isn't the problem, that's what modern EDR does - collect, analyze, compare, and do statistics on all of the things. The plaintext part is not okay.
- notepad0x90 2y agoThank you, that's a sound perspective, but it is the responsibility of the security staff who deploy EDRs like Crowdstrike to scrub any data at ingestion time into their SIEM. but within CS's platform, it makes little sense to talk about scrubbing, since CS doesn't know what you want scrubbed unless it is standardized data forms (like SSNs,credit cards,etc..). Another way to look at it is, the CS cloud environment is effectively part of your environment. the secrets can get scrubbed, but CS still has access to your devices, they can remotely access them and get those secrets at any time without your knowledge. that is the product. The security boundary of OP's mac is inclusive of the CS cloud.
- st3fan 2y agoUnfortunately the software doesn’t allow for scrubbing or redacting to be configured. Those features simply do not exist.
- notepad0x90 2y agofor their own cloud, yeah, you basically accept their cloud as an extension of your devices. but the back-end they use(d?), Splunk, does have scrubbing capability they can expose to customers, if actual customers requested it. In reality, you can take steps to prevent PII from being logged by Crowdstrike, but credentials are too non-standard to meaningfully scrub. It would be an exercise in futility. If you trust them to have unrestricted access to the credential, the fact that they're inadvertently logging it because of the way your applications work should not be considered an increase in risk.
- SoftTalker 2y agoSecrets in clear text in environment variables is never a good idea though.
- dchftcs 2y agoThere are secrets like passwords, but there are also secrets like "these are the parameters for running a server for our assembly line for X big corp".
- brundolf 2y agoDo you have a source?
- madcadmium 2y agoDoes it also monitor the contents of your copy/paste buffer? It would scoop up a ton of privileged data if so.
- hiddencost 2y agoThis kind of information seems like it should have a CVE and a responsible disclosure process. Kidding, mostly, but wow that's a hell of a vulnerability.
- notepad0x90 2y agoIt is not a vulnerability, you literally pay for this feature. I really don't want to defend Crowdstrike but HN keeps making it hard not to.
- hiddencost 2y agoStoring secrets in unsecured environments in plaintext is literally a vulnerability. One of the most famous examples can be seen in the NSA slide at the top of this article: https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
- notepad0x90 2y agothe security tools' storage system is always considered a secured environment.
- j4coh 2y agoWithout even having to secure it?
- throw_a_grenade 2y agoYes, but also No. So there's this thing called "Threat model" and it includes some assumptions about some moving parts of the infra, and it very often includes assertion that a particular environment (like IDS log, signing infra surrounding HSM etc.) is "secure" (they mean outside of the scope of that particular threat model). So it often gets papered over, and it takes some reflex to say "hey, how we will secure that other part". There needs to be some conciousnes about it, because it's not part of this model under discussuon, so not part of the agenda of this meeting... And it gets lost. That's how shit happens in compliance-oriented security.
- notepad0x90 2y agothat's what EDRs do. anyone with access to your SIEM or CS data should also be trusted with response access (i.e.: remotely access those machines). If you want this redacted, it is a SIEM functionality not Crowdstrike's. Depends on the SIEM but even older generation SIEMs have a data scrubbing feature. This isn't a Crowdstrike design decision as you've put it. any endpoint monitoring too, including the free and open source ones behave just as you described. You won't just see env vars from macs but things like domain admin creds and PKI root signing private keys. If you give someone access to an EDR, or they are incident responders with SIEM access, you've trusted them with full -- yet, auditable and monitored -- access to that deployment.
- Fnoord 2y agoSure, storage. Networking though? SIEMs receive and send data unencrypted? They should not. By sending the data in plain text you open up an attack surface to anyone sniffing the network.
- notepad0x90 2y agoCrowdstrike like many EDRs uses mutually authenticated TLS to send the data over the network to their cloud.
- Fnoord 2y agoOP said: > Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. So this person claims the data isn't send using TLS. I didn't verify the claim myself though.
- deleted 2y ago[deleted]
- pmlnr 2y agoDon't downvote this, this is the sad truth.
- jgtrosh 2y agoDid somebody say GDPR?
- pmlnr 2y agoCompanies believe GDPR doesn't apply to their human resources.
- riedel 2y agoThey have IT policies to make sure it largely does not apply. Even in our policy officially any personal use is forbidden. Funnily there is also agreement with our employee board, that any personal use will not be sanctioned. So guess what happens. This done to circumvent not only GPR but also TTDSG in germany (which is harsher on 'spying' as it applies to telecoms. For any 'officially' gathered personal information though typical very specific agreements with our employee board exist though (reporting of illness, etc). Wonder how such information which is also sensitive in a workplace is handled. Also I see those systems used in hospitals etc, if other peoples data is pumped through this systems GDPR definitively applies and auditors may find it (I only know such auditing in finance though). In the future NIS2 will also apply so exactly the people that use such systems will be put under additional scrutiny. Hope this triggers also some auditing of the systems used and not just the use of more of such systems.
- unilynx 2y agoWhat would you expect the GDPR to say? This is allowed as long as the GDPRs requirements are followed
- raverbashing 2y agoNot applicable. It is not related to personal data
- philshem 2y agoSIEM = Security information and event management https://en.wikipedia.org/wiki/Security_information_and_event_management https://en.wikipedia.org/wiki/Security_information_and_event...
- debarshri 2y agoIt is a common in the world of SIEM. Logs with secrets and PII data is often sent and stays in the SIEM for years until an incident occurs.
- MasterIdiot 2y agoHaving worked for a SIEM vendor, I can say that all security software is extremely invasive, and most security people can probably track every action you make on company-issued devices, and that includes HTTPS decryption.
- blablabla123 2y agoYeah the question is always if the cure is better than the disease. I'm quite ambivalent on this. On the one hand I tend to agree with the "Anti AV camp" that a sufficiently maintained machine can do well when following best practices. Of course that includes SIEM which can also be run on-premise and doesn't necessarily have to decrypt traffic if it just consumes properly formatted logs. On the other hand there was e.g. WannaCry in 2017 where 200,000 systems across 150 countries running Windows XP and other unsupported Windows Server versions had crypto miners installed. It shows that companies world-wide had trouble properly maintaining the life cycle of their systems. I think it's too easy to only accuse security vendors of quality problems.
- firtoz 2y agoReminds me of a guy I know openly bragging that he can watch all of his customers who installed his company's security cameras. I won't reveal his details but just imagine any cloud security camera company doing the same and you would probably be right. I guess it's pretty much the same principle.