4 ms·

> one part enterprisey, one part "move fast and break things". When there's 0day, how enterprisey you would like to catch the 0day?

tsimionescu 2y ago
Not sure, but definitely more enterprisey than "release a patch to the entire world at once before running it on a single machine in-house".
- mewpmewp2 2y ago
  So it would be preferable to have your data encrypted, taken hostage unless you pay, and be down for days, instead of 6 hours of just down?
  - xeromal 2y ago
    That's a false dichotomy
  - tsimionescu 2y ago
    Do you seriously believe that all CrowdStrike on Windows customers were at such imminent risk of ransomware that one-two hours to run this on one internal setup and catch the critical error they released would have been dangerous? This is a ludicrous position, and has been proven obviously false by the proceedings: all systems that were crashed by this critical failure were not, in fact, attacked with ransomware once the CS agent was un-installed (at great pain).
    - hello_moto 2y ago
      I'd challenge you to be a CISO :) You don't want to be in a situation where you're taken hostage and asked hundred mills ransomeware just because you're too slow to mitigate the situation.
canucker2016 2y ago
Crowdstrike exploited their own 0-day. Their market cap went down by several billion dollars. A patch should, at minimum: 1. Let the app run 2a. Block the offending behaviour 2b. Allow normal behaviour Part 1. can be assumed if Parts 2a and 2b work correctly. We know CrowdStrike didn't ensure 2a or 2b since the app caused the machine to reboot when the patch caused a fault in the app. CrowdStrike's Root Cause Analysis, https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf https://www.crowdstrike.com/wp-content/uploads/2024/08/Chann..., lists what they're going to do: ==== Mitigation: Validate the number of input fields in the Template Type at sensor compile time Mitigation: Add runtime input array bounds checks to the Content Interpreter for Rapid Response Content in Channel File 291 - An additional check that the size of the input array matches the number of inputs expected by the Rapid Response Content was added at the same time. - We have completed fuzz testing of the Channel 291 Template Type and are expanding it to additional Rapid Response Content handlers in the sensor. Mitigation: Correct the number of inputs provided by the IPC Template Type Mitigation: Increase test coverage during Template Type development Mitigation: Create additional checks in the Content Validator Mitigation: Prevent the creation of problematic Channel 291 files Mitigation: Update Content Configuration System test procedures Mitigation: The Content Configuration System has been updated with additional deployment layers and acceptance checks Mitigation: Provide customer control over the deployment of Rapid Response Content updates ====

tsimionescu 2y ago

Not sure, but definitely more enterprisey than "release a patch to the entire world at once before running it on a single machine in-house".

mewpmewp2 2y ago
So it would be preferable to have your data encrypted, taken hostage unless you pay, and be down for days, instead of 6 hours of just down?
- xeromal 2y ago
  That's a false dichotomy
- tsimionescu 2y ago
  Do you seriously believe that all CrowdStrike on Windows customers were at such imminent risk of ransomware that one-two hours to run this on one internal setup and catch the critical error they released would have been dangerous? This is a ludicrous position, and has been proven obviously false by the proceedings: all systems that were crashed by this critical failure were not, in fact, attacked with ransomware once the CS agent was un-installed (at great pain).
  - hello_moto 2y ago
    I'd challenge you to be a CISO :) You don't want to be in a situation where you're taken hostage and asked hundred mills ransomeware just because you're too slow to mitigate the situation.

canucker2016 2y ago

Crowdstrike exploited their own 0-day. Their market cap went down by several billion dollars. A patch should, at minimum: 1. Let the app run 2a. Block the offending behaviour 2b. Allow normal behaviour Part 1. can be assumed if Parts 2a and 2b work correctly. We know CrowdStrike didn't ensure 2a or 2b since the app caused the machine to reboot when the patch caused a fault in the app. CrowdStrike's Root Cause Analysis, https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf https://www.crowdstrike.com/wp-content/uploads/2024/08/Chann..., lists what they're going to do: ==== Mitigation: Validate the number of input fields in the Template Type at sensor compile time Mitigation: Add runtime input array bounds checks to the Content Interpreter for Rapid Response Content in Channel File 291 - An additional check that the size of the input array matches the number of inputs expected by the Rapid Response Content was added at the same time. - We have completed fuzz testing of the Channel 291 Template Type and are expanding it to additional Rapid Response Content handlers in the sensor. Mitigation: Correct the number of inputs provided by the IPC Template Type Mitigation: Increase test coverage during Template Type development Mitigation: Create additional checks in the Content Validator Mitigation: Prevent the creation of problematic Channel 291 files Mitigation: Update Content Configuration System test procedures Mitigation: The Content Configuration System has been updated with additional deployment layers and acceptance checks Mitigation: Provide customer control over the deployment of Rapid Response Content updates ====