5 ms·
You are completely right. BTW It wasn't a software update, it was a content update, a 'channel file'. Someone didn't do enough testing. edit: or any testing at
by tempaway4575144 2y ago
You are completely right. BTW It wasn't a software update, it was a content update, a 'channel file'.
Someone didn't do enough testing. edit: or any testing at all?
https://x.com/George_Kurtz/status/1814235001745027317 https://x.com/George_Kurtz/status/1814235001745027317
https://x.com/brody_n77/status/1814185935476863321 https://x.com/brody_n77/status/1814185935476863321
- Shank 2y agoIt's an automatic update of the product. Semantic "channel vs. binary" doesn't indicate anything. If your software's definition files can cause a kernel mode driver to crash in a bootloop you have bigger problems, but the outcome is the same as if the driver itself was updated.
- tempaway4575144 2y agoIndeed. Its worse really, it means there was a bug lurking in their product that was waiting for a badly formatted file to surface it. Given how widespread the problem is it also means they are pushing these files out without basic testing. edit: It will be very interesting to see how CrowdStrike wriggle out of the obvious conclusion that their company no longer deserves to exist after a f*k up like this.
- account42 2y agoSimple: They are obviously too big to fail now.
- deleted 2y ago[deleted]
- tempaway4575144 2y ago"Too big to uninstall" is a thing I guess
- morpheuskafka 2y agoThat’s even worse—-they should be fuzz testing with bad definitions files to make sure this is safe. Inevitably the definitions updates will be rushed out to address zero days and the work should be done ahead of time to make them safe.
- tux3 2y agoHaving spent time reverse-engineering Crowdstrike Falcon, a lot of funny things can happen if you feed it bad input. But I suspect they don't have much motivation to make the sensor resilient to fuzzing, since the thing's a remote shell anyways, so they must think that all inputs are absolutely trusted (i.e. if any malicious packet can reach the sensor, your attackers can just politely ask to run arbitrary commands, so might as well assume the sensor will never see bad data..)
- GONE_KLOUT 2y agoPlease more details. What do you mean with "is a remote shell anyways"? thanks!
- deleted 2y ago[deleted]
- baq 2y agoIt's an interface to the ring 0 kernel module. Everything is a remote shell if it can talk to ring 0.
- tux3 2y agoFalcon has a feature called "Real Time Response". The sensor is in contact with a server with which it exchanges events serialized in protobuf. One of the event you can get from the Crowdstrike server runs an arbitrary shell command. https://www.crowdstrike.com/tech-hub/endpoint-security/the-power-of-real-time-response/ https://www.crowdstrike.com/tech-hub/endpoint-security/the-p...
- 2y ago
- bravetraveler 2y agoThat makes me even more unsettled! Shouldn't this be closer to metadata than operational/mechanical? Feels like they made unsafe data for the format they created. Untrustworthy. To your point, they aren't testing.
- Avamander 2y agoWhy does it make you more unsettled? The amount of parsers written in unsafe languages for difficult formats is immense. They're everywhere.
- bravetraveler 2y agoAdmittedly, I don't know exactly what's in these files. When I hear 'content' I think 'config'. This is going to be very hypothetical, I ask for some patience. Not arguments. The 'config file' parser is so unsafe that... not only will the thing consuming it break, but it'll take down the environment around it. Sure, this isn't completely fair. It's working in kernel space so one misstep can be dire. Again, testing. I think it's a reasonable assumption/request that something try to degrade itself, not the systems around it edit: When a distinction between 'config' and 'agent' releases is made, it's typically with the understanding that content releases move much faster/flow freely. The releases around the software itself tend to be more controlled, being what is actually executed. In short, the risk modeling and such doesn't line up. The content updates get certain privileges under certain (apparently mistaken) robustness assumptions. Too much credit, or attention, is given to the Agent!
- weinzierl 2y agoAs I understand, this only manifests after a reboot and if the 'content update' is tested at all it is probably in a VM that just gets thrown away after the test and is never rebooted. Also, this makes me think: How hard would it be to craft a malware that has the same signature as an important system file? Preferably one that doesn't cause immediate havoc when quarantined, just a BSOD after reboot, so it slips through QA. I don't believe this is what's happened, but I think it is an interesting threat.
- jodrellblank 2y ago> How hard would it be to craft a malware that has the same signature as an important system file? Very, otherwise digital signatures wouldn’t be much use. There are no publicly known ways to make an input which hashes to the same value as another known input through the SHA256 hash algorithm any quicker than brute-force trial and error of every possibility. This is the difficulty that BitCoin mining is based on - the work that all the GPUs were doing, the reason for the massive global energy use people complain about is basically a global brute-force through the SHA256 input space. See the “find a custom SHA256” challenge on HN last month discussions: https://news.ycombinator.com/item?id=40683564 https://news.ycombinator.com/item?id=40683564
- weinzierl 2y agoI was talking about malware signatures, which do necessarily use cryptographic hashes. They are probably more optimized for speed because the engine needs to check a huge number of files as fast as possible.
- jodrellblank 2y agoCryptographic hashes are not the fastest possible hash, but they are not slow; CPUs have hardware SHA acceleration: https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sha-extensions.html https://www.intel.com/content/www/us/en/developer/articles/t... - compared to the likes of a password hash where you want to do a lot of rounds and make checking slow, as a defense against bruteforcing. That sounds even harder; Windows Authenticode uses SHA1 or SHA256 on partial file bytes, the AV will use its own hash likely on the full file bytes, and you need a malware which matches both - so the AV will think it's legit and Windows will think it's legit.
- glimshe 2y agoIt passed all unit tests!
- livrem 2y agoIt passed the type checker!
- account42 2y ago> President & CEO CrowdStrike, Former CTO of McAfee Well that's certainly a track record.
- delfinom 2y agoShowing yet again that the executive class only fails upwards.
- mrguyorama 2y agoThat's funny, because IIRC McAfee back in the Windows XP days did this exact same thing! They added a system file to the signature registry and caused Windows computers to BSOD on boot. https://www.zdnet.com/article/defective-mcafee-update-causes-worldwide-meltdown-of-xp-pcs/ https://www.zdnet.com/article/defective-mcafee-update-causes...
- andyjohnson0 2y ago> It wasn't a software update, it was a content update, a 'channel file' Because I know nothing about Crowdstrike... what is a "channel file"? Some kind of config file?
- ExoticPearTree 2y agoIt is how they package their malware definitions. It's semantics.
- TheOtherHobbes 2y agoSo their malware definition turned into malware? Good to know they don't check their definitions for defects before installing them.
- chrisjj 2y agoSince when is this content not software, just because it is.not an .exe?
- drivebycomment 2y agoThis will go down as one of the worst examples of communication during an outage.
- philipwhiuk 2y agoIt's possible there's no human involvement from detection to deployment.