The "vulnerability" here was basically just having Kernel level access, which CrowdStrike is intended to have. If hackers had that, they've already won anyway. The difficulty lies in actually getting that level of access. So no, it doesn't change a thing for hackers.
this post was submitted on 23 Jul 2024
12 points (75.0% liked)
Asklemmy
44152 readers
731 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy π
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- [email protected]: a community for finding communities
~Icon~ ~by~ ~@Double_[email protected]~
founded 5 years ago
MODERATORS
So how about hacking CrowdStrike and obtaining that access? I'm guessing it might be easier than hacking Microsoft?
Are there other companies having the same access level as CrowdStrike? How vulnerable are they?
So how about hacking CrowdStrike and obtaining that access? Iβm guessing it might be easier than hacking Microsoft?
Maybe. CrowdStrike is a company which specializes in security and has some pretty smart folks in that area. They also live and die by the perceived value of their security products. So, security is pretty important to the company. Microsoft is a conglomerate, and while it does have some arms which specialize in (and are pretty good at) security, the company's continued existence doesn't depend on their performance. So, the Microsoft President can go in front of Congress and promise to do better, and we all know this is bullshit and Microsoft will continue to be Microsoft.
As for an attacker actually leveraging the CrowdStrike platform as part of an attack. It's entirely possible. Security products have been found to have vulnerabilities in the past. IIRC, McAfee's ePO server was vulnerable to Log4j. And given CrowdStrike's engine runs in Ring 0 on the endpoints, it's certainly an attractive target. Finding a Remote Code exploit in it seems like something an APT like the NSA or PLA Unit 61398 might get up to. That said, as I mentioned above, CrowdStike also employs a lot of smart folks and is likely doing it's level best to find those vulnerabilities first and fix them.
Are there other companies having the same access level as CrowdStrike? How vulnerable are they?
Ya. Really, any EDR or A/V product is going to run in Ring 0. And any such kernel level driver crashing is going to cause a BSOD. That's just the way Windows is designed. I have personally dealt with bad updates from several other products causing BSODs. Including one which brought down the entire site I was working at, at the time. I believe it also took down a number of other sites as well. Since, once I figure out how to get the bad update out of our system, the folks responsible for the update actually reached out and asked me what I did.
Ultimately, products like these exist in a very trusted state on systems, because they have to. if and when they crash, you can expect a BSOD. In this case, I suspect CrowdStrike is going to receive (and they deserve) a lot of shit for the way this one went down. The reporting I've seen states that the update file was just a mass of null bytes. And it seems there was no sanity checking or error handling for a corrupt update being pushed by CrowdStrike. I suspect that's gonna get fixed pretty quick, but it was a pretty bad oversight for a product with regular, live updates.
Great comment. And cool story about your fix!
if gamers keep allowing companies to install kernel level anti-cheat, i fear the answer is sooner rather than later.
"Hackers" (rather, malicious actors) rarely look to take down IT resources as their goal. Instead, they want to access it for their own purposes. The closest example would be ransomware, where it gets taken down as part of the threat/punishment. But if the victim pays, their resources must be restored.
Plus, I would be surprised if Crowd Strike doesn't have any protections on its own files. I also expect there will be additional verification checks (hash/etc) on their updates going forward.
malicious actors rarely look to take down IT resources as their goal
Could be a hostile government sponsored group or idealists (Microsoft has more haters than fans) or simply someone could do it just because they can - if they could. Some men just want to see the world burn.
They could also DDOS essentially anything with root access to that many devices.
Its like taking all the armies guns to throw them in a volcano 'cause you want to see the world burn'
A Crow Strike sounds both glorious and terrifying.
Haven't noticed the typo until now and I made it twice...!
(οΌβΈα)
Can? Probably. Will? No. They would need access to Crowdstrike's update distribution system and if they had that they could do much more interesting things than crashing a bunch of systems.