Gregory's ServerIf anybody wonders what the file that took down 8.5 million Windows systems looks like.. it was 41kb in size. The only validity checking I can see CrowdStrike driver does is to check the first few bytes match the pattern seen in the screenshot before loading and executing.
|
31 comments
 The initial Post Incident Review is out from CrowdStrike. It’s good and really honest. There’s some wordsmithing (eg channel updates aren’t code - their parameters control code). The key take away - channel updates are currently deployed globally, instantly. They plan to change this at a later date to operate in waves. This is smart (and what Microsoft do for similar EPP updates). https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/ By ‘this is smart’ I mean ‘this is smart… now’. Obviously they shouldn’t have been globally, simultaneously deploying kernel driver parameter changes across all customers: it was waiting to go wrong. They still are btw, as it will take a while to engineer the correct way of doing it. On insurance and CrowdStrike, Parametrix claim amongst just the Fortune 500 companies, they are facing $5.4bn in losses, of which around 10% will be covered by insurance. CrowdStrike have won this year's Pwnie Award for Epic Fail, which will please @qwertyoruiop. If you want to know something crazy: - This year TCS migrated their EDR to CrowdStrike Questions for your EDR providers (do not assume they are experts in availability): - What are your different update processes? CrowdStrike staff members are selling CrowdStrike monopoly sets they were given on eBay. CrowdStrike filed at 8-K with the SEC on July 22nd for a cybersecurity incident. https://www.board-cybersecurity.com/incidents/tracker/20240722-crowdstrike-holdings-inc-cybersecurity-incident/ Almost a week in, CrowdStrike say 97% of devices are back online. https://www.axios.com/2024/07/25/crowdstrike-97-percent-systems-online Microsoft are talking about changes to Windows after the CrowdStrike incident. Good. https://www.theverge.com/2024/7/26/24206719/microsoft-windows-changes-crowdstrike-kernel-driver There’s a really good discussion on @riskybusiness’s YouTube show about the CrowdStrike incident. About the 3 minute mark @alex made me realise I was far too kind to CrowdStrike. He rightly rips them apart. Re the Delta case - the lawyer they’ve hired successfully sued Microsoft previously on behalf of the US government, and the decision was upheld on appeal too. The ruling almost lead to the breaking up of Microsoft. The following US government backed out of the case. Bill Gates said at the time the lawyer was “out to destroy Microsoft”. So there’s a chance here the CrowdStrike incident may end up having implications across vendor industry around warranties etc, we’ll see. Replacing an XDR platform at scale takes some time, so if you’re wondering what the translation of Elon’s tweet about Crowdstrike is: Elon: can we replace Crowdstrike? Of course.. given how the Twitter takeover happened maybe he just got them to uninstall it and #yolosec Delta’s CEO has confirmed they plan to take legal action against CrowdStrike after incurring a $500m loss 6 minute video interview: https://www.cnbc.com/2024/07/31/delta-ceo-crowdstrike-microsoft-outage-cost-the-airline-500-million.html CrowdStrike shareholders are suing CrowdStrike https://www.bbc.com/news/articles/cy08ljxndr4o CrowdStrike made a net loss of $845m between 2018 until this year, and has taken on $743m of debt during this period. Spirit Airlines in the US anticipates a $7.2 million hit to its third-quarter operating income due to operational disruptions caused by the CrowdStrike incident, which forced the carrier to cancel 470 flights. Here's the Delta boss on his thoughts about the CrowdStrike incident. They had 40k Windows Server boxes alone, all with BitLocker full disk encryption enabled, all of which wouldn't boot and weren't fixable without manually unlocking BitLocker. That had gone all in with CrowdStrike + Microsoft's most premium offerings. He has a really good point about how tech companies have become obsessed with growth as their only metric of success, and customer satisfaction is not on the radar. There's a really mad moment in that interview where they ask them what assistance CrowdStrike have offered, and he essentially says nothing, not even a lunch voucher. What a time to be alive. CrowdStrike complained to Cloudflare about a CrowdStrike parody site… and Cloudflare took it down. Without a court order. https://clownstrike.lol/crowdmad/ Cloudflare recently announced they have become a strategic partner with CrowdStrike: https://www.cloudflare.com/en-gb/press-releases/2024/crowdstrike-and-cloudflare-announce-expanded-strategic-partnership-to-secure/ Additionally to loop this in, CrowdStrike submitted a takedown for a parody label (they’ve since rescinded it after being called out). We’ve reached the part of the brand cycle where people are using CrowdStrike as an excuse https://www.theverge.com/2024/8/2/24212298/mrbeast-beast-games-crowdstrike Previously on Crowdstrike Falcon vulnerability research, check out this timeline where they tried to use NDAs to avoid disclosure, then fixed it without telling anybody. https://modzero.com/modlog/archives/2022/08/22/ridiculous_vulnerability_disclosure_process_with_crowdstrike_falcon_sensor/index.html  @GossiTheDog I had a similar experience with Microsoft. A junior colleague found a 1-click exploit in Skype for Linux. We reported it. We didn't want any bounty money - just to be assigned a CVE that we could include in our paper. Microsoft's response was essentially "it's not an RCE, go away". Then they silently fixed it, without crediting us. Never every doing the "responsible disclosure" dance with Microsoft ever again. |
The US Department of Transport has opened an investigation into Delta over the disruption related to CrowdStrike incident.
Good luck to the CrowdStrike account manager for Delta.