Because defender will not spot that you have an outdated copy of the Struts library in your Apache installation, or that a adobe reader install has a known vulnerability etc. The attack surface is *way* bigger than just the OS. It does not matter how well the OS is patched, if an outdated web browser gives an attacker shell access via a compromised web page or malicious spreadsheet.
Worth keeping in mind, this is not a windows specific problem... in fact crowdstrike have managed to bork a number of linux platforms relatively recently!
It seems like it was just file of 0 bytes. They accessed a data structure in the file that should have have located information elsewhere in it, and due to a complete failure to validate said file first, ended up dereferencing a null pointer causing an access violation. Not normally a show stopper unless you are running in the kernel at the time!
How that design in the driver got through QA in the in the first place is astonishing, and how they failed to test the update well enough before general release, even more so!
Arguably you can even blame the EU for some of this! MS had proposed a new API that would allow security vendors to do what they need to do without needing kernel code to do it. Apple provides a similar API on Mac, and croudstrike updated their code to use that for their mac implementation of Falcon. However the EU blocked MS from implementing what they wanted on the grounds that it was "anti competitive" and gave them monopoly control on the low level access required to implement security endpoint applications.
OK - thanks. Apple used to allow kernel extensions but they seem in recent years to have forbidden that in macOS. So Oracle had to rework VirtualBox to no longer do that.
+1 on that., Very informative
Agreed. I'm surprised that no one at MicroSoft picked up this possible failure mode. But then I suppose the FBI didn't pick up that someone wanting to learn how to fly a big jet while not being interested in the takeoff and landing aspects might be a big clue.
"What causes poverty?" Wrong question. Poverty is our primordial state. The real question is, "What causes wealth?"
Hint: it ain't Socialism.
'Throughout history, poverty is the normal condition of man. Advances which permit this norm to be exceeded — here and there, now and then — are the work of an extremely small minority, frequently despised, often condemned, and almost always opposed by all right-thinking people. Whenever this tiny minority is kept from creating, or (as sometimes happens) is driven out of a society, the people then slip back into abject poverty.
'This is known as "bad luck.”'
R A Heinlein
We've seen this movie before
When I }rst heard about this catastrophe (and I am not misusing that word, I assure you), I thought it sounded familiar. On Reddit's Sysadmin Subreddit, user u/externedguy reminded me why. Maybe you remember this story from 14 years ago: "Defective McAfee update causes worldwide meltdown of XP PCs." Oops, they did it again. At 6AM today, McAfee released an update to its antivirus de}nitions for corporate customers that had a slight problem. And by "slight problem," I mean the kind that renders a PC useless until tech support shows up to repair the damage manually. As I commented on Twitter earlier today, I'm not sure any virus writer has ever developed a piece of malware that shut down as many machines as quickly as McAfee did today. In that case, McAfee had delivered a faulty virus de}nition (DAT) }le to PCs running Windows XP. That }le falsely detected a crucial Windows system }le, Svchost.exe, as a virus and deleted it. The result, according to a contemporary report, is that "azected systems will enter a reboot loop and [lose] all network access. " The parallels between that 2010 incident and this year's CrowdStrike outage are uncanny. At its core was a defective update.
Yup, and crowdstrike re-wrote their mac client to run in user mode and use their new API that allows access to the kinds of facilities that used to require kernel mode.
The 2010 timing was particularly unfortunate for McAfee. Intel had announced its intention to acquire McAfee, Inc. for $7.68 billion on April
19, 2010. The defective DAT file was released two days later, on April 21. That 2010 McAfee screw-up was a big deal, kneecapping Fortune 500 companies (including Intel!) as well as universities and government/military deployments worldwide. It knocked 10% of the cash registers at Australia's largest grocery chain o|ine, forcing the closure of 14-18 stores. And in 'the You Can't Make This Up Department' CrowdStrike's founder and CEO, George Kurtz, was McAfee's Chief Technology Officer during that 2010 incident.
Yes, the parallels are uncanny - the same guy that is in charge at Crowdstrike was also in charge at McAfee back then!
Just seen some more details on the config file issue. Apparently it was not *all* zeros, just had some erroneous sections in it. It also sounds like said "config" file also includes some code in it (compiled into an intermediate "P code"), that is then run by an interpreter built into the kernel mode driver.
Which is probably worse than first thought, since even if the kernel mode driver validate the format of the file, it would likely have functionality in there that could not easily be properly validated with a static analysis of the content.
Well quite. But then I'm minded to wonder what MS is doing allowing themselves to validate such things. I mean, everybody seems to be grasping that this is a dangerous approach.
Because they've made it difficult to load drivers not signed by them.
I think the attitude of MS (and others) is that it's the customer who takes the risks of a casual attitude to security, not the software vendor, since there is no warranty of any kind offered.
Even in other areas of life, where warranties exist, they offer no compensation for consequential damage, nor should they.
'What were they thinking of?' is a question which often comes to mind when there is no penalty for incompetence, or indeed, negligence. MS is, after all, fairly safe from any possibility of boycott, though I suspect CrowdStrike isn't.
It's all very well saying that. But how many customers have the knowledge to evaluate the risks? It should not be necessary to run the CrowdStrike offering in the kernel. We seem to be back in the 1850s in terms of safety, when people in factories were just told not to go near those unprotected belt-driven pulleys that could take your arm off if it got caught in the works - rather than encasing the drive belt and pulleys.
It is necessary. It has to be able to do things in memory spaces inaccessible to a user process
We seem to be back in the 1850s in terms of safety, when people
Crowstrike isnt a bad idea, its just sloppy quality control
Sounds like it's time for a different OS architecture which has perhaps several security levels.
THe x86 archirecture supports four levels, but I don't think MS use them all.
Some mainframe hardware has 16.
Have something to add? Share your thoughts — no account required.
Ask the community — no account required