This is why you do staged rollouts of updates... not the entire planet at once.
And don't have automatic updates enabled for critical infrastructure.
So true, this really highlights the risk of updates impacting critical systems vs critical systems being exposed to critical vulnerabilities. Its a real balancing act.
It actually highlights the risk of having unaudited third party software running on your critical infrastructure
I don't know exactly how crowd strike works, but this sounded like a "virus signatures" update (IE not a software update per se). And thats what caused the issue.
I think "real time virus protection" is why people use it so they expect the signatures to get updated asap/with little to no human intervention.
This is a crowd strike epic fail...for how they let their software blue screen systems with a virus signature update.
No, you run Linux with automatic secutity updates turned on
Can someone in non marketing terms explain what the fuck CrowdStrike Falcon Sensor is? I literally never heard of this company or product before.
It's basically corporate anti-virus software. Intended to detect and prevent malware.
Apparently it's the next iteration of AI based antivirus where it uses smart algorithms to detect system behaviours and makes assessments on whether they're malicious or not
Apparently it's the next iteration of AI based antivirus
CrowdskyStrikenet
I know there is a lot of marketing fluff, but yes, it is an EDR. Which means instead of just checking file signatures against a database if known bad stuff, it actually examines what applications do and makes a sort of judgement on if it is acting maliciously or not. I use a similar product. Although the false positives can sometimes be baffling, it honestly can catch a legit program misbehaving.
On top of that, everything is logged. Every file, network connection, or registry key that every process on the computer touches is logged. That means when something happens, you can see the full and complete list of actions taken by the malicious system. Thus can actually be a drain on the computer, but modern systems handle it well enough.
What do you use? I’d be interested in that sort of thing
SentinelOne. They are more reseller/MSP friendly, but the product is very similar to CrowdStrike.
We also use S1 and while it does often flag false positives, that's a whole heck of a lot better than the alternative. Also I have not noticed it being very resource intensive.
It's overhead is more subtle than task manager can tell. Because of all its watching and monitoring, it slows down applications themselves. Task take longer. Sometime it is by a trivial amount, but I've been able to measure a notable difference in some task with and without S1, even if task manager says all is well.
obviously, A.I consider microsoft as a malicious software. Sometimes, A.I is very accurate 😁
Is it less expensive than ransomware though?
Yes
By a wide margin
Ransomware you have to pay $10,000 every few years. Crowdstrike you have to pay $1,000 per month. Same number of outages for both. /s
Add some extra zeroes to that ransomware figure...
Can you tell whether this update was delivered by Crowdstrike's own update delivery pipeline of via Window's update pipeline?
Absolutely nothing to do with windows pipelines or Microsoft
Okay, thanks. There was a parallel Microsoft outage, so I thought they were somehow linked.
Crowdstrike updates don't come through Windows Update.
It checks for malicious falcons in your system's level 4 aviary cache.
Ha ha! Well done!
I work in QA on the night shift at a video game company. It was absolute chaos at work tonight lmao we only had a grand total of 6 working PCs between all of us
Company spyware. We have that on our devices. They used to have an “about” stored locally on the app, but removed it and a web connection is required to view the docs. Basically says it downloads/sees everything on your device and checks for threats. Thing is a few people have been fired for having things in their devices they shouldn’t. I didn’t ask what it was, nor did I hear how these things were “threats”, but nonetheless they were fired. Too many people treat company hardware like “free device, bro!” and put all sorts of personal stuff on the device. Most industries it’s probably not too big of a deal, but for mine if there’s an incident that happens when you were busy watching Netflix or something instead of doing your job you’re fucked. First thing they’ll do is check your device and crowdstrike to see what you were doing, and even if you weren't watching Netflix all your personal data will be exposed.
They definitely could, but most cybersecurity departments are paid too much to worry about minor items like that. If HR tells us to look into a specific user and gets the proper approvals so that everything is in compliance, we'll definitely get someone on the team to do it, but otherwise if we happen to see evidence of unapproved usage, we're mostly going to overlook it unless it could lead to something dangerous to your machine or the company as a whole.
EDRs like Crowdstrike can see very very nearly everything you do though, definitely everything you would care about.
Yikes. I feel sorry for all the help desk and support staff that has to deal with this chaotic mess all day.
On a Friday !
What kind of criminally incompetent psychopath rolls out a global update on a fucking Friday afternoon?
Is the CEO of CrowdStrike Satan?
They push updates every day. Attackers don't take Fridays off.
I have heard that Friday afternoon can be better because it gives you a full weekend to put out any fires before business hours start again.
That's assuming it's a small error that doesn't roll on into the week anyway.
They'll need that beer.
Yup, my phone is nonstop going off with slack messages and tickets. Time to mute it for now
What a striking name... CrowdStrike heh. They definitely live up to it!
More like CrashStrike
Ca-caw!
Looking forward to the Kevin Fang video in a few years.
Crowstrike Onstrike
Crowd Strike's Final Fantasy
So cool
That’s a shame.
This is a most excellent place for technology news and articles.
