WELLINGTON, New Zealand (AP) â A widespread Microsoft outage disrupted flights, banks, media outlets and companies around the world on Friday.Nothing to do with Microsoft. CrowdStrike is not a Microsoft company.
https://apnews.com/article/microsoft-crowdstrike-outage-australia- internet-banks-media-0a5f792b6571b37a35181d64028fefc4
WELLINGTON, New Zealand (AP) â A widespread
...
An X user posted a screenshot of an alert from the company Crowdstrike
that said the company was aware of âreports of crashes on Windows hostsâ related to its Falcon Sensor platform. ... Crowdstrike did not
respond to a request for comment.
Nothing to do with Microsoft.
CrowdStrike is not a Microsoft company.
Andy Burns <usenet@andyburns.uk> wrote:
Editor wrote:
Nothing to do with Microsoft.
Except Microsoft's services
The MS services affected were ones provided by a corporation who also had deployed crowdstrike.
were affected because their backends were
affected by crowdstrike ...
What does that say about microsoft's own threat and vulnerability
tracking products, that they use someone else's?
Nothing? Windows doesn't solve all corporate needs. That's why there's an active and necessary third party ecosystem.
On 2024-07-20 16:43, Chris wrote:
Andy Burns <usenet@andyburns.uk> wrote:
Editor wrote:
Nothing to do with Microsoft.
Except Microsoft's services
The MS services affected were ones provided by a corporation who also had
deployed crowdstrike.
were affected because their backends were
affected by crowdstrike ...
What does that say about microsoft's own threat and vulnerability
tracking products, that they use someone else's?
Nothing? Windows doesn't solve all corporate needs. That's why there's an
active and necessary third party ecosystem.
The fact that a piece of third party software could brick a Windows system isn't really very great.
On 7/20/2024 8:40 PM, Alan wrote:
On 2024-07-20 16:43, Chris wrote:
Andy Burns <usenet@andyburns.uk> wrote:
Editor wrote:
Nothing to do with Microsoft.
Except Microsoft's services
The MS services affected were ones provided by a corporation who also had >>> deployed crowdstrike.
were affected because their backends were
affected by crowdstrike ...
What does that say about microsoft's own threat and vulnerability
tracking products, that they use someone else's?
Nothing? Windows doesn't solve all corporate needs. That's why there's an >>> active and necessary third party ecosystem.
The fact that a piece of third party software could brick a Windows system isn't really very great.
If the software is by a white hat, you sign and attest it, and
then it will pass whatever checks you use to "judge" the
integrity of pieces of software. You're either inside the fence,
or you're outside the fence.
Andy Burns <usenet@andyburns.uk> wrote:<https://portal.office.com/adminportal/home#/servicehealth/history/:/alerts/MO821132>
Editor wrote:
Nothing to do with Microsoft.
Except Microsoft's services
The MS services affected were ones provided by a corporation who also had deployed crowdstrike.
Nothing to do with Microsoft. CrowdStrike is not a Microsoft company.
On 2024-07-20 20:19, Paul wrote:
On 7/20/2024 8:40 PM, Alan wrote:
On 2024-07-20 16:43, Chris wrote:
Andy Burns <usenet@andyburns.uk> wrote:
Editor wrote:
Nothing to do with Microsoft.
Except Microsoft's services
The MS services affected were ones provided by a corporation who also had >>>> deployed crowdstrike.
were affected because their backends were
affected by crowdstrike ...
What does that say about microsoft's own threat and vulnerability
tracking products, that they use someone else's?
Nothing? Windows doesn't solve all corporate needs. That's why there's an >>>> active and necessary third party ecosystem.
The fact that a piece of third party software could brick a Windows system isn't really very great.
If the software is by a white hat, you sign and attest it, and
then it will pass whatever checks you use to "judge" the
integrity of pieces of software. You're either inside the fence,
or you're outside the fence.
Sorry, but it's not that simple.
Even signed software should be killed when it tries to access a privileged memory address.
Even signed software should be killed when it tries to access a privileged memory address.
https://www.techrepublic.com/article/crowdstrikes-security-software-targets-bad-guys-not-their-malware/
"On the detection front, we need world-class, host-based detection;
something that operates at the kernel level and detects the
most sophisticated attacks," mentions Brian Kelly, CSO for Rackspace.
"That is where CrowdStrike shines."
Aiming for the bad actors, not their malware...
"
Windows only uses two Rings. The non-privileged level (Ring 3) is where applications
run. Those are the things that have rules applied to them.
On 7/20/2024 12:30 AM, Editor wrote:
Nothing to do with Microsoft. CrowdStrike is not a Microsoft company.
 True. The primary lesson from this is that so-called
Agile programming and drip-feed updates are a basic system
integrity problem. But people have been convinced that
dripfeed means secure, shiny and new.
 I haven't seen a single tech media wiseacre question why an
AV driver was being swapped out as a passive dripfeed update
in the first place. Probably hundreds of companies, including MS,
are routinely usong their customers as unpaid beta testers. With
an MS Office update the IT people will at least test it themselves
before they distribute it "across the enterprise". But there's
increasing dripfeed going on even in IT-supervised companies.
 This one wasn't Microsoft's fault, but it just as well could
have been. MS have also instigated dripfeed updates and
plenty of problems have happened:
https://www.pcworld.com/article/2249204/microsoft-confirms-broken-windows-11-update-offers-workaround.html
 But now people have been conditioned to believe that if they
turn off the seat-of-the-pants update faucet then they'll be
instantly attacked by malware. (There are questions posted
regularly on Reddit about what to do with Win10 computers
after October 2025, as though any computer without the latest
dripfeed will turn into a pumpkin.)
Alan <nuh-uh@nope.com> wrote:
On 2024-07-20 16:43, Chris wrote:
Andy Burns <usenet@andyburns.uk> wrote:
Editor wrote:
Nothing to do with Microsoft.
Except Microsoft's services
The MS services affected were ones provided by a corporation who also had >>> deployed crowdstrike.
were affected because their backends were
affected by crowdstrike ...
What does that say about microsoft's own threat and vulnerability
tracking products, that they use someone else's?
Nothing? Windows doesn't solve all corporate needs. That's why there's an >>> active and necessary third party ecosystem.
The fact that a piece of third party software could brick a Windows
system isn't really very great.
It's not just some desktop application. By necessity it is a pretty
low-level service so if goes rogue can be damaging. Although, I do get your point. I wonder if something like the Mac's SIP would have saved the situation?
On 21/07/2024 12:58, Newyana2 wrote:
On 7/20/2024 12:30 AM, Editor wrote:
Nothing to do with Microsoft. CrowdStrike is not a Microsoft company.
ĂÂ True. The primary lesson from this is that so-called
Agile programming and drip-feed updates are a basic system
integrity problem. But people have been convinced that
dripfeed means secure, shiny and new.
ĂÂ I haven't seen a single tech media wiseacre question why an
AV driver was being swapped out as a passive dripfeed update
in the first place. Probably hundreds of companies, including MS,
are routinely usong their customers as unpaid beta testers. With
an MS Office update the IT people will at least test it themselves
before they distribute it "across the enterprise". But there's
increasing dripfeed going on even in IT-supervised companies.
ĂÂ This one wasn't Microsoft's fault, but it just as well could
have been. MS have also instigated dripfeed updates and
plenty of problems have happened:
https://www.pcworld.com/article/2249204/microsoft-confirms-broken-windows-11-update-offers-workaround.html
ĂÂ But now people have been conditioned to believe that if they
turn off the seat-of-the-pants update faucet then they'll be
instantly attacked by malware. (There are questions posted
regularly on Reddit about what to do with Win10 computers
after October 2025, as though any computer without the latest
dripfeed will turn into a pumpkin.)
CrowdStrike made a very simple error of judgement. Normally, when
updates are released, they are done in a controlled manner. This means
that updates are offered to a selection few customers in a particular geographical area. For whatever reasons, CrowdStrike decided to update everybody and this resulted a meltdown. They tried to blame Microsoft
first but Microsoft retaliated by stopping their servers.
With VPS, users are responsible for their own servers and in this case CrowdStrike were responsible for the misconfiguration of their server or servers. These servers are hosted on Microsoft Azure so everybody
started blaming Microsoft. I have a VPS server on Azure but it is my responsibility for it. I can do whatever I want as long as it is legal
and Microsoft won't touch it. The only time Microsoft gets involved is
when I can't resolve something and so Microsoft will handle it and
charge me for the service.
Microsoft doesn't get involved with Customers servers. They don't even
do backups as far as I know. I do my own backups once a week because I
don't have anything useful going on. Just a simple Joomla website which changes once in a blue moon!!
On 2024-07-20 20:19, Paul wrote:
On 7/20/2024 8:40 PM, Alan wrote:
On 2024-07-20 16:43, Chris wrote:
Andy Burns <usenet@andyburns.uk> wrote:
Editor wrote:
Nothing to do with Microsoft.
Except Microsoft's services
The MS services affected were ones provided by a corporation who also had >>>> deployed crowdstrike.
were affected because their backends were
affected by crowdstrike ...
What does that say about microsoft's own threat and vulnerability
tracking products, that they use someone else's?
Nothing? Windows doesn't solve all corporate needs. That's why there's an >>>> active and necessary third party ecosystem.
The fact that a piece of third party software could brick a Windows system isn't really very great.
If the software is by a white hat, you sign and attest it, and
then it will pass whatever checks you use to "judge" the
integrity of pieces of software. You're either inside the fence,
or you're outside the fence.
Sorry, but it's not that simple.
Even signed software should be killed when it tries to access a privileged memory address.
Microsoft does play a part.
The WHQL lab "approved" the driver level code that runs in
Ring0, knowing the details of the attack surface such an
approach would bring.
Paul wrote:
Microsoft does play a part.
The WHQL lab "approved" the driver level code that runs in
Ring0, knowing the details of the attack surface such an
approach would bring.
And further than that, the crowdstrike driver is marked as a boot-start driver, so if it fails to load, the machine won't continue.
3. Question; how many other companies have similar privileged access?
That's very worrying.
1. Crowdstrike are fully licensed to issue updates into crucial areas of Windows.
2. MS don't do their own validation.
3. Question; how many other companies have similar privileged access?
Notable in all this is that all these failedif you want to catch 0-day malware, you can't wait a week while your IT
computers were set up to allow CrowdStrike to do as they liked
without notice. Why are regular driver updates required? What sort
of IT people are allowing this and why aren't they being looked at?
It really much simpler than all that's being discussed.
Crowdstrike made their device driver files ârequired for bootâ, to prevent any external process from doing what people are describing and/or now trying to do.
Newyana2 wrote:
Notable in all this is that all these failedif you want to catch 0-day malware, you can't wait a week while your IT
computers were set up to allow CrowdStrike to do as they liked
without notice. Why are regular driver updates required? What sort
of IT people are allowing this and why aren't they being looked at?
dept test definition updates several times per day
"I don't test very often, but when I do, I test in Production" :-)
Newyana2 wrote:
On 7/22/2024 10:57 AM, Ed Cryer wrote:
3. Question; how many other companies have similar privileged access?
Anyone who you allow. Notable in all this is that all these failed
computers were set up to allow CrowdStrike to do as they liked
without notice. Why are regular driver updates required? What sort
of IT people are allowing this and why aren't they being looked at?
Microsoft and others have also caused big problems in the past.
Maybe not so clearly obvious in terms of commercial products
like airlines failing, but buggy updates are nothing new.
You might be surprised at how many developers have no idea
how their software runs or what it requires. That's why MS started
locking down system files. People would install any old thing with
no understanding of versions or dependencies. Even Microsoft have
done that. There was a notable case at one time with the richedit
library that's used in Write, Wordpad and a lot of 3rd-party software.
At one time there were 3 versions that all had the same file name
and version. Only the file size varied! Installing the wrong one could
mess up a system. Very few developers know anything about those
issues. They depend on their installer tools to sort it out.
Into that scenario then came the idea of spyware telemetry as
routine and calling home for dripfeed updates. You might have dozens
of programs running dripfeed updates without asking. Why? Especially
with drivers. That's crazy. If there's no problem then why fix it?
Because it's the latest fad. It's preparing the public for rental
software
by taking control away from the person who actually uses the software.
It's also satisfying the popular preconception that newer is better and
more newer is more better. That's how we got the totally indefensible
idea of agile programming. Look at the people in the Firefox newsgroup
who can't wait to get the latest version. Why? These are tech-literate
people, yet they've fallen for the idiocy that all software should update
as much as possible.
Updates used to be mainly to add new features. Testing usually
resulted
in solid software. For example, I still use Paint Shop Pro 5 from
1999. There
was one update 5.01 and I think there was an update 5.03. As I recall it
was to deal with some issue with ZIP drives. It's still stable 25
years later.
(I also have PSP 16, but that's a bloated mess put out by Corel, with no
notable improvements.)
We don't even know what's changed in the latest version of most
software. Concurrent with this seat-of-the-pants manic updating has been
a trend to obscure what, if anything, is in the latest update. I
personally
avoid updating anything until there's been time for reviews and info.
Most
big corporations do the same. They test out updates before installing
across
the "fleet" of computers. SOHo users are now serving as unpaid beta
testers, effectively unable to stop Windows dripfeed updates and
largely unaware of
3rd-party updates.
Long story short, if you're not using a firewall and blocking all
this traffic,
disabling updates that you haven't specifically needed and instigated,
then
your computer probably has all sorts of entities coming and going --
spying,
installing updates, etc, without telling you. But the airline IT
people should
have known better.
Comically, I was reading that Southwest escaped the problems because
they're still running a combination of Win 3.1 and 95. :)
I've read lots of people criticising "They shouldn't have allowed
automatic updates; they certainly shouldn't have allowed driver updates".
But what if both of those were in the negative; and savvy people looked
at the update list, saw one from a respected security co. relevant to
their systems, and just simply ticked "install". That's a responsible approach. What should they have done other than that, when so many
experts are constantly battering into their ears "Install updates"?
A possible outcome could have been that just hours after NOT installing
the update their systems were infiltrated and compromised.
Some poor sap of a programmer working for Cloudstrike will have taken
the fall for this. But he had an open doorway into Windows, allowed by
his superiors and woe betide him if he didn't do it.
Some poor sap of a programmer working for Cloudstrike will have taken
the fall for this. But he had an open doorway into Windows, allowed by
his superiors and woe betide him if he didn't do it.
On 7/22/2024 6:57 PM, Paul wrote:
"I don't test very often, but when I do, I test in Production" :-)
I hadn't realized how reckless software development has become.
Agile programming. Testing in production. TIP should be what focus
groups are for, BEFORE the code is written. Yet I see both methods propagandized as the latest improvement in software. It's seems to
be basically Zuck's MO: Move fast and break things. There's an
interesting philosophical preconception embedded in that thinking,
which is the assumption that new is by definition better. Whatever the product is, it must be changed and it must be changed soon, as a
matter of principle. Change masquerading as quality control.
none
of that explains why anyone is allowing a system-critical driver to be updated automatically.
On Mon, 22 Jul 2024 19:03:53 +0100, Ed Cryer <ed@somewhere.in.the.uk>
wrote:
Some poor sap of a programmer working for Cloudstrike will have taken
the fall for this. But he had an open doorway into Windows, allowed by
his superiors and woe betide him if he didn't do it.
But surely that poor sap of a programmer, or someone else at
Crowdstrike, was responsible for testing it before it went out?
On 7/22/2024 1:04 PM, Andy Burns wrote:
Newyana2 wrote:
Notable in all this is that all these failedif you want to catch 0-day malware, you can't wait a week while your IT dept test definition updates several times per day
computers were set up to allow CrowdStrike to do as they liked
without notice. Why are regular driver updates required? What sort
of IT people are allowing this and why aren't they being looked at?
They're not going to catch o-days by definition. Of course there's something to be said for frequent AV updates, but there are also
problems. The whole idea of virus definitions is out of date. And none
of that explains why anyone is allowing a system-critical driver to be updated automatically.
On 23/07/2024 01:03, Newyana2 wrote:
none
of that explains why anyone is allowing a system-critical driver to be
updated automatically.
It's not the driver being updated, it's definition files used by the
driver, and which it apparently doesn't validate well enough, since the definitions can segfault the driver.
On 7/22/2024 8:03 PM, Newyana2 wrote:
On 7/22/2024 1:04 PM, Andy Burns wrote:
Newyana2 wrote:
Notable in all this is that all these failedif you want to catch 0-day malware, you can't wait a week while your IT dept test definition updates several times per day
computers were set up to allow CrowdStrike to do as they liked
without notice. Why are regular driver updates required? What sort
of IT people are allowing this and why aren't they being looked at?
They're not going to catch o-days by definition. Of course there's
something to be said for frequent AV updates, but there are also
problems. The whole idea of virus definitions is out of date. And none
of that explains why anyone is allowing a system-critical driver to be
updated automatically.
It needs to be tested.
Just for the record, I tested the shit outta stuff at work,
and what I learned, is you can't test quality into something.
Not on computers. Test is a crutch. Test is nice. But test
is not an answer. You can spend a buck fifty on it, or you
can spend ten billion, and the results are the same. For
ten billion, you get a T-shirt.
If you design quality into something, make it so "it can't fail",
that happens to be "cheaper than test". For example, one of
our engineers, the only engineer at work to wear a suit (!!!),
he had a bench in the lab all to himself, and there was a
computer he designed running long term test. It had the
"don't touch" sheet of typing paper taped to it, and it
was doing a long term stability test (it ran for at least a year).
But really, let's be honest, it was a "my shit doesn't stink" statue.
And I thought that was pretty cool. It never occurred to me to build
a statue like that. Because "my shit stinks, when it needs to stink".
And this is why we test. I never trust hardware enough, to build
a statue from it.
Paul
what does it mean to say a config file is determining API
calls? Who knows.
Newyana2 wrote:
what does it mean to say a config file is determining API
calls? Who knows.
Some form of p-code?
For this group, for the most part its just complaining about someone elses predicament. Even though true, few, if any at all, were impacted.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 491 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 146:46:19 |
| Calls: | 9,694 |
| Calls today: | 4 |
| Files: | 13,731 |
| Messages: | 6,178,588 |