Comment

Comment on CrowdStrike Isn't the Real Problem

breakingcups@lemmy.world ⁨3⁩ ⁨months⁩ ago

Please, enlighten me how you’d remotely service a few thousand Bitlocker-locked machines, that won’t boot far enough to get an internet connection, with non-tech-savvy users behind them. Pray tell what common “basic hygiene” practices would’ve helped, especially with Crowdstrike reportedly ignoring and bypassing the rollout policies set by their customers.

Not saying the rest of your post is wrong, but this stood out as easily glossed over.

source

Sort:hotnew top

ramble81@lemm.ee ⁨3⁩ ⁨months⁩ ago
You’d have to have something even lower level like a OOB KVM on every workstation which would be stupid expensive for the ROI, or something at the UEFI layer that could potentially introduce more security holes.

source
- Leeks@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Maybe they should offer a real time patcher for the security vulnerabilities in the OOB KVM, I know a great vulnerability database offered by a company that does this for a lot of systems world wide! /s
  
  source
  - A_A@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Lol 😋 ! also i need a “Out-of-Band, Keyboard, Video, and Mouse” to your “OOB, KVM” so to ~~steal the bank~~ improve security.
    
    source
    Leeks@lemmy.world ⁨3⁩ ⁨months⁩ ago
    “It’s turtles all the way down”.
    
    source
- circuscritic@lemmy.ca ⁨3⁩ ⁨months⁩ ago
  …you don’t have OOB on every single networked device and terminal? Have you never heard of the buddy system?
  
  source
- timewarp@lemmy.world ⁨3⁩ ⁨months⁩ ago
  UEFI isn’t going away. Sorry to break the news to you.
  
  source
  - ramble81@lemm.ee ⁨3⁩ ⁨months⁩ ago
    I didn’t say it was, nor did I say UEFI was the problem. My point was additional applications or extensions at the UEFI layer increase the attack footprint of a system. Just like vPro, you’re giving hackers a method that can compromise a system below the OS. And add that in to laptops and computers that get plugged in random places before VPNs and other security software is loaded and you have a nice recipe for hidden spyware and such.
    
    source
- Brkdncr@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Vpro is usually $20 per machine and offers oob kvm.
  
  source
LrdThndr@lemmy.world ⁨3⁩ ⁨months⁩ ago
A decade ago I worked for a regional chain of gyms with locations in 4 states.

I was in TN. When a system would go down in SC or NC, we originally had three options:

(The most common) have them put it in a box and ship it to me.

I go there and fix it (rare)

I walk them through fixing it over the phone (fuck my life)

I got sick of this. So I researched options and found an open source software solution called FOG. I ran a server in our office and had little optiplex 160s running a software client that I shipped to each club. Then each climber at each club was configured to PXE boot from the fog client.

If everything was okay, it would chain the boot to the os on the machine. But I could flag a machine for primate and at next boot, the machine would check in with PXE and get a complete reimage from premade images on the fog server.

So yes, I could completely reimage a computer from hundreds of miles away by clicking a few checkboxes on my computer.

This was free software. It saved us thousands in shipping fees alone.

There ARE options out there.
source
- magikmw@lemm.ee ⁨3⁩ ⁨months⁩ ago
  This worksbgreat for stationary pcs and local servers, does nothing for public internet connected laptops in hands of users.
  
  The only fix here is staggered and tested updates, and apparently this update bypassed even deffered update settings that crowdstrike themselves put into their software.
  
  The only winning move here was to not use crowdstrike.
  
  source
  - wizardbeard@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago
    It also assumes that reimaging is always an option.
    
    Yes, every company should have networked storage enforced specifically for issues like this, so no user data would be lost, but there’s often a gap between should and “has been able to find the time and get the required business side buy in to make it happen”.
    
    Also, users constantly find new ways to do non-standard, non-supported things with business critical data.
    
    source
    Bluetreefrog@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Isn’t this just more of what caused the problem in the first place? Namely, centralisation. If you store data locally and you lose a machine, that’s bad but not the end of the world. If you store it centrally and you lose the data, that’s catastrophic. Nassim Taleb nailed this stuff. Keep the downside limited, and the upside unlimited or as he says, “Don’t pick up pennies in front of a steamroller.”
    
    source
  - LrdThndr@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Absolutely. 100%
    
    But don’t let perfect be the enemy of good. A fix that gets you 40% of the way there is still 40% less work you have to do by hand. Not everything has to be a fix for all situations. There’s no such thing as a panacea.
    
    source
    magikmw@lemm.ee ⁨3⁩ ⁨months⁩ ago
    Sure. At the same time one needs to manage resources.
    
    I was all in on laptop deployment automation. It cut down on a lot of human error issues and having inconsistent configuration popping up all the time.
    
    But it needs constant supervision, even if not constant updates. More systems and solutions lead to neglect if not supplied well. So some “would be good to have” systems just never make the cut, because as overachieving I am, I’m also don’t want to think everything is taken care of when it clearly isn’t.
    
    source
    -> View More Comments
  - timewarp@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Almost all computers can be set to PXE boot, but work laptops usually even have more advanced remote management capabilities. You ask the employee to reboot the laptop and presto!
    
    source
    magikmw@lemm.ee ⁨3⁩ ⁨months⁩ ago
    I wonder how you’re supposed to get PXE boot to work securely over the internet. And how that helps when affected disk is still encrypted and needs unusual intervention to fix, including admin access to system files.
    
    I’ve been doing this for a while, and I like creative solutions, so I wonder about those issues a lot. Not much comes to my mind besides let’s recall all the laptops and do it one by one.
    
    source
    -> View More Comments
- Brkdncr@lemmy.world ⁨3⁩ ⁨months⁩ ago
  How removed from IT are that you think fog would have helped here?
  
  source
  - LrdThndr@lemmy.world ⁨3⁩ ⁨months⁩ ago
    How would it not have? You got an office or field offices?
    
    “Bring your computer by and plug it in over there.” And flag it for reimage. Yeah. It’s gonna be slow, since you have 200 of the damn things running at once, but you really want to go and manually touch every computer in your org?
    
    The damn thing’s even boot looping, so you don’t even have to reboot it.
    
    I’m sure the user saved all their data in one drive like they were supposed to, right?
    
    I get it, it’s not a 100% fix rate. And it’s a bit of a callous answer to their data. And I don’t even know if the project is still being maintained.
    
    But the post I replied to was lamenting the lack of an option to remotely fix unbootable machines. This was an option to remotely fix nonbootable machines. No need to be a jerk about it.
    
    source
    Brkdncr@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Because your imaging environment would also be down. And you’re still touching each machine and bringing users into the office.
    
    Or your imaging process over the wan takes 3 hours since it’s dynamically installing apps and updates and not a static “gold” image. Imaging is then even slower because your source disk is only ssd and imaging slows down once you get 10+ going at once.
    
    I’m being rude because I see a lot of armchair sysadmins that don’t seem to understand the scale of the crowdstike outage, what crowdstrike even is beyond antivirus, and the workflow needed to recover from it.
    
    source
    -> View More Comments
- Evotech@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Now your fog servers are dead. What not
  
  source
- cyberpunk007@lemmy.ca ⁨3⁩ ⁨months⁩ ago
  This is a good solution for these types of scenarios. Doesn’t fit all though. Where I work, 85% of staff work from home. We largely use SaaS. I’m struggling to think of a good method here other than walking them through reinstalling windows on all their machines.
  
  source
  - timewarp@lemmy.world ⁨3⁩ ⁨months⁩ ago
    
    Configure PXE to reboot into recovery image, push out command to remove bad file. Reboot. Done.
    
    or
    
    Have recovery image already installed. Have user reboot & push key to boot into recovery. Push out fix. Done.
    
    source
    cyberpunk007@lemmy.ca ⁨3⁩ ⁨months⁩ ago
    I had no idea you could remotely configure pxe to reboot into a recovery image and run a script. How do you do this?
    
    source
    LrdThndr@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Fuck yeah. Even better than reimagine. That’s creative as fuck and I love it.
    
    source
  - LrdThndr@lemmy.world ⁨3⁩ ⁨months⁩ ago
    That’s still 15% less work though. If I had to manually fix 1000 computers, clicking a few buttons to automatically fix 150 of them sounds like a sweet-ass deal to me even if it’s not universal.
    
    You could also always commandeer a conference room or three and throw a switch on the table. “Bring in your laptop and go to conference room 3. Plug in using any available cable on the table and reboot your computer. Should be ready in an hour or so. There’s donuts and coffee in conference room 4.” Could knock out another few dozen.
    
    Won’t help for people across the country, but if they’re nearish, it’s not too bad.
    
    source
    cyberpunk007@lemmy.ca ⁨3⁩ ⁨months⁩ ago
    Not a lot of nearish. It would be pretty bad if this happened here.
    
    source
- timewarp@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Thank you for sharing this. This is what I’m talking about. Larger companies not utilizing something like this already are dysfunctional. There are no excuses for why it would take them days, weeks or longer.
  
  source
mynamesnotrick@lemmy.zip ⁨3⁩ ⁨months⁩ ago
Was a windows sysadmin for a decade. We had thousands of machines with endpoint management with bitlocker encryption. (I have sincd moved on to more of into cloud kubertes devops) Anything on a remote endpoint doesn’t have any basic “hygiene” solution that could remotely fix this mess automatically. I guess Intels bios remote connection (forget the name) could in theory allow at least some poor tech to remote in given there is internet connection and the company paid the xhorbant price.

All that to say, anything with end-user machines that don’t allow it to boot is a nightmare. And since bit locker it’s even more complicated. (Hope your bitloxker key synced… Lol).

source
- Spuddlesv2@lemmy.ca ⁨3⁩ ⁨months⁩ ago
  You’re thinking of Intel vPro. I imagine some of the Crowdstrike ~~victims~~ customers have this and a bunch of poor level 1 techs are slowly griding their way through every workstation on their networks. But yeah, OP is deluded and/or very inexperienced if they think this could have been mitigated on workstations through some magical “hygiene”.
  
  source
- LrdThndr@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Bro. PXE boot image servers. You can remotely image machines from hundreds of miles away with a few clicks and all it takes on the other end is a reboot.
  
  source
  - wizardbeard@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago
    With a few clicks and being connected to the company network. Leaving anyone not able to reach an office location SOL.
    
    source
    LrdThndr@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Hey, it’s not perfect, but a fix that gets you 10% of the way there is still 10% you don’t have to do by hand. Don’t let perfect be the enemy of good, my man.
    
    source
- Brkdncr@lemmy.world ⁨3⁩ ⁨months⁩ ago
  You’re thinking of AMT/vPro.
  
  source
Dran_Arcana@lemmy.world ⁨3⁩ ⁨months⁩ ago
Separate persistent data and operating system partitions, ensure that every local network has small pxe servers, vpned (wireguard, etc) to a cdn with your base OS deployment images, that validate images based on CA and checksum before delivering, and give every user the ability to pxe boot and redeploy the non-data partition.

Bitlocker keys for the OS partition are irrelevant, and keys for the data partition can be stored and passed via AD after the redeploy. If someone somehow deploys an image that isn’t ours, it won’t have keys to the data partition because it won’t have a trust relationship with AD.

(This is actually what I do at work)

source
- I_Miss_Daniel@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Sounds good, but can you trust an OS partition not to store things in %programdata% etc that should be encrypted?
  
  source
  - Dran_Arcana@lemmy.world ⁨3⁩ ⁨months⁩ ago
    With enough ~autism~ in your overlay configs, sure, but in my environment tat leakage is still encrypted. It’s far simpler to just accept leakage and encrypt the OS partition with a key that’s never stored anywhere. If it gets lost, you rebuild the system from pxe. (Which is fine, because it only takes about 20 minutes and no data we care about exists there) If it’s working correctly, the OS partition is still encrypted and protects any inadvertent data leakage from offline attacks.
    
    source
- Brkdncr@lemmy.world ⁨3⁩ ⁨months⁩ ago
  But your pxe boot server is down, your radius server providing vpn auth is down, your bitlocker keys are in AD which is down because all your domain controllers are down.
  
  source
  - Dran_Arcana@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Yes and no. In the best case, endpoints have enough cached data to get us through that process. In the worst case, that’s still a considerably smaller footprint to fix by hand before the rest of the infrastructure can fix itself.
    
    source
- Trainguyrom@reddthat.com ⁨3⁩ ⁨months⁩ ago
  
  Separate persistent data and operating system partitions, ensure that every local network has small pxe servers, vpned (wireguard, etc) to a cdn with your base OS deployment images, that validate images based on CA and checksum before delivering, and give every user the ability to pxe boot and redeploy the non-data partition.
  
  At that point why not just redirect the data partition to a network share with local caching? Seems like it would simplify this setup greatly (plus makes enabling shadow copy for all users stupid easy)
  
  source
  - Dran_Arcana@lemmy.world ⁨3⁩ ⁨months⁩ ago
    We do this in a lot of areas with fslogix where there is heavy persistent data, it just never felt necessary to do that for endpoints where the persistent data partition is not much more than user settings and caches of convenience. Anything that is important is never stored solely on the endpoints, but it is nice to be able to reboot those servers without affecting downstream endpoints. If we had everything locally dependant on fslogix, I’d have to schedule building-wide outages for patching.
    
    source
    Trainguyrom@reddthat.com ⁨3⁩ ⁨months⁩ ago
    I was more thinking in terms of Branch Cache but fslogix and other similar software definitely gives you more options as well
    
    source
- pHr34kY@lemmy.world ⁨3⁩ ⁨months⁩ ago
  I’ve been separating OS and data partitions since I was a kid running Windows 95. It’s horrifying that people don’t expect and prepare for machines to become unbootable on a regular basis.
  
  Hell, I bricked my work PC twice this year just by using the Windows cleanup tool - on Windows 11. The antivirus went nuclear, as antivirus products do.
  
  source
felbane@lemmy.world ⁨3⁩ ⁨months⁩ ago
Rollout policies are the answer, and CrowdStrike should be made an example of if they were truly overriding policies set by the customer.

It seems more likely to me that nobody was expecting “fingerprint update” to have the potential to completely brick a device, and so none of the affected IT departments were setting staged rollout policies in the first place. Or if they were, they weren’t adequately testing.

Then - after the fact - it’s easy to claim that rollout policies were ignored when there’s no way to prove it.

If there’s some evidence that CS was indeed bypassing policies to force their updates I’ll eat the egg on my face.

source
- originalucifer@moist.catsweat.com ⁨3⁩ ⁨months⁩ ago
  from what ive read/watched thats the crux of the issue.... did they push a 'content' update, i.e. signatures or did they push a code update.
  
  so you basically had a bunch of companies who absolutely do test all vendor code updates beings slipped a code update they werent aware of being labeled a 'content' update.
  
  source
- DesertCreosote@lemm.ee ⁨3⁩ ⁨months⁩ ago
  I’m one of the admins who manage CrowdStrike at my company.
  
  We have all automatic updates disabled, because when they were enabled (according to the CrowdStrike best practices guide they gave us), they pushed out a version with a bug that overwhelmed our domain servers. Now we test everything through multiple environments before things make it to production, with at least two weeks of testing before we move a version to the next environment.
  
  This was a channel file update, and per our TAM and account managers in our meeting after this happened, there’s no way to stop that file from being pushed, or to delay it. Supposedly they’ll be adding that functionality in now.
  
  source
lazynooblet@lazysoci.al ⁨3⁩ ⁨months⁩ ago
Autopilot, intune. Force restart device twice to get startup repair, choose factory reset, share LAPS admin password and let the workstation rebuild itself.

source
sp3tr4l@lemmy.zip ⁨3⁩ ⁨months⁩ ago
You are talking about how to fix the problem.

This person is talking about what caused the problem.

Completely different things.

Bad thing happened, how do we fix bad thing and its effects.

Analogous to: A house is on fire; call the ambulances to treat any wounded call the fire department, call insurance, figure out temporary housing.

Bad thing happened, but why did the bad thing happen and how to we prevent future occurrences of this?

Analogous to: Investigate the causes of the fire, suggest various safety regulations on natural gas infrastructure, home appliances, electrical wiring, building material and methods, etc.
source
riskable@programming.dev ⁨3⁩ ⁨months⁩ ago

what common “basic hygiene” practices would’ve helped

Not using a proprietary, unvetted, auto-updating, 3rd party kernel module in essential systems would be a good start.

Bank in the day companies used to insist upon access to the source code for such things along with regular 3rd party code audits but these days companies are cheap and lazy and don’t care as much. They’d rather just invest in “security incident insurance” and hope for the best 🤷

Sometimes they don’t even go that far and instead just insist upon useless indemnification clauses in software licenses. …and yes, they’re useless:

nolo.com/…/indemnification-provisions-contracts.h…).

(Important part indicating why they’re useless should be highlighted)

source
JasonDJ@lemmy.zip ⁨3⁩ ⁨months⁩ ago
Does Windows have a solid native way to remotely re-image a system like macOS does?

source
- lazynooblet@lazysoci.al ⁨3⁩ ⁨months⁩ ago
  Yes but it is licensed based and focused on business customers.
  
  source
- Brkdncr@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Yes.
  
  source
- catloaf@lemm.ee ⁨3⁩ ⁨months⁩ ago
  No.
  
  Maybe with Intune and Autopilot, but I haven’t used it.
  
  source
  - lazynooblet@lazysoci.al ⁨3⁩ ⁨months⁩ ago
    If you don’t know, don’t answer
    
    source
  - timewarp@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Windows ADK does this too, or any PXE server really… so yes, you can. The CS issue though didn’t require re-image. Merely removing a file. DR planning would usually have a recovery image pre-installed to automate booting into for lower-level fixes.
    
    source
Nomad@infosec.pub ⁨3⁩ ⁨months⁩ ago
It’s called EFI. How do you think your BIOS update from inside BIOS is working? ;)

source
timewarp@lemmy.world ⁨3⁩ ⁨months⁩ ago
I’d issue IPMI or remote management commands to reboot the machines. Then I’d boot into either a Linux recovery environment (yes, Linux can unlock BitLocker-encrypted drives) or a WinPE (or Windows RE) and unlock the drives, preferably already loaded on the drives, but could have them PXE boot - just giving ideas here, but ideal DR scenario would have an environment ready to load & PXE would cause delays.

I’d either push a command or script that would then remove the update file that caused the issue & then reboots. Having planned for a scenario like this already, total time to fix would be less than 2 hours.

source
- riskable@programming.dev ⁨3⁩ ⁨months⁩ ago
  At my company I use a virtual desktop and it was restored from a nightly snapshot a few hours before I logged in that day (and presumably, they also applied a post-restore temp fix). This action was performed on all the virtual desktops at the entire company and took approximately 30 minutes (though, probably like 4 hours to get the approval to run that command, LOL).
  
  It all took place before I even logged in that day. I was actually kind of impressed… We don’t usually act that fast.
  
  source
  - timewarp@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Somebody give those workers that had their shit together a raise, for real.
    
    source
SuperFola@programming.dev ⁨3⁩ ⁨months⁩ ago
Dual partitioning as Android does it might have helped. Install the update to partition B, reboot and if it’s alright swap A and B partitions to make B the default. Boot again to the default partition (A, formerly B).

It wouldn’t have booted correctly afaiu with the faulty update, and would have been reverted to use the untouched A partition.

source