• @chalupapocalypse@lemmy.world
    link
    fedilink
    994 months ago

    Management: Well we lost 8 billion dollars but we still don’t have any extra money for backups or remote reimaging or vdi, but we will buy you 700 plane tickets to go to each computer and boot it into safe mode, also you’re fired

    • @iAvicenna@lemmy.world
      link
      fedilink
      24 months ago

      while management at CrowdStrike: we are doubling the number of min commits and reviews per day to make up for the damage

    • @onlinepersona@programming.dev
      link
      fedilink
      English
      -44 months ago

      Much less invest in a memory safe language. If they don’t take a serious look at Rust, Go, or some other memory-safe language… I’ll stop right there: they won’t. Management doesn’t give a fuck as long as the cost is within manageable margins, or they can fire a bunch of scapegoats but change nothing.

      Anti Commercial-AI license

          • TechNom (nobody)
            link
            fedilink
            English
            84 months ago

            I don’t think that rust would have prevented this one, since this isn’t a compile time error (for the code loader).The address dereferencing would have been inside an unsafe block. What was missing was a validity check of the CI build artifacts and payload check on the client side.

            I do however, think that the ‘fingers-crossed’ approach to memory safety in C and C++ must stop. Rust is a great fit for this use case.

            • @Valmond@lemmy.world
              link
              fedilink
              24 months ago

              Well, modern c++ with smartpointers is quite good IMO.

              C on the ither hand is like swimming with sharks, with a nosebleed.

          • @Mikina@programming.dev
            link
            fedilink
            14 months ago

            I might be wrong, but from how I understand it it probably wouldn’t help. Kernel drivers have a rigorous QA and cert by Microsoft if you want to get them signed, which is a process that may take a long time - longer than you can afford when pushing updates to AV/EDR to catch emerging threats. What Crowdstrike does to bypass this requirement is that the CS Falcon is just an engine, that loads, interprets and executes code from definition files. The kernel driver code then doesn’t need to change, so no need for new MS cert, and they can just push new definition files. So, they kind of have to deal with unsafe in this case, since you are executing a new code.

            • @zaphod@sopuli.xyz
              link
              fedilink
              34 months ago

              What Crowdstrike does to bypass this requirement is that the CS Falcon is just an engine, that loads, interprets and executes code from definition files.

              If Microsoft really has “rigorous QA and cert” for kernel drivers then they shouldn’t have certified this, because now it’s a certified bypass for the certification.

  • FuglyDuck
    link
    fedilink
    English
    37
    edit-2
    4 months ago

    I’m willing to bet the threat of evil admin attacks will keep people up for a while.

      • TechNom (nobody)
        link
        fedilink
        English
        44 months ago

        Nobody ever learned from the solarwinds attack. If a massive amount of your infrastructure is backed by some obscure software, bad actors will either try to insert a backdoor or find a zero-day exploit. If people are going to neglect what just happened, crowdstrike will fall heals up, faster than solarwinds did.