Vetting security "experts" and IT industry

So it's been in the news recently that these guys were responsible for BSOD'ing millions of critical Windows machines around the world recently because they were able to get people to accept a broken kernel patch that they wrote. The question is how. Can someone please explain how these literal con artists came to be trusted with security updates for critical systems around the world. Apparently, to such an extent that they've become considered the "industry standard"??? I would have thought that anyone serious about computer security wouldn't touch these guys with a 10-foot-pole after they made up all that garbage about the DNC email leaks that initiated the Russiagate hoax that we are still living through. I would have thought that a company that had allowed itself to be used as a political pawn and had a pivotal assertion of theirs thoroughly discredited would become radioactive in the cybersecurity industry. But instead they grew. In fact they grew massively since 2016. Are people who employ IT services that retarded? Is marketing all that impresses them? What the hell is going on here? Did they receive a ton of spook agency money a-la In-Q-Tel or some other cutout to boost them to this spot? I am utterly baffled to learn how prominent they've become. Please, help me understand. Do people who deal with Windows just do absolutely zero vetting of their IT services?

Yes Yes Business as usual Who knows All the equivalent enterprise solutions are just as soykaf

Con artists run the world, everything is like this. The people who sell the cure make the problem, whether the problem be real or imagined, and the cure is worse. Deceiving and being deceived, waxing worse and worse.

BSOD is actually good for security in the same way that doing $ sudo halt closes attack vectors on linux >Can someone please explain how these literal con artists came to be trusted with security updates for critical systems around the world. they may have been con artists but after this incident they have been ascended to based retards

The CEO sounds like Joe Biden in terms of incoherency. All he talks about is why it happened but he can't seem to just say "We messed up, and we're taking steps to fix the problem". https://www.youtube.com/watch?v=xySnsTQLqB8 >>78830 >they may have been con artists but after this incident they have been ascended to based retards This. Because this happened, for one day the world was set back and forced to resort to simpler technology. The real crisis with technological society is an information overload where everything gets centralized and more and more layers of complexity are added, stifling innovation and creativity more and more. I dream that someday, somehow, someone manages to patch in an "rm -rf /" to Linux. Then the real fun will begin.

How does a company choose CrowdStrike as an EDR? >CTO or CISO is biased because it's what they know from their last job or what they heard about >high profile clients, governments already use it, the "nobody gets fired for buying IBM" meme >some techie superficially tested a few EDRs and this looked like the best bang for the buck >it's what the MSSP recommends >seems as competent as any other company desu (https://en.wikipedia.org/wiki/CrowdStrike) >CEO's buddy gets a kickback on sales therefore you'll be deploying CrowdStrike, no discussion More fundamentally, why does anyone run mystery box software in the first place like this EDR client? Because money. As long as it keeps flowing, nobody gives a damn about their Rube Goldberg machine of an infrastructure. When good times stop like now, then everyone cares and acts surprised for a moment, until they forget in a few months. Then the cycle starts again. Also because of our limited human intelligence coupled with the complexity of computer systems: >be caveman >too retarded to know about toxins and test berry for 10,000 different ones >look around >ok those three people ate the berry and seem fine >cautiously taste berry >ok tastes fine >eat berries It's not that people are irresponsible and do absolutely zero vetting of the software, it's that the update mechanism is one of many things that nobody will seriously consider when choosing an EDR. We simply don't have the brain capacity to dig into every little thing and make a holistic rational decision. Today it was the EDR update, tomorrow it'll be another random thing out of the millions of cases you never thought about. We default to simple smoke tests and following the herd. Which is how all bugs and vulnerabilities are created in the first place, software or hardware. "OOPSIE WHOOPSIE!! We didn't consider this specific case UwU!! We did a null pointer fuxy wucksie!!! xpp" You wouldn't reasonably expect the EDR client to casually install new drivers with database updates. Even if you realize how it works and how retarded this is, that it's a gaping backdoor, it's way down on the list of things to sperg out about. Before this incident you'd be considered an ineffective tinfoil hat autist for bringing up the dangerous update mechanism. Unfortunately "we live in a society" and in this world it's not realistic for companies to be as diligent as the space industry, as it'd 10x costs, bankrupting businesses. It's cheaper to allow a lot of spaghetti to keep costs low, even if it causes millions in losses every now and then. Good enough. Might be the culture of buying the fastest and slickest computer, car instead of demanding rock solid but more outdated ones. There's no technical reason why 20 year lifespan phones, 50 year daily driver cars or 500 year houses can't be made, there's just no mass market for those.

https://news.ycombinator.com/item?id=41005936 Crowdstrike did this to our production linux fleet back on April 19th, and I've been dying to rant about it. The short version was: we're a civic tech lab, so we have a bunch of different production websites made at different times on different infrastructure. We run Crowdstrike provided by our enterprise. Crowdstrike pushed an update on a Friday evening that was incompatible with up-to-date Debian stable. So we patched Debian as usual, everything was fine for a week, and then all of our servers across multiple websites and cloud hosts simultaneously hard crashed and refused to boot. When we connected one of the disks to a new machine and checked the logs, Crowdstrike looked like a culprit, so we manually deleted it, the machine booted, tried reinstalling it and the machine immediately crashes again. OK, let's file a support ticket and get an engineer on the line. Crowdstrike took a day to respond, and then asked for a bunch more proof (beyond the above) that it was their fault. They acknowledged the bug a day later, and weeks later had a root cause analysis that they didn't cover our scenario (Debian stable running version n-1, I think, which is a supported configuration) in their test matrix. In our own post mortem there was no real ability to prevent the same thing from happening again -- "we push software to your machines any time we want, whether or not it's urgent, without testing it" seems to be core to the model, particularly if you're a small IT part of a large enterprise. What they're selling to the enterprise is exactly that they'll do that.

>>78837 >There's no technical reason why 20 year lifespan phones, 50 year daily driver cars or 500 year houses can't be made, there's just no mass market for those. Oh rest assured there actually is a market for those. The trick as a competitor is to corner the market and force feed consumers planned obsolescence. Becoming the winner in market competition is all about undermining the market until you're able to secure a monopoly or cartel that consumers can't say no to.

>>78840 There's a market for it, but you can always make more money by producing a cheaper product that is harder to repair. >>78826 A lot of the time the IT guys aren't even making IT decisions like this. The boss is usually getting some kind of kickback, or is getting wined & dined to sign a contract, or is just buying the advertising without thinking about it. They're usually not the person who has soykaf fall on them when problems arise, either. He's gonna be in a different division next year anyway, so who cares? All he has to do is look like he's doing something good to the other execs. Basically like >>78837 said.

>>78840 There seriously is a market for it. Literally would be a "I'll take 5", it's why I got 4 Wii's when they were cheap before the pandemic or why I have three Thinkpads. Products being robust & modifiable allows them to enter the secondary market & why consumers buy those products. The cheap soykafass one's don't make me want to buy from the unreputable Chinese merchant, but what else can I do when said companies seem to corner the market on things like Amazon dust blowers.

Security is compliance theater in the enterprise. Crowdstrike has caused more outages than it has prevented hands down. But its needed for compliance so companies don't risk getting sued by their customers when they have a data breach because their actual security practices internal are complete garbage.

Does Endpoint Detection and Response (EDR) software actually even do anything, or is this just another case of a completely false sense of security?

>Apparently, to such an extent that they've become considered the "industry standard"??? It'snot the company but rather the Microsoft thing being more remotely manageable and having its own fallbacks for remote stuff (netbios rdp etc) along with manageability (intel me/amd psp(cloud pro)) baked in chips. If only linux had better platform for that it would also be a competitor but no.. even Macs don't have it as good. My only problem with this issue is that the crowdstrike/microsoft problem reportedly affected even offline voting machines so this looks to me more like a remote magic outofband wireless packet got sent out there for all UEFI (ring negative) devices and it just happened to also brick crowdstrike or it might be that they timed it perfectly in concerto so all the search results get whitewashed by the BSOD when in fact the magic packet may have affected even "poorly airgapped" systems

>>78877 Source on the voting machine stuff? From what I've read it had to do rather with machines involved in voter verification and ballot printing.

>>78838 >up-to-date Debian stable That's an oxymoron (unless you have backports repo enabled).

>>78826 Most big corpos who sell B2B get their big fat share through Govt contracts . They sell most of their big share of services to the government, whoever is in power to steer the government funds towards X or Y product decides what kind of narrative is suitable and vice versa , whoever wants to appeal to the Govt should embrace its narrative and manipulate it .. Corporations are just a tool of a minority of groups, those groups are salesmen , investors , C suites etc etc .. Those people decide what kind of narrative goes on and who is expert and who is not, they own the workers, press , online blogs, reviewers through money, NDA , favors etc etc That is not limited to computing companies, all companies are like that, and it might be even worse outside of computing .. Healthcare comes to mind .. There is no truth in a world where whoever can pay more is king .. Universities are just a factory and grant kissing ass departments .. How to change it ? There is no single answer / ideology to this, especially that humans fear death, hunger and sickness by default .. Let alone the multitude of them who would go even to death just to be wealthy, powerful etc etc ..

>>78829 >The people who sell the cure make the problem No, ransomware became a whole industry because it's very profitable and easy. It would absolutely exist without security companies. Some Russians buy Google ads for a fake OBS installer or send out a million spam emails with a URL in it, eventually someone will give them a backdoor to a company, then they get network admin rights and encrypt everything. That'll be $5 million. They also offer to pay random sysadmins $1000 or a percentage of the eventual ransom for an account, it's insane what ransomware gangs get up to and how organized they are. There are services on both sides that specialize in negotiating the ransom amount. Lots of interesting info here: https://krebsonsecurity.com/category/ransomware/ There's more than enough work and complexity to go around without creating an artificial problem. Could be that some are working both sides, but there are just too many people involved globally for the whole thing to be fake in general, some of it would leak. Also companies do it to themselves 99.9% of the time, someone set up that open RDP port and set the admin password to Test2024, someone clicked that phishing link, ran that executable, didn't update the known vulnerable software on the web server, didn't set up offline backups, failed to do the most rudimentary log monitoring. Of course they'll get pwned. Most of it is avoidable if every employee using a computer had a lick of sense, but there will always be retarded ones.

>>78882 >but there will always be retarded ones. It's very easy to forget if you run in certain circles, but the overwhelming majority of people are the "retarded ones" where technology is concerned.

>>78875 Yes, EDR actually works. When you hear about corpos getting ransomwared in the news, they probably didn't have any. Privacy nightmare because the good ones are cloud exclusive and upload every little piece of metadata to the EDR company (all file names, hashes, process details, domain names, IPs, system logs), but it works well when it comes to detecting hackermen. Doesn't block attacks every hour of the day, most of the time it's sitting there doing nothing and is an annoyance, but in a large company you can expect a serious incident a few times every year, any of which could sink the ship. Fun fact, you can get a dumbed down version of Microsoft's EDR as a random person :3 https://www.microsoft.com/en-us/microsoft-365/microsoft-defender-for-individuals

>>78875 It does something but because it does something it is annoying as fuarrrk when you want to review/reverse engineer malware. in a company? it stops the braindead employees from fuarrrking everyone cuz they clicked on some fake ad or fell for the most basic ass phishing attempt. actually helpful. To a tech literate folk at home? Not much. It'll probably stop you from fuarrrking up once in a blue moon but you'll get fuarrrked in the ass by smth more advanced and the EDR won't catch it most likely because it is new and not recognized by it. You should be doing backups anyway for those cases where it nukes ur whole pc if it doesn't just steal all ur info.

what do you mean "security updates"? this is a security product like antivirus, which is indeed total snakeoil just like antivirus and firewalls. stopped reading there

>>78916 snake oil to us, but it's useful to companies who need to tard wrangle their ransomware magnet employees

>>78874 This is true in the medical field as well. There's so much theater around HIPAA and all the other insane compliance requirements. What's funny is there's always a loophole in the requirements - usually along the lines of "Check this box if you're _PLANNING_ to implement this thing in the next year". And you can just keep pushing it off.

>>78936 HIPAA is all about protecting patient privacy, isn't it? I wouldn't call that one insane.

>>78945 Huh. I thought it was about protecting the government from patient lawsuits over privacy violations.

>>78948 I'm not aware of anyone having a reason to sue "the government" over medical privacy. On the other hand it's very socially destabilizing to allow private organizations like insurance agencies and employers to get ahold of medical history.

>78935 so diverce owo >ransomware magnet employees if it wasn't for printers and scanners most office worker could be moved to linox or something

By the way, about this. Windews suddenly neede d a special security update. Why now? Why those people.? As far as i got it, this one was not ppanned, it supposed to perform a really certain task. Which one? And sigh brugging abot con ppl running teh world right after exacly con ppl failed, what a stubborn perception. Damn them, crystal cities

>>79086 Windows got hit with a cyber attack, so probably dealing with that https://www.yahoo.com/news/microsoft-down-outage-caused-cyber-162027273.html

>>79087 why , who, why now, how? only more questions.

>>79090 idk, could be >kick your target when he is on the ground in any case, it doesn't look good when they had 2 consecutive cyber oopsies in a matter of weeks. One was crowdstrike, but it affected windows services, so might as well have been them.

>>78826 >Can someone please explain how these literal con artists came to be trusted with security updates for critical systems around the world. Apparently, to such an extent that they've become considered the "industry standard"??? Ignorant take. Take the airlines for example, they are operating a business that probably produces tens of billions of dollars a year, that you point out is a relatively critical service. What kind of protection should they put in place for that? What kinds of risks to their business are there out there? This is the function of the C-Suite of American Airlines. What about the IT department? What kind of continuous integration and testing should AA staff have had surrounding updates to system infrastructure? What kind of rolling deployment strategies should they have used? It's a special kind of insane to just let vendors, who are totally unaware of your use of the systems and value, push updates to your fleet of production systems that generate tens of millions of dollars a day in value without a functional backup plan for what to do for when those systems fail. I have heard people blame Microsoft for developing the NT Kernel in C. I have heard people blame crowd strike for not testing the patch correctly. To my mind, that's all bullshit. Of course crowd strike has a test procedure - but its not designed to protect tens of millions of dollars a day in value - that's the owner of those systems job. to be honest, I think this is the 4 airlines cheaping out on IT, because they thought it was a good gamble, and don't care if it's a critical service. IMO the solution either better regulation on how airlines have to operate IT systems OR (better?) break up of the airlines into more companies with a more diversity of policy, systems and vendors so they don't all fail on the same day due to crowd strike.