#crowdstroke — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #crowdstroke, aggregated by home.social.
-
I barely dodged the #CrowdStroke during my trip, only to get my train delayed by arsons for my return.
At least the latter is fucking up the JOs so it's not all bad :blobfoxfloofexplode:
-
I barely dodged the #CrowdStroke during my trip, only to get my train delayed by arsons for my return.
At least the latter is fucking up the JOs so it's not all bad :blobfoxfloofexplode:
-
I barely dodged the #CrowdStroke during my trip, only to get my train delayed by arsons for my return.
At least the latter is fucking up the JOs so it's not all bad :blobfoxfloofexplode:
-
After the gift card fiasco just took it to a whole new level, you might need an update on where we are with #CrowdStroke. Well do we have the video for you, or what:
https://www.captiongenerator.com/v/2302333/crowdstrike -
After the gift card fiasco just took it to a whole new level, you might need an update on where we are with #CrowdStroke. Well do we have the video for you, or what:
https://www.captiongenerator.com/v/2302333/crowdstrike -
After the gift card fiasco just took it to a whole new level, you might need an update on where we are with #CrowdStroke. Well do we have the video for you, or what:
https://www.captiongenerator.com/v/2302333/crowdstrike -
After the gift card fiasco just took it to a whole new level, you might need an update on where we are with #CrowdStroke. Well do we have the video for you, or what:
https://www.captiongenerator.com/v/2302333/crowdstrike -
After the gift card fiasco just took it to a whole new level, you might need an update on where we are with #CrowdStroke. Well do we have the video for you, or what:
https://www.captiongenerator.com/v/2302333/crowdstrike -
[long post] #CrowdStroke is demonstrating the significant risks of giving a third party remote root across your systems. I'd argue we don't have to accept this and can stop granting such vendors access to critical systems with acceptable security.
Risks of AV/NGAV/EDR/XDR/whatever the next buzzword is don't just include functional bugs: false positives killing your critical processes, data exposure, or supply chain attacks via third party have all happened.
The commonly repeated refrains of "bugs can happen to anyone" "this stuff is hard" etc. aren't reassuring or an acceptable answer when Delta, for example, has continued to mass-cancel flights for 4 days (so far!) Shrugging our collective shoulders and just hoping the AV - I mean EDR - vendors don't screw up again like they have several times before and continuing to install their agents everywhere is just not going to cut it.
Nevertheless effective active endpoint security software is arguably necessary on endpoints where users surf the internet and open attachments to block malicious initial access, but on critical servers, the situation is reversed. If an agent for a common C2 framework is detected on a domain controller or OT control system, immediately killing it is likely not the best response option, even apart from the risks above. It is indicative of a far broader ongoing intrusion requiring a comprehensive incident response.
But what is the alternative exactly? How else will you see that agent or credential dump or brute force attempt, etc.? Nearly all the high signal data from hashes of libraries loaded to process injection via CreateRemoteThread can be collected by built-in or configurable event collection with something like sysmon, forwarded to a SIEM, and analyzed against executable whitelists, YARA rules, VirusTotal, and more. Brute force attempts can be detected by these as well as by packet captures, request log analytics, etc.
Nearly all the value of CrowdStrike comes not from the superiority of a few extra points their kernel driver can monitor, but from the analysts watching, investigating, tuning, and responding to the data collected. This is type of service that many managed security services can provide on a safer and more passive stack. Not only that, but you can often keep your data in your own SIEMs, in your network, in your datacenter, that you own.
It can be the right choice for many systems. I'd argue it undoubtedly is for critical OT ICS systems, and likely is for many IT servers as well.
-
[long post] #CrowdStroke is demonstrating the significant risks of giving a third party remote root across your systems. I'd argue we don't have to accept this and can stop granting such vendors access to critical systems with acceptable security.
Risks of AV/NGAV/EDR/XDR/whatever the next buzzword is don't just include functional bugs: false positives killing your critical processes, data exposure, or supply chain attacks via third party have all happened.
The commonly repeated refrains of "bugs can happen to anyone" "this stuff is hard" etc. aren't reassuring or an acceptable answer when Delta, for example, has continued to mass-cancel flights for 4 days (so far!) Shrugging our collective shoulders and just hoping the AV - I mean EDR - vendors don't screw up again like they have several times before and continuing to install their agents everywhere is just not going to cut it.
Nevertheless effective active endpoint security software is arguably necessary on endpoints where users surf the internet and open attachments to block malicious initial access, but on critical servers, the situation is reversed. If an agent for a common C2 framework is detected on a domain controller or OT control system, immediately killing it is likely not the best response option, even apart from the risks above. It is indicative of a far broader ongoing intrusion requiring a comprehensive incident response.
But what is the alternative exactly? How else will you see that agent or credential dump or brute force attempt, etc.? Nearly all the high signal data from hashes of libraries loaded to process injection via CreateRemoteThread can be collected by built-in or configurable event collection with something like sysmon, forwarded to a SIEM, and analyzed against executable whitelists, YARA rules, VirusTotal, and more. Brute force attempts can be detected by these as well as by packet captures, request log analytics, etc.
Nearly all the value of CrowdStrike comes not from the superiority of a few extra points their kernel driver can monitor, but from the analysts watching, investigating, tuning, and responding to the data collected. This is type of service that many managed security services can provide on a safer and more passive stack. Not only that, but you can often keep your data in your own SIEMs, in your network, in your datacenter, that you own.
It can be the right choice for many systems. I'd argue it undoubtedly is for critical OT ICS systems, and likely is for many IT servers as well.
-
[long post] #CrowdStroke is demonstrating the significant risks of giving a third party remote root across your systems. I'd argue we don't have to accept this and can stop granting such vendors access to critical systems with acceptable security.
Risks of AV/NGAV/EDR/XDR/whatever the next buzzword is don't just include functional bugs: false positives killing your critical processes, data exposure, or supply chain attacks via third party have all happened.
The commonly repeated refrains of "bugs can happen to anyone" "this stuff is hard" etc. aren't reassuring or an acceptable answer when Delta, for example, has continued to mass-cancel flights for 4 days (so far!) Shrugging our collective shoulders and just hoping the AV - I mean EDR - vendors don't screw up again like they have several times before and continuing to install their agents everywhere is just not going to cut it.
Nevertheless effective active endpoint security software is arguably necessary on endpoints where users surf the internet and open attachments to block malicious initial access, but on critical servers, the situation is reversed. If an agent for a common C2 framework is detected on a domain controller or OT control system, immediately killing it is likely not the best response option, even apart from the risks above. It is indicative of a far broader ongoing intrusion requiring a comprehensive incident response.
But what is the alternative exactly? How else will you see that agent or credential dump or brute force attempt, etc.? Nearly all the high signal data from hashes of libraries loaded to process injection via CreateRemoteThread can be collected by built-in or configurable event collection with something like sysmon, forwarded to a SIEM, and analyzed against executable whitelists, YARA rules, VirusTotal, and more. Brute force attempts can be detected by these as well as by packet captures, request log analytics, etc.
Nearly all the value of CrowdStrike comes not from the superiority of a few extra points their kernel driver can monitor, but from the analysts watching, investigating, tuning, and responding to the data collected. This is type of service that many managed security services can provide on a safer and more passive stack. Not only that, but you can often keep your data in your own SIEMs, in your network, in your datacenter, that you own.
It can be the right choice for many systems. I'd argue it undoubtedly is for critical OT ICS systems, and likely is for many IT servers as well.
-
[long post] #CrowdStroke is demonstrating the significant risks of giving a third party remote root across your systems. I'd argue we don't have to accept this and can stop granting such vendors access to critical systems with acceptable security.
Risks of AV/NGAV/EDR/XDR/whatever the next buzzword is don't just include functional bugs: false positives killing your critical processes, data exposure, or supply chain attacks via third party have all happened.
The commonly repeated refrains of "bugs can happen to anyone" "this stuff is hard" etc. aren't reassuring or an acceptable answer when Delta, for example, has continued to mass-cancel flights for 4 days (so far!) Shrugging our collective shoulders and just hoping the AV - I mean EDR - vendors don't screw up again like they have several times before and continuing to install their agents everywhere is just not going to cut it.
Nevertheless effective active endpoint security software is arguably necessary on endpoints where users surf the internet and open attachments to block malicious initial access, but on critical servers, the situation is reversed. If an agent for a common C2 framework is detected on a domain controller or OT control system, immediately killing it is likely not the best response option, even apart from the risks above. It is indicative of a far broader ongoing intrusion requiring a comprehensive incident response.
But what is the alternative exactly? How else will you see that agent or credential dump or brute force attempt, etc.? Nearly all the high signal data from hashes of libraries loaded to process injection via CreateRemoteThread can be collected by built-in or configurable event collection with something like sysmon, forwarded to a SIEM, and analyzed against executable whitelists, YARA rules, VirusTotal, and more. Brute force attempts can be detected by these as well as by packet captures, request log analytics, etc.
Nearly all the value of CrowdStrike comes not from the superiority of a few extra points their kernel driver can monitor, but from the analysts watching, investigating, tuning, and responding to the data collected. This is type of service that many managed security services can provide on a safer and more passive stack. Not only that, but you can often keep your data in your own SIEMs, in your network, in your datacenter, that you own.
It can be the right choice for many systems. I'd argue it undoubtedly is for critical OT ICS systems, and likely is for many IT servers as well.
-
[long post] #CrowdStroke is demonstrating the significant risks of giving a third party remote root across your systems. I'd argue we don't have to accept this and can stop granting such vendors access to critical systems with acceptable security.
Risks of AV/NGAV/EDR/XDR/whatever the next buzzword is don't just include functional bugs: false positives killing your critical processes, data exposure, or supply chain attacks via third party have all happened.
The commonly repeated refrains of "bugs can happen to anyone" "this stuff is hard" etc. aren't reassuring or an acceptable answer when Delta, for example, has continued to mass-cancel flights for 4 days (so far!) Shrugging our collective shoulders and just hoping the AV - I mean EDR - vendors don't screw up again like they have several times before and continuing to install their agents everywhere is just not going to cut it.
Nevertheless effective active endpoint security software is arguably necessary on endpoints where users surf the internet and open attachments to block malicious initial access, but on critical servers, the situation is reversed. If an agent for a common C2 framework is detected on a domain controller or OT control system, immediately killing it is likely not the best response option, even apart from the risks above. It is indicative of a far broader ongoing intrusion requiring a comprehensive incident response.
But what is the alternative exactly? How else will you see that agent or credential dump or brute force attempt, etc.? Nearly all the high signal data from hashes of libraries loaded to process injection via CreateRemoteThread can be collected by built-in or configurable event collection with something like sysmon, forwarded to a SIEM, and analyzed against executable whitelists, YARA rules, VirusTotal, and more. Brute force attempts can be detected by these as well as by packet captures, request log analytics, etc.
Nearly all the value of CrowdStrike comes not from the superiority of a few extra points their kernel driver can monitor, but from the analysts watching, investigating, tuning, and responding to the data collected. This is type of service that many managed security services can provide on a safer and more passive stack. Not only that, but you can often keep your data in your own SIEMs, in your network, in your datacenter, that you own.
It can be the right choice for many systems. I'd argue it undoubtedly is for critical OT ICS systems, and likely is for many IT servers as well.
-
Enforcing homogeneity is enforcing fragility and catastrophic failures.
#CrowdStroke #ClownStrike #CrowdStrike -
Enforcing homogeneity is enforcing fragility and catastrophic failures.
#CrowdStroke #ClownStrike #CrowdStrike -
Enforcing homogeneity is enforcing fragility and catastrophic failures.
#CrowdStroke #ClownStrike #CrowdStrike -
Enforcing homogeneity is enforcing fragility and catastrophic failures.
#CrowdStroke #ClownStrike #CrowdStrike -
Enforcing homogeneity is enforcing fragility and catastrophic failures.
#CrowdStroke #ClownStrike #CrowdStrike -
So today I fly home via United. United is one of the airlines that is affected by #CrowdStroke. My flight is in 7 hours. I have carry on baggage only. I'm going to document my struggles so that y'all can enjoy my agony. I plan on turning this thread into a blogpost.
"Enjoy"?
I've tried to check in with the United website a few times yesterday and today. I get a few steps into the process and then the system says "no fuck you, check in at the airport". This morning I got as far as seat selection before the system errored out. I can't imagine what the airport is like now.
I'm planning on getting to the airport very fucking early so that I can brave the line game that is undoubtedly full of other travellers that are also totally stuck and fucked over by this shitshow.
If my flight is delayed, I doubt that United or Air Canada will comply with the Canadian flight delay compensation laws due to it being an IT issue. Probably should have bought insurance on the trip.
Worst possible case, home is only a 9 hour drive away.
I have status with Air Canada. One of the perks you get is the magic phone number that gets you to a human before the hold music loops. I called the magic phone number yesterday to see if there was any way to route around United's issues by flying with another airline.
There is not. United is the only airline that flies into YOW from EWR. Worst case one of the itineraries I could go for is EWR -> YYZ -> YOW, or even EWR -> YUL -> YOW, but I see this as a last-ditch option. If things are super broken at the airport though, I may have to take that option.
-
So today I fly home via United. United is one of the airlines that is affected by #CrowdStroke. My flight is in 7 hours. I have carry on baggage only. I'm going to document my struggles so that y'all can enjoy my agony. I plan on turning this thread into a blogpost.
"Enjoy"?
I've tried to check in with the United website a few times yesterday and today. I get a few steps into the process and then the system says "no fuck you, check in at the airport". This morning I got as far as seat selection before the system errored out. I can't imagine what the airport is like now.
I'm planning on getting to the airport very fucking early so that I can brave the line game that is undoubtedly full of other travellers that are also totally stuck and fucked over by this shitshow.
If my flight is delayed, I doubt that United or Air Canada will comply with the Canadian flight delay compensation laws due to it being an IT issue. Probably should have bought insurance on the trip.
Worst possible case, home is only a 9 hour drive away.
I have status with Air Canada. One of the perks you get is the magic phone number that gets you to a human before the hold music loops. I called the magic phone number yesterday to see if there was any way to route around United's issues by flying with another airline.
There is not. United is the only airline that flies into YOW from EWR. Worst case one of the itineraries I could go for is EWR -> YYZ -> YOW, or even EWR -> YUL -> YOW, but I see this as a last-ditch option. If things are super broken at the airport though, I may have to take that option.
-
So today I fly home via United. United is one of the airlines that is affected by #CrowdStroke. My flight is in 7 hours. I have carry on baggage only. I'm going to document my struggles so that y'all can enjoy my agony. I plan on turning this thread into a blogpost.
"Enjoy"?
I've tried to check in with the United website a few times yesterday and today. I get a few steps into the process and then the system says "no fuck you, check in at the airport". This morning I got as far as seat selection before the system errored out. I can't imagine what the airport is like now.
I'm planning on getting to the airport very fucking early so that I can brave the line game that is undoubtedly full of other travellers that are also totally stuck and fucked over by this shitshow.
If my flight is delayed, I doubt that United or Air Canada will comply with the Canadian flight delay compensation laws due to it being an IT issue. Probably should have bought insurance on the trip.
Worst possible case, home is only a 9 hour drive away.
I have status with Air Canada. One of the perks you get is the magic phone number that gets you to a human before the hold music loops. I called the magic phone number yesterday to see if there was any way to route around United's issues by flying with another airline.
There is not. United is the only airline that flies into YOW from EWR. Worst case one of the itineraries I could go for is EWR -> YYZ -> YOW, or even EWR -> YUL -> YOW, but I see this as a last-ditch option. If things are super broken at the airport though, I may have to take that option.
-
So today I fly home via United. United is one of the airlines that is affected by #CrowdStroke. My flight is in 7 hours. I have carry on baggage only. I'm going to document my struggles so that y'all can enjoy my agony. I plan on turning this thread into a blogpost.
"Enjoy"?
I've tried to check in with the United website a few times yesterday and today. I get a few steps into the process and then the system says "no fuck you, check in at the airport". This morning I got as far as seat selection before the system errored out. I can't imagine what the airport is like now.
I'm planning on getting to the airport very fucking early so that I can brave the line game that is undoubtedly full of other travellers that are also totally stuck and fucked over by this shitshow.
If my flight is delayed, I doubt that United or Air Canada will comply with the Canadian flight delay compensation laws due to it being an IT issue. Probably should have bought insurance on the trip.
Worst possible case, home is only a 9 hour drive away.
I have status with Air Canada. One of the perks you get is the magic phone number that gets you to a human before the hold music loops. I called the magic phone number yesterday to see if there was any way to route around United's issues by flying with another airline.
There is not. United is the only airline that flies into YOW from EWR. Worst case one of the itineraries I could go for is EWR -> YYZ -> YOW, or even EWR -> YUL -> YOW, but I see this as a last-ditch option. If things are super broken at the airport though, I may have to take that option.
-
So today I fly home via United. United is one of the airlines that is affected by #CrowdStroke. My flight is in 7 hours. I have carry on baggage only. I'm going to document my struggles so that y'all can enjoy my agony. I plan on turning this thread into a blogpost.
"Enjoy"?
I've tried to check in with the United website a few times yesterday and today. I get a few steps into the process and then the system says "no fuck you, check in at the airport". This morning I got as far as seat selection before the system errored out. I can't imagine what the airport is like now.
I'm planning on getting to the airport very fucking early so that I can brave the line game that is undoubtedly full of other travellers that are also totally stuck and fucked over by this shitshow.
If my flight is delayed, I doubt that United or Air Canada will comply with the Canadian flight delay compensation laws due to it being an IT issue. Probably should have bought insurance on the trip.
Worst possible case, home is only a 9 hour drive away.
I have status with Air Canada. One of the perks you get is the magic phone number that gets you to a human before the hold music loops. I called the magic phone number yesterday to see if there was any way to route around United's issues by flying with another airline.
There is not. United is the only airline that flies into YOW from EWR. Worst case one of the itineraries I could go for is EWR -> YYZ -> YOW, or even EWR -> YUL -> YOW, but I see this as a last-ditch option. If things are super broken at the airport though, I may have to take that option.
-
Who said permacomputing would never go mainstream
https://www.yahoo.com/tech/windows-version-1992-saving-southwest-171922788.html
(if even true ofc)
-
Who said permacomputing would never go mainstream
https://www.yahoo.com/tech/windows-version-1992-saving-southwest-171922788.html
(if even true ofc)
-
Who said permacomputing would never go mainstream
https://www.yahoo.com/tech/windows-version-1992-saving-southwest-171922788.html
(if even true ofc)
-
Who said permacomputing would never go mainstream
https://www.yahoo.com/tech/windows-version-1992-saving-southwest-171922788.html
(if even true ofc)
-
Who said permacomputing would never go mainstream
https://www.yahoo.com/tech/windows-version-1992-saving-southwest-171922788.html
(if even true ofc)
-
OHIRL: "I bet the person who would have known better got put on PIP and managed out as part of an AI pivot."
I know, I know, I shouldn't laugh. I'm sorry.
-
OHIRL: "I bet the person who would have known better got put on PIP and managed out as part of an AI pivot."
I know, I know, I shouldn't laugh. I'm sorry.
-
OHIRL: "I bet the person who would have known better got put on PIP and managed out as part of an AI pivot."
I know, I know, I shouldn't laugh. I'm sorry.
-
OHIRL: "I bet the person who would have known better got put on PIP and managed out as part of an AI pivot."
I know, I know, I shouldn't laugh. I'm sorry.
-
OHIRL: "I bet the person who would have known better got put on PIP and managed out as part of an AI pivot."
I know, I know, I shouldn't laugh. I'm sorry.
-
In the aftermath of the #ClownStrike ( #CrowdStroke or whatever) it would be interesting to watch the uptick in re-infection traffic in the coming days and weeks due to lost comms on the infected endpoints
@greynoise should be well positioned to catch a bunch of replay scenarios -
In the aftermath of the #ClownStrike ( #CrowdStroke or whatever) it would be interesting to watch the uptick in re-infection traffic in the coming days and weeks due to lost comms on the infected endpoints
@greynoise should be well positioned to catch a bunch of replay scenarios -
In the aftermath of the #ClownStrike ( #CrowdStroke or whatever) it would be interesting to watch the uptick in re-infection traffic in the coming days and weeks due to lost comms on the infected endpoints
@greynoise should be well positioned to catch a bunch of replay scenarios -
– What does it do?
– It turns blue. -
Immerhin wissen wir jetzt, wer alles #crowdstike einsetzt. #crowdstroke 🤷🏼♀️
-
Immerhin wissen wir jetzt, wer alles #crowdstike einsetzt. #crowdstroke 🤷🏼♀️
-
Immerhin wissen wir jetzt, wer alles #crowdstike einsetzt. #crowdstroke 🤷🏼♀️
-
Immerhin wissen wir jetzt, wer alles #crowdstike einsetzt. #crowdstroke 🤷🏼♀️
-
Immerhin wissen wir jetzt, wer alles #crowdstike einsetzt. #crowdstroke 🤷🏼♀️
-
#crowdstroke has a nice ring to it.
-
This #crowdstrike issue is also a #microsoft issue. Even with far-reaching rights a third-party application should not be able to crash the whole system it is running on. #crowdstroke
-
This #crowdstrike issue is also a #microsoft issue. Even with far-reaching rights a third-party application should not be able to crash the whole system it is running on. #crowdstroke
-
This #crowdstrike issue is also a #microsoft issue. Even with far-reaching rights a third-party application should not be able to crash the whole system it is running on. #crowdstroke
-
This #crowdstrike issue is also a #microsoft issue. Even with far-reaching rights a third-party application should not be able to crash the whole system it is running on. #crowdstroke
-
The worst part about #Crowdstroke is realizing how many more or less critical systems are actually built on #Windows
-
The worst part about #Crowdstroke is realizing how many more or less critical systems are actually built on #Windows
-
The worst part about #Crowdstroke is realizing how many more or less critical systems are actually built on #Windows
-
The worst part about #Crowdstroke is realizing how many more or less critical systems are actually built on #Windows
-
The worst part about #Crowdstroke is realizing how many more or less critical systems are actually built on #Windows
-
So what did we have in the past two weeks.
Mozzila is now an ad company
Proton drank the AI coolaid
#crowdstroke #crowdstike #enshittification
