upvote

points

by sunaookami21 hours ago |
comments
upvoteby airhangerf1520 hours ago|
next
[-]
I'm still surprised people use CrowdStrike. I guess there are no real alternatives. I know companies are getting CrowdStrike alerts for this very issue, but it still just seems like a MASSIVE attack surface.

Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.

I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.

reply
upvoteby tredre315 hours ago|
parent|
next
[-]
> They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently)

Neither have I, I think you goofed up on your acronyms? For a driver as embedded as crowdstrike you need to recompile, there's no other way around it. Linux doesn't provide anything stable to target and a shim won't cut it in this case.

> the service ran as root, it UPDATED ITS OWN BINARIES as root!

Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?

reply
upvoteby darkwi11ow13 hours ago|
parent|
[-]
I think gp meant DKMS (https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support). It allows for things like using same proprietary device drivers across many Linux kernels.
reply
upvoteby burger_moon15 hours ago|
parent|
prev|
next
[-]
Crowdstrike and Solarwinds are still being used by nearly every fed govt agency today. It's amazing really that despite everything they still get to suck up our funds.
reply
upvoteby nightski18 hours ago|
parent|
prev|
next
[-]
If I had to guess it's that very few people use it for actual security guarantees and most use it just to be able to fill out the questionnaire or compliance box saying "we do this".
reply
upvoteby Melatonic17 hours ago|
parent|
prev|
next
[-]
What do you suggest instead ?

Their Linux stuff has gotten much better but besides the (insanely huge) recent windows debacle I've found them to be a great product

reply
upvoteby JoBrad17 hours ago|
parent|
prev|
next
[-]
I remember when Crowdstrike was all about mobilizing your spare computer to DDOS the bad guys.
reply
upvoteby anygivnthursday19 hours ago|
parent|
prev|
next
[-]
> I'm still surprised people use CrowdStrike

I mean, LastPass is still in business...

reply
upvoteby numbsafari19 hours ago|
parent|
[-]
> > I'm still surprised people use CrowdStrike

> I mean, LastPass is still in business...

I mean, Microsoft is still experiencing massive growth.

reply
upvoteby kemotep18 hours ago|
parent|
[-]
If Microsoft was any good the entire IT industry would collapse. Millions of high paying careers are built on decades of fixing the garbage that comes out of Redmond. Probably a trillion dollars worth of businesses selling software and support to companies running Microsoft would evaporate as soon as Microsoft doesn’t continue their current efforts.
reply
upvoteby lfglopes17 hours ago|
parent|
prev|
[-]
I had to fill a security questionnaire today. One of the questions was

"Do you use crowdstrike falcon?"

reply
upvoteby asveikau15 hours ago|
prev|
[-]
I forgot entirely about superfish. That takes me back.

My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops.

I think higher end Lenovo laptops with cleaner windows images were not affected. And a lot of knowledgeable users wipe the OS anyway.

reply