191
CrowdStrike Isn't the Real Problem
(lemmy.world)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 21 Jul 2024
191 points (76.5% liked)
Technology
59390 readers
2843 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Please, enlighten me how you'd remotely service a few thousand Bitlocker-locked machines, that won't boot far enough to get an internet connection, with non-tech-savvy users behind them. Pray tell what common "basic hygiene" practices would've helped, especially with Crowdstrike reportedly ignoring and bypassing the rollout policies set by their customers.
Not saying the rest of your post is wrong, but this stood out as easily glossed over.
You’d have to have something even lower level like a OOB KVM on every workstation which would be stupid expensive for the ROI, or something at the UEFI layer that could potentially introduce more security holes.
Maybe they should offer a real time patcher for the security vulnerabilities in the OOB KVM, I know a great vulnerability database offered by a company that does this for a lot of systems world wide! /s
.....you don't have OOBM on every single networked device and terminal? Have you never heard of the buddy system?
You should probably start writing up an RFP. I'd suggest you also consider doubling up on the company issued phones per user.
If they already have an ATT phone, get them a Verizon one as well, or vice versa.
At my company we're already way past that. We're actually starting to import workers to provide human OOBM.
You don't answer my call? I'll just text the migrant worker we chained to your leg to flick your ear until you pick up.
Maybe that sounds extreme, but guess who's company wasn't impacted by the Crowdstrike outage.
Was a windows sysadmin for a decade. We had thousands of machines with endpoint management with bitlocker encryption. (I have sincd moved on to more of into cloud kubertlnetes devops) Anything on a remote endpoint doesn't have any basic "hygiene" solution that could remotely fix this mess automatically. I guess Intels bios remote connection (forget the name) could in theory allow at least some poor tech to remote in given there is internet connection and the company paid the xhorbant price.
All that to say, anything with end-user machines that don't allow it to boot is a nightmare. And since bit locker it's even more complicated. (Hope your bitloxker key synced... Lol).
You’re thinking of Intel vPro. I imagine some of the Crowdstrike ~~victims~~ customers have this and a bunch of poor level 1 techs are slowly griding their way through every workstation on their networks. But yeah, OP is deluded and/or very inexperienced if they think this could have been mitigated on workstations through some magical “hygiene”.
Bro. PXE boot image servers. You can remotely image machines from hundreds of miles away with a few clicks and all it takes on the other end is a reboot.
With a few clicks and being connected to the company network. Leaving anyone not able to reach an office location SOL.
Hey, it’s not perfect, but a fix that gets you 10% of the way there is still 10% you don’t have to do by hand. Don’t let perfect be the enemy of good, my man.
A decade ago I worked for a regional chain of gyms with locations in 4 states.
I was in TN. When a system would go down in SC or NC, we originally had three options:
I got sick of this. So I researched options and found an open source software solution called FOG. I ran a server in our office and had little optiplex 160s running a software client that I shipped to each club. Then each machine at each club was configured to PXE boot from the fog client.
The server contained images of every machine we commonly used. I could tell FOG which locations used which models, and it would keep the images cached on the client machines.
If everything was okay, it would chain the boot to the os on the machine. But I could flag a machine for reimage and at next boot, the machine would check in with the local FOG client via PXE and get a complete reimage from premade images on the fog server.
The corporate office was physically connected to one of the clubs, so I trialed the software at our adjacent club, and when it worked great, I rolled it out company wide. It was a massive success.
So yes, I could completely reimage a computer from hundreds of miles away by clicking a few checkboxes on my computer. Since it ran in PXE, the condition of the os didn’t matter at all. It never loaded the os when it was flagged for reimage. It would even join the computer to the domain and set up that locations printers and everything. All I had to tell the low-tech gymbro sales guy on the phone to do was reboot it.
This was free software. It saved us thousands in shipping fees alone. And brought our time to fix down from days to minutes.
There ARE options out there.
This works great for stationary pcs and local servers, does nothing for public internet connected laptops in hands of users.
The only fix here is staggered and tested updates, and apparently this update bypassed even deffered update settings that crowdstrike themselves put into their software.
The only winning move here was to not use crowdstrike.
It also assumes that reimaging is always an option.
Yes, every company should have networked storage enforced specifically for issues like this, so no user data would be lost, but there's often a gap between should and "has been able to find the time and get the required business side buy in to make it happen".
Also, users constantly find new ways to do non-standard, non-supported things with business critical data.
Isn't this just more of what caused the problem in the first place? Namely, centralisation. If you store data locally and you lose a machine, that's bad but not the end of the world. If you store it centrally and you lose the data, that's catastrophic. Nassim Taleb nailed this stuff. Keep the downside limited, and the upside unlimited or as he says, "Don't pick up pennies in front of a steamroller."
Absolutely. 100%
But don’t let perfect be the enemy of good. A fix that gets you 40% of the way there is still 40% less work you have to do by hand. Not everything has to be a fix for all situations. There’s no such thing as a panacea.
Sure. At the same time one needs to manage resources.
I was all in on laptop deployment automation. It cut down on a lot of human error issues and having inconsistent configuration popping up all the time.
But it needs constant supervision, even if not constant updates. More systems and solutions lead to neglect if not supplied well. So some "would be good to have" systems just never make the cut, because as overachieving I am, I'm also don't want to think everything is taken care of when it clearly isn't.
Yeah. I find a base image and post-install config with group policy or Ansible to be far more reliable.
Yea we're doing something similiar. Only update base images for bigger OS updates or if something breaks or can break.
The general idea is to have config that works for both new PCs and the ones that are already in use. Saves on maintaining two configuration methods.
This is a good solution for these types of scenarios. Doesn't fit all though. Where I work, 85% of staff work from home. We largely use SaaS. I'm struggling to think of a good method here other than walking them through reinstalling windows on all their machines.
That’s still 15% less work though. If I had to manually fix 1000 computers, clicking a few buttons to automatically fix 150 of them sounds like a sweet-ass deal to me even if it’s not universal.
You could also always commandeer a conference room or three and throw a switch on the table. “Bring in your laptop and go to conference room 3. Plug in using any available cable on the table and reboot your computer. Should be ready in an hour or so. There’s donuts and coffee in conference room 4.” Could knock out another few dozen.
Won’t help for people across the country, but if they’re nearish, it’s not too bad.
Not a lot of nearish. It would be pretty bad if this happened here.
Now your fog servers are dead. What now
Separate persistent data and operating system partitions, ensure that every local network has small pxe servers, vpned (wireguard, etc) to a cdn with your base OS deployment images, that validate images based on CA and checksum before delivering, and give every user the ability to pxe boot and redeploy the non-data partition.
Bitlocker keys for the OS partition are irrelevant because nothing of value is stored on the OS partition, and keys for the data partition can be stored and passed via AD after the redeploy. If someone somehow deploys an image that isn't ours, it won't have keys to the data partition because it won't have a trust relationship with AD.
(This is actually what I do at work)
Sounds good, but can you trust an OS partition not to store things in %programdata% etc that should be encrypted?
With enough ~autism~ in your overlay configs, sure, but in my environment tat leakage is still encrypted. It's far simpler to just accept leakage and encrypt the OS partition with a key that's never stored anywhere. If it gets lost, you rebuild the system from pxe. (Which is fine, because it only takes about 20 minutes and no data we care about exists there) If it's working correctly, the OS partition is still encrypted and protects any inadvertent data leakage from offline attacks.
At that point why not just redirect the data partition to a network share with local caching? Seems like it would simplify this setup greatly (plus makes enabling shadow copy for all users stupid easy)
Edit to add: I worked at a bank that did this for all of our users and it was extremely convenient for termed employees since we could simply give access to the termed employee's share to their manager and toss a them a shortcut to access said employee's files, so if it turned out Janet had some business critical spreadsheet it was easily accessible even after she was termed
We do this in a lot of areas with fslogix where there is heavy persistent data, it just never felt necessary to do that for endpoints where the persistent data partition is not much more than user settings and caches of convenience. Anything that is important is never stored solely on the endpoints, but it is nice to be able to reboot those servers without affecting downstream endpoints. If we had everything locally dependant on fslogix, I'd have to schedule building-wide outages for patching.
But your pxe boot server is down, your radius server providing vpn auth is down, your bitlocker keys are in AD which is down because all your domain controllers are down.
Yes and no. In the best case, endpoints have enough cached data to get us through that process. In the worst case, that's still a considerably smaller footprint to fix by hand before the rest of the infrastructure can fix itself.
I've been separating OS and data partitions since I was a kid running Windows 95. It's horrifying that people don't expect and prepare for machines to become unbootable on a regular basis.
Hell, I bricked my work PC twice this year just by using the Windows cleanup tool - on Windows 11. The antivirus went nuclear, as antivirus products do.
Rollout policies are the answer, and CrowdStrike should be made an example of if they were truly overriding policies set by the customer.
It seems more likely to me that nobody was expecting "fingerprint update" to have the potential to completely brick a device, and so none of the affected IT departments were setting staged rollout policies in the first place. Or if they were, they weren't adequately testing.
Then - after the fact - it's easy to claim that rollout policies were ignored when there's no way to prove it.
If there's some evidence that CS was indeed bypassing policies to force their updates I'll eat the egg on my face.
from what ive read/watched thats the crux of the issue.... did they push a 'content' update, i.e. signatures or did they push a code update.
so you basically had a bunch of companies who absolutely do test all vendor code updates beings slipped a code update they werent aware of being labeled a 'content' update.
You are talking about how to fix the problem.
This person is talking about what caused the problem.
Completely different things.
Analogous to: A house is on fire; call the ambulances to treat any wounded call the fire department, call insurance, figure out temporary housing.
This is basically immediate remedy or mitigation.
Analogous to: Investigate the causes of the fire, suggest various safety regulations on natural gas infrastructure, home appliances, electrical wiring, building material and methods, etc.
This is much more complex and involves systemic change.
Autopilot, intune. Force restart device twice to get startup repair, choose factory reset, share LAPS admin password and let the workstation rebuild itself.
Does Windows have a solid native way to remotely re-image a system like macOS does?
Yes but it is licensed based and focused on business customers.
Intel AMT.