There is no learning, companies just move to different antivirus. The new hotness, the cycle repeats over and over until the new antivirus does this same shit. Look at McAfee in 2010, in fact the CEO of Crowdstrike was the CTO of McAfee then. That easily took down millions of windows XP machines.
this post was submitted on 20 Jul 2024
11 points (100.0% liked)
Technology
68689 readers
21 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
in fact the CEO of Crowdstrike was the CTO of McAfee then
The hero of Linux adoption then. All hail - what's the name of that guy?
This isn't the Windows L you think it is. This can and has happened on Linux. It's a Crowdstrike/Bad corp IT issue.
I know, but the whole culture of using such things is Windows-centered.
Are there really a billion systems in the world that run Crowdstrike? That seems implausible. Is it just hyperbole?
Probably includes a bunch of virtual machines.
Yeah, our VMs completely died at work. Has to set up temporary stuff on hardware we had laying around today. Was kinda fun, but stressful haha.
Could you just revert VMs to a snapshot before the update? Or do you not take periodic snapshots? You could probably also mount the VM's drive on the host and delete the relevant file that way.
Yes you can just go into safe mode on an affected machine and delete the offending file. The problem is it took a couple hours before that resolution was found, and it has to be done by hand on every VM. I can’t just run an Ansible playbook against hundreds of non-booted VMs. Then you have to consider in the case of servers, there might be a specific start up order, certain things might have to be started before other things and further fixing might be required given that every VM hard crashed. At the minimum it took many companies 6-12 hours to get back up and running and on many more it could take days.
Sounds pretty plausible to me. An organization doesn’t have to be very big to get into the hundreds or thousands of devices on a network when you account for servers and VM.
A company with 40 employees all accessing and RDS server using a company laptop is looking at 85+ devices already
Despite how it may seem on Lemmy, most people have not yet actually switched to Linux. This stat is legit.
I know that Windows is everywhere, I just don't know the percentage of Windows computers that run Crowdstrike.
Keep in mind, it's not just clients, but servers too. A friend of mine works for a decently sized company that has about 1600 (virtual) servers internationally. And yes, all of them were affected.
You do realize that linux is something like 80% of servers. Which also well out number personal machines. If you include android linux is easily the most used os on the planet.
It’s 80% of web servers but not 80% of ALL servers.
Whoda thunk automatic updates to critical infrastructure was a good idea? Just hope healthcare life support was not affected.
Many compliance frameworks require security utilities to receive automatic updates. It's pretty essential for effective endpoint protection considering how fast new threats spread.
The problem is not the automated update, it's why it wasn't caught in testing and how the update managed to break the entire OS.
load more comments
(5 replies)
Hospital stuff was affected. Most engineers are smart enough to not connect critical equipment to the Internet, though.
I’m not in the US, but my other medical peers who are mentioned that EPIC (the software most hospitals use to manage patient records) was not affected, but Dragon (the software by Nuance that we doctors use for dictation so we don’t have to type notes) was down. Someone I know complained that they had to “type notes like a medieval peasant.” But I’m glad that the critical infrastructure was up and running. At my former hospital, we used to always maintain physical records simultaneously for all our current inpatients that only the medical team responsible for those specific patients had access to just to be on the safe side.
This is pretty much correct. I work in an Epic shop and we had about 150 servers to remediate and some number of workstations (I’m not sure how many). While Epic make not have been impacted, it is a highly integrated system and when things are failing around it then it can have an impact on care delivery. For example if a provider places a stat lab order in Epic, that lab order gets transmitted to an integration middleware which then routes it to the lab system. If the integration middleware or the lab system are down, then the provider has no idea the stat order went into a black hole.
Our lab was absolutely fucked from multiple integrations going down. I’m a Cupid analyst and we weren’t really affected. What app do you work on?
I’m an integration guy at my roots but I lead a variety of different teams at the moment. We use Corepoint as one of our interface engines and it shat the bed big time. We had to restore it from backup, which was nuts in my opinion. We had a variety of apps impacted.
That’s cool. I was going to move over to our integration team but I’m looking into Epic consulting instead. Our integration team was very busy on Friday along with our clinical apps team. We use Cloverleaf for our interface engine, I’ve got a bit of experience poking around in there. HL7 is interesting, but I’d like to learn FHIR. Do you have a Bridges cert?
I’m Bridges certified as well as in Cloverleaf, which we also use. FHIR is great but it doesn’t require much in the way of integration engineers.
I’m an Epic analyst - while Epic was fine, many of our third party integrations shit the bed. Cardiology (where I work) was mostly unaffected aside from Omnicell being down, but the laboratory was massively fucked due to all the integrations they have. Multiple teams were quite busy, I just got to talk to them about it eventually.
It's because Windows is crap software. Just stop using anything Microsoft makes.
This was very much not caused by windows
In a way, it was. If Windows was not as crappy as it is, external solutions would not be needed.
Is your point "Linux and Mac dont get viruses or targeted for cyberattacks"?
Or is it "This wouldn't have broken on a different operating system"?
No to both. Windows is so broken, it needs kernel-level external software to protect it from attacks that should not be possible in the first place. It is a joke of history that this software was even worse than windows itself.
I see you're operating on a plane of reality where windows is the only bad software, so it's kinda pointless for me to continue here. I hope you have a wonderful day.
Windows is definitely not the only bad software, but for the amount of resources they could spend on quality, it is a rather shitty product. They could do better, but they don't want to.
I don't hear about billions of Linux or Mac computers going down all at the same time. I'm hearing that windows allows a simple text file change to bring down all of them at the same time.
Calling a kernel mode driver a "simple text file" sure is interesting
Even if you write assembly code straight out like a total hacker, it's still a text file. Literally jump 0x12345 is text. And if it's just a few kilobits long, then it's a simple text file yes. Got anything else to ad? Specially if the file actually doesn't work and the system made to run it "windows" is such shit that every copy of it got halted.
Yes and at the end of the day it's all just binary getting dumped into a cache and processed by the CPU. The point is that the intent of the file matters and while they do both hold text, the intent, purpose, and handling of the kernel mode/ring 0 driver is much different than a "simple text file"
So different in fact, that as another user pointed out, it has happened to Linux too
There is learning here.
As companies, we put faith in an external entity with goals not identical to our own: a lot of faith, and a lot of control.
That company had the power to destroy our businesses, cripple travel and medicine and our courts, and delay daily work that could include some timely and critical tasks.
This is not crowdstrike's fault; for the bad code yes, but for the indirect effects of that no. We knew - please tell me we had the brains god gave a gnat and we knew - that putting so much control in the hands of outsiders not concerned or aware of our detailed needs and priorities, was a negligent and foolish thing to do.
The lesson is to do our jobs: we need to ensure we have the ability to make the decisions to which were entrusted, and the power that authority gives us that our decisions when accepted are not threatened by a negligent mistake so boneheaded it's all but the whim of a simpleton. We cannot choose to manage our part of our organization effectively, no matter how (un)important that organization or part is, and then share control with a force that we've seen can run roughshod over it.
It's exactly like the leopards eating our face, except people didn't see they were leopards. No one blames the leopards, as they're just conforming to their nature, eventually.
And no one should blame this company for a small mistake, just because we let the jaws get so close to our faces that we became complacent.
Have you never worked in corporate IT or something? Of course we should blame Crowdstrike, that way we don't get a sev 1 on our scorecard.
Also:
Crowd strike should be held responsible, and with that I don't mean the developmers who were forced to do this shit, I mean the ceo, the CTO.
Jail them.
If you are so critical you better not fuck around and I can guarantee you, they were fucking around, pushing bad practices, etc. why do I say that? Because its lways like that
That comp ay should be dissolved, the C suite jailed.
Also, STOP USING WINDOWS FOR DESKTOP FOR FRACK SAKE. Switch to Linux already, I'm getting tired of having to read this shit.
If you're using windows for servers then you deserve your place right next to those C suite guys and gals
load more comments
(9 replies)
view more: next ›