slazer2au 36 points a year ago

Inb4 an out of court settlement happens in about a year and a half with CS not admitting fault but paying an undisclosed amount to Delta.

The Atlanta-based judge also let Delta pursue a computer trespass claim, and a narrowed claim that CrowdStrike fraudulently promised not to introduce an "unauthorized back door" into the carrier's computers.

Also, this will be interesting.

save

path: 0 17162497, hotness: undefined, score: 36, children: 11

Max_P 22 points a year ago

unauthorized back door

Isn't autoupdating software by definition an authorized backdoor by virtue of enabling it? The whole premise of CrowdStrike is continuous updates for attacks they see in the wild on other companies' systems.

Also if anything CrowdStrike did the opposite of a backdoor since everyone needed to find their BitLocker keys to get back in and clean this mess. It locked out the front and back door.

save

path: 0 17162497 17162805, hotness: undefined, score: 22, children: 10

ricecake 17 points a year ago

There was an additional auto update function that wasn't disclosed. Delta had disabled the auto update because, like many large companies, they prefer to deploy changes incrementally so that an issue doesn't blow-up all their systems at once.

So...

Isn't autoupdating software by definition an authorized backdoor by virtue of enabling it?

Yes. Which is why they contend disabling it makes it unauthorized.

save

path: 0 17162497 17162805 17163838, hotness: undefined, score: 17, children: 3

SupraMario 2 points a year ago

That's not how that works. CS didn't have at the time, an option to disable channel file updates. It's how their edr works. Delta's mssp or secops group, %100 knew this as it's in CS own documentation. They really don't have a foot to stand on here, but CS will pay it to make it go away.

save

path: 0 17162497 17162805 17163838 17166216, hotness: undefined, score: 2, children: 2

ricecake 4 points a year ago

CS didn't have at the time, an option to disable channel file updates

Yes, that's the crux of the accusation. Given the large number of people who seemed to be under the impression that selecting a staggered release cadence would protect them from a faulty update, it's not unreasonable to think that people were caught off guard by a second autoupdate system that they couldn't configure that could also tank their system.

save

path: 0 17162497 17162805 17163838 17166216 17168540, hotness: undefined, score: 4, children: 1

slazer2au 5 points a year ago

I wouldn't call an auto update mechanism an unauthorised backdoor, it is required behaviour for that kind of software.

save

path: 0 17162497 17162805 17162903, hotness: undefined, score: 5, children: 4

ricecake 6 points a year ago

It's absolutely not required behavior! Software for servers has very different requirements from software for end users, and if you have a lot of them you also want to manage your end user machines differently.

Updates can go wrong, and if you roll out a bad update to everything at once you can crash everything and lose a lot of money. As aptly demonstrated by cloudstrike.

That's why Delta and many other companies disabled the auto update functions: so they could control the rollout cadence.
They reasonably believed that disabling autoupdates disabled them. They didn't expect a second autoupdate system that wasn't documented, wasn't controlled by the autoupdate system settings and couldn't be disabled.

save

path: 0 17162497 17162805 17162903 17164329, hotness: undefined, score: 6, children: 3

SupraMario 1 point a year ago

It's not a second auto update. It's %100 documented in the software and you can %100 throttle it. Channel files are heavily discussed when you roll out CS.

save

path: 0 17162497 17162805 17162903 17164329 17166255, hotness: undefined, score: 1, children: 2

jagged_circle 1 point a year ago

Yes crowd strike is a huge security risk

save

path: 0 17162497 17162805 17173555, hotness: undefined, score: 1, children: 0

Stamets 15 points a year ago

save

path: 0 17162431, hotness: undefined, score: 15, children: 9

oldfart 7 points a year ago

I feel sorry fot you but I must ask, was it literal shit?

save

path: 0 17162431 17162840, hotness: undefined, score: 7, children: 5

Stamets 7 points a year ago

save

path: 0 17162431 17162840 17163555, hotness: undefined, score: 7, children: 4

oldfart 5 points a year ago

Holy shit. No permanent damage?

save

path: 0 17162431 17162840 17163555 17164226, hotness: undefined, score: 5, children: 3

Stamets 4 points a year ago

save

path: 0 17162431 17162840 17163555 17164226 17164261, hotness: undefined, score: 4, children: 2

wetbeardhairs 4 points a year ago

is Stupid Addiction a band name?

save

path: 0 17162431 17165813, hotness: undefined, score: 4, children: 0

HakunaHafada 3 points a year ago

... their stupid addiction tickets?

What are addiction tickets?

save

path: 0 17162431 17175808, hotness: undefined, score: 3, children: 1

Stamets 2 points a year ago

save

path: 0 17162431 17175808 17181849, hotness: undefined, score: 2, children: 0

SaltSong 12 points a year ago

Did any of the passengers on those 7,000 flights get any compensation? Or just a "so sorry, out of our control?"

Looks like delta tried to dismiss the passengers claims, but they are being sued for it.

save

path: 0 17173041, hotness: undefined, score: 12, children: 0

RememberTheApollo_ 6 points a year ago

I work for a company that formerly used CrowdStrike. Since the event we no longer do.

save

path: 0 17170056, hotness: undefined, score: 6, children: 0

Envy 5 points a year ago

save

path: 0 17162898, hotness: undefined, score: 5, children: 0

sunzu2 1 point a year ago

save

path: 0 17163371, hotness: undefined, score: 1, children: 0

Nomad_Scry 0 points a year ago

When this happened it was pretty clear (to me, I was at least) that Delta didn't have an actual BCP. This is their CYA lawsuit and should be throw out - their negligence predates CloudStrike's incompetence.

save

path: 0 17167982, hotness: undefined, score: 0, children: 1

timbuck2themoon 5 points a year ago

That notwithstanding, iirc the update was pushed to all of their "rings" even the n+2 or whatever.

Cs clearly fucked up and I don't see why they shouldn't be penalized for it.

save

path: 0 17167982 17169476, hotness: undefined, score: 5, children: 0