News for hackers. Stuff that matters.
Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by trhway on Sunday August 11, 2024 @03:35PM (#41218759)
Because people on the receiving end are the same - they accepted and rolled out the update without even as much as “canarying” it. SolarWind was the same - the customers weren’t bothered even by mismatched integrity hashes. It is a tacit pact in our industry - we all screw up and cut the slack to each other. Who will cast the first stone?
Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by yjftsjthsd-h on Sunday August 11, 2024 @04:05PM (#41218953)
> they accepted and rolled out the update without even as much as “canarying” it.

Well, no; AIUI part of the problem was precisely that this update was pushed in such a way that it skipped any canary system in place. There might be a separate conversation to question what percentage of their users were taking advantage of its staged rollout features, but it's rather immaterial when the incident in question bypassed them even if users had configured it sensibly.

Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by sisve on Sunday August 11, 2024 @04:45PM (#41219207)
But the customer installed CS software could do this. So they are partly to blame. I do not think you will find that tesla would allow a third party update to its car. Or a oil rig would allow third party updates to critical parts of its systems. So its understanding the context. I think a lot of places this is an risk that is ok. But maybe not everywhere. And I hope some companies with critical systems will learn from this
Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by yjftsjthsd-h on Monday August 12, 2024 @01:27AM (#41221355)
> But the customer installed CS software could do this. So they are partly to blame.

It depends on if/how it was communicated. If there's a big red box in the user manual that says, "this software might take updates that completely bypass any phased rollout you configure", then yes it was probably irresponsible to use it. If, however, the software lets you configure phased rollouts and fails to mention that they might just get ignored, then I don't see how the customer can be blamed at all. (And in both cases, if CS shipped such an update with exactly zero testing whatsoever, which strains credulity but is what I've read, then they still get most of the blame.)

Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by shrubble on Sunday August 11, 2024 @03:48PM (#41218859)
Crowdstrike can force-push an update at any time of their choosing that the connected device will grab and load, is my understanding.
Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by trhway on Sunday August 11, 2024 @03:53PM (#41218878)
Don’t you see that you’re only enforcing my point?
Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by shrubble on Sunday August 11, 2024 @06:03PM (#41219605)
No, because "canary" in the context that you used it, has a specific meaning. If you believe they should have tested CrowdStrike more or been more skeptical of their claims before licensing, that's independent of the user/administrators doing canary-style testing.
Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by miguelazo on Sunday August 11, 2024 @04:01PM (#41218917)
What’s the default? And what did their technical account manager recommend? My guess, no canary ring.