CrowdStrike ex-employees: 'Quality control was not part of our process'

Re:CrowdStrike ex-employees: 'Quality control was not part o... by Fnoord on Saturday September 14, 2024 @07:23AM (#41539062)

Sure, storage. Networking though? SIEMs receive and send data unencrypted? They should not. By sending the data in plain text you open up an attack surface to anyone sniffing the network.

[ Parent | on HN ]

Re:CrowdStrike ex-employees: 'Quality control was not part o... by notepad0x90 on Saturday September 14, 2024 @06:25PM (#41543527)

Crowdstrike like many EDRs uses mutually authenticated TLS to send the data over the network to their cloud.

[ Parent | on HN ]

Re:CrowdStrike ex-employees: 'Quality control was not part o... by Fnoord on Wednesday September 18, 2024 @09:27PM (#41587539)

OP said:

> Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text.

So this person claims the data isn't send using TLS. I didn't verify the claim myself though.

[ Parent | on HN ]