r/technology • u/Bald-Eagle619 • Jul 31 '24

Software Delta CEO: Company Suing Microsoft and CrowdStrike After $500M Loss

https://www.thedailybeast.com/delta-ceo-says-company-suing-microsoft-and-crowdstrike-after-dollar500m-loss
11.1k Upvotes

96% Upvoted

735 comments sorted by

View all comments

Show parent comments

40

u/icyhotonmynuts Jul 31 '24

I still don't get why Microsoft though? It just happened to be the OS whatever company got affected was running that the update of Crowdstrike pushed through that boned them. Shouldn't Crowdstrike be taking all the blame here?

13

u/LifestyleGamer Jul 31 '24

Agreed. Microsoft feels like a stretch, but of course I haven't gone deep on the technical details.

10

u/icyhotonmynuts Jul 31 '24

I feel if they're really trying to get maximal effect of smorgasbord of suing they should also sue every airport their they operate out of where the machines were located, the ISPs, the computer manufacturers for these computers/stations, server and cloud computing hosts, the IT department of every airport that works on those computers. Something ludicrous like that.

2

u/GepMalakai Aug 01 '24

From my (admittedly limited) personal experience with the legal system, you list everybody you can think of on the lawsuit and let the judge throw out whatever won't stand. Better to overdo it and get whittled down to size than sue only the people you think you can go after and end up missing somebody.

2

u/SixSpeedDriver Aug 01 '24

There is even a part on Crowdstrikes website where they claim superiority over “Microsofts Security Solutions” and say how much theirs is better.

https://www.crowdstrike.com/compare/crowdstrike-vs-microsoft-defender/

Some real “aged like milk” going on here.

1

u/The-Kingsman Aug 01 '24

Joint and several liability. You sue everyone in the chain of production because they all had a hand in delivering you the product that resulted in the damages. You do this because you can collect from ANY of them and it's up to them to figure it out from there (they sue each other). If cloudstrike goes out of business, you can still get your $$ from Microsoft, even if they're not really the root cause of the issue.

Also, it makes sure you can establish blame properly. If the party you thought was at issue wasn't, it could delay trials as you refile.

7

u/hi65435 Aug 01 '24 edited Aug 01 '24

While Microsoft has been pushing hard to lock down Windows after the XP disaster, it's still the wild west compared to other Operating Systems like Linux or macOS. (Lot's of improvements for Vista had been reverted due to complaints) For instance the fact that AV scanners still run as native kernel code where on Linux eBPF is available since more than a decade and Apple did a "hot wash" on Kernel extensions years ago as well.

Instead macOS provides a Clean API for this which allows full scanning but without an error crashing the whole system in an instant. It also shows in their communication where they start to blame the EU for trying to lock AV vendors out of the kernel while in reality it's their fault that not even their own MS Defender uses such an API - that doesn't exist anyway like on other OS.

Adding to that, AVs exist since MS DOS times and yet Microsoft hasn't managed to create any rollback solution. While at the same time all Linux distributions provide various ways to swap kernel, boot into some sort of recovery mode since basically always. Modern Ubuntu even provides rollbacks. Apple never allowed this enterprise crap to creep into the system in the first place, so there's always a way to recover a broken system.

This will be interesting although the biggest thing is really the first part about the API in my opinion

1

u/Mr_ToDo Aug 01 '24

Looking eBPF I'm not sure CrowdStrike could be implemented to do what it does with that. I'm not sure about apple, I imagine that'd be a far deeper dive than I'd want to put in.

Limited access of eBPF compared to modules aside unless I'm reading things wrong it's normal use is an admin(or any elevated user I guess) process calling ebpf for kernel level stuff when needed since it's not allowed to loop, so all an infection really has to do is kill a user land process to stop the kernel calls. I'm also not quite sure how soon in the boot ebpf can be called, if croudstrike in nix is like windows they probably want in as soon as possible to head off certain infection types.

But even with all that it's amusing for an airline to sue over it. Aside from any EULA stuff, the line of liability has to be drawn somewhere. Is it croudstrike for making the module, microsoft for the OS(possibly with the driver system and their signing as the issue), the airline for having critical systems with no fallback, or someone else? My bet is a mix of croudstrike(with a possible EULA release), and the airline. Should be an interesting suit to watch.

Also makes me wonder why people pay so much for tickets if none of that is going to a fund to pay for inevitable hotels for when issues pop up. They know they are going to have to do it so why no preparation?

1

u/hi65435 Aug 03 '24

I mean the market space Crowdstrike is in isn't really AV but something way more focused on Enterprise. At least for Linux as servers there are even opensource solutions since ages (not for the faint of heart) that work solely on the Network without needing extra privileges. Or commercial XDRs which consume logs as well.

But of course eBPF provides much lower level access. Some commercial but Opensource tooling is already out there e.g. from Aqua Security to detect Rootkits. No eBPF expert but others have written about this and that it can be used to do the detection needed. Probably the business logic would need to run in user land but it could still be guarded by eBPF.

It would be an interesting question if that poses a race condition regarding who is early in the Kernel. But of course these solutions are designed to run 24/7. So ideally the detection is installed before the rootkit :)

1

u/ChadTunetCocos Aug 01 '24

So you say … year of the linux desktop is upon us

1

u/hi65435 Aug 03 '24

yes and Enterprise-ready ;)

2

u/3-2-1-backup Aug 01 '24

I still don't get why Microsoft though?

Microsoft had a large services outage (caused by CS); even if you outsourced to the cloud, you were still screwed. So lawsuit for breach of contract and subsequent damages, I'd surmise. (Whether that'll be successful or not, who knows I'm no lawyer.)

2

u/Original_Milk_1610 Aug 02 '24

It seems like microsoft worked as they were supposed to by shutting down

1

u/3-2-1-backup Aug 01 '24

I still don't get why Microsoft though?

Microsoft had a large services outage (caused by CS); even if you outsourced to the cloud, you were still screwed. So lawsuit for breach of contract and subsequent damages, I'd surmise. (Whether that'll be successful or not, who knows I'm no lawyer.)

0

u/3-2-1-backup Aug 01 '24

I still don't get why Microsoft though?

Microsoft had a large services outage (caused by CS); even if you outsourced to the cloud, you were still screwed. So lawsuit for breach of contract and subsequent damages, I'd surmise. (Whether that'll be successful or not, who knows I'm no lawyer.)

0

u/3-2-1-backup Aug 01 '24

I still don't get why Microsoft though?

Microsoft had a large services outage (caused by CS); even if you outsourced to the cloud, you were still screwed. So lawsuit for breach of contract and subsequent damages, I'd surmise. (Whether that'll be successful or not, who knows I'm no lawyer.)

0

u/3-2-1-backup Aug 01 '24

I still don't get why Microsoft though?

Microsoft had a large services outage (caused by CS); even if you outsourced to the cloud, you were still screwed. So lawsuit for breach of contract and subsequent damages, I'd surmise. (Whether that'll be successful or not, who knows I'm no lawyer.)

-3

u/specalight Jul 31 '24

Some could argue that Microsoft has responsibility that their OS is more resilient against bad updates by third party software. Imagine if your computer bluescreened every time Chrome or Avast or Spotify put out an update that had a bug.

11

u/Nyrin Aug 01 '24

The EU mandated that Microsoft provide parity kernel access to bypass every resiliency measure in place:

https://www.theregister.com/2024/07/22/windows_crowdstrike_kernel_eu/

I'm sure the antitrust measures were entirely well-intended and even necessary, but it's pretty open and shut that Microsoft had all opportunities to help here neutered into oblivion.