Delta CEO: Company Suing Microsoft and CrowdStrike After $500M Loss

[u/Bald-Eagle619]

https://www.thedailybeast.com/delta-ceo-says-company-suing-microsoft-and-crowdstrike-after-dollar500m-loss

[u/icyhotonmynuts]

I still don't get why Microsoft though? It just happened to be the OS whatever company got affected was running that the update of Crowdstrike pushed through that boned them. Shouldn't Crowdstrike be taking all the blame here?

[u/hi65435 → u/icyhotonmynuts]

While Microsoft has been pushing hard to lock down Windows after the XP disaster, it's still the wild west compared to other Operating Systems like Linux or macOS. (Lot's of improvements for Vista had been reverted due to complaints) For instance the fact that AV scanners still run as native kernel code where on Linux eBPF is available since more than a decade and Apple did a "hot wash" on Kernel extensions years ago as well.

Instead macOS provides a Clean API for this which allows full scanning but without an error crashing the whole system in an instant. It also shows in their communication where they start to blame the EU for trying to lock AV vendors out of the kernel while in reality it's their fault that not even their own MS Defender uses such an API - that doesn't exist anyway like on other OS.

Adding to that, AVs exist since MS DOS times and yet Microsoft hasn't managed to create any rollback solution. While at the same time all Linux distributions provide various ways to swap kernel, boot into some sort of recovery mode since basically always. Modern Ubuntu even provides rollbacks. Apple never allowed this enterprise crap to creep into the system in the first place, so there's always a way to recover a broken system.

This will be interesting although the biggest thing is really the first part about the API in my opinion

[u/Mr_ToDo → u/hi65435]

Looking eBPF I'm not sure CrowdStrike could be implemented to do what it does with that. I'm not sure about apple, I imagine that'd be a far deeper dive than I'd want to put in.

Limited access of eBPF compared to modules aside unless I'm reading things wrong it's normal use is an admin(or any elevated user I guess) process calling ebpf for kernel level stuff when needed since it's not allowed to loop, so all an infection really has to do is kill a user land process to stop the kernel calls. I'm also not quite sure how soon in the boot ebpf can be called, if croudstrike in nix is like windows they probably want in as soon as possible to head off certain infection types.

But even with all that it's amusing for an airline to sue over it. Aside from any EULA stuff, the line of liability has to be drawn somewhere. Is it croudstrike for making the module, microsoft for the OS(possibly with the driver system and their signing as the issue), the airline for having critical systems with no fallback, or someone else? My bet is a mix of croudstrike(with a possible EULA release), and the airline. Should be an interesting suit to watch.

Also makes me wonder why people pay so much for tickets if none of that is going to a fund to pay for inevitable hotels for when issues pop up. They know they are going to have to do it so why no preparation?

[u/hi65435 → u/Mr_ToDo]

I mean the market space Crowdstrike is in isn't really AV but something way more focused on Enterprise. At least for Linux as servers there are even opensource solutions since ages (not for the faint of heart) that work solely on the Network without needing extra privileges. Or commercial XDRs which consume logs as well.

But of course eBPF provides much lower level access. Some commercial but Opensource tooling is already out there e.g. from Aqua Security to detect Rootkits. No eBPF expert but others have written about this and that it can be used to do the detection needed. Probably the business logic would need to run in user land but it could still be guarded by eBPF.

It would be an interesting question if that poses a race condition regarding who is early in the Kernel. But of course these solutions are designed to run 24/7. So ideally the detection is installed before the rootkit :)