CrowdStrike Blog

This is a great early detection mechanism for malware. Providers like Crowdstrike https://www.crowdstrike.com/ already aggregate results of malware scans for customers. This is different because it is National CSIRT of the Czech Republic and because it is a honeypot, it will let the attacker use more commands.

Crowdstrike | Irvine, Sunnyvale, Seattle, DC, Other Cities, Remote | Fulltime | ONSITE or REMOTE | http://www.crowdstrike.com/ CrowdStrike Stops Breaches. We're a rapidly growing company that raised >$300M from awesome investors like Accel, CapitalG, Warburg Pincus, March Capital, Telstra and others. We're growing our team of software and devops engineers to help scale our automation of our software and systems. Give us a shout if you're interested in the following areas, with other information listed at : http://www.crowdstrike.com/careers/ My team is hiring folks to help with Network Engineering, Linux Automation (Thanks Linus!!), and Virtualization. We're also hiring linux engineers (devops/sysadmins) across Europe and Data Center techs in Germany (Berlin/Frankfurt). Other teams hiring a bunch - I think we have around 100 open positions right now. We have a real devops approach - very egalitarian and enabling of engineers. There's tremendous mutual respect and as a result, we get a lot of leading edge stuff done very efficiently. Come join us! Contact us at http://www.crowdstrike.com/careers/. You're welcome to ping me at alan dot hannan at crowd strike dot com for any questions. I manage a team here and enjoy my job and coworkers. Around 50% of company engineers work remotely, we have major offices in Sunnyvale, Irvine, Seattle, Kirkland, Minneapolis, DC/Virginia, London, Bucharest, and Pune.

So there will be congress public hearings on this, and the CEO will probably be called to testify. The company has been heavily outsourcing development to India, and it's not the kind of cultural environment where a Developer is going to push back and request more time for testing. CEO will of course blame some low level employees who did not follow procedures... "CrowdStrike Significantly Invests in India Operations to Continue Protecting Businesses from Modern Cyber Attacks" - https://www.crowdstrike.com/press-releases/crowdstrike-invests-in-indi…

CrowdStrike https://www.crowdstrike.com › resources › infographics Learn how CrowdStrike keeps your critical areas of risk such as endpoints, cloud workloads, data, and identity, safe and your business running

>1. Microsoft themselves could potentially enforce a gradual rollout on updates (did the update go through windows updates?) No. The crash was caused by a "configuration update", not through code pushed through windows update. https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-techn… >2. Have better automatic recovery options, could windows have detected the bad driver and reverted it automatically? see: https://news.ycombinator.com/item?id=41019743 >3. just generally be more resilient, why should one bad driver take everything down? It's kernel mode. With great power comes great responsibility. Blaming the OS is like blaming linux that you can sudo rm -rf /.

Compliance based stuff... "do you trust this machine to access your network/services/applications and execute these commands?" https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoi… (the VMWare owned product isn't CrowdStrike, that just had the best SEO page with a clear description. VMWare have Carbon Black which is the other dominant player in this market https://www.vmware.com/uk/products/whats-new/carbon-black.html )

The original write-up is linked from this post https://www.crowdstrike.com/blog/cr8escape-new-vulnerability-discovere… - Good, lots of details on exact reproduction. One idea for mitigation before you can get a patch out for this would be to use admission control (e.g. OPA/Kyverno) to block setting custom sysctls altogether or blocking the characters used in the attack. There's some notes on that https://blog.aquasec.com/cve-2022-0811-cri-o-vulnerability and Kyverno have a mention of the finer grained policy https://twitter.com/kyverno/status/1504499323324678145 One thing that's worth noting is that to exploit this the attacker needs create pod rights (or rights to create a workload type that then creates pods), so it's probably not critical for every cluster.

While encrypted DNS does conceal the domain name from the ISP, it also prevents the ISP from intentionally returning an incorrect IP address in response to a DNS request. This behavior is known as DNS cache poisoning[1] (or DNS spoofing) and has been used by governments to censor websites and perform DDoS attacks on other websites.[2] [1] https://en.wikipedia.org/wiki/DNS_spoofing [2] https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewall-art-dns-…

They may be something other than 3d active, but have that appearance: https://www.crowdstrike.com/ https://www.bain.com/ https://www.accenture.com/us-en That's with a few minutes of just searching various consulting type firms.

> Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some. We use https://www.crowdstrike.com/ and never had any issues so far. Very low CPU usage, no false positives. Not sure if it actually does anything ;).

> Desktop/laptop malware scanners notoriously use up CPU at murphaicly inconvenient moments. This isn't true at all. Sure for many "traditional" AV solutions it might be. But there is a pretty strong growing trend to use "next-gen" endpoint/AV protection that is extremely lightweight, so much so that users won't see any impact at all. https://www.sentinelone.com/ https://www.crowdstrike.com/ https://www.carbonblack.com/

https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… At this point it's essentially impossible to make a credible claim that Russia did not compromise the DNC network. At best you could try to argue that they weren't the only ones to do so, but that feels like grasping at straws.

If Alex happens to drop by: what happened to DriverMon? Clearly Alex has been very busy but he mentioned the GUI-fication of the tool was being handled by his co-worker Robin Keir. "Abusing the NT Kernel Shim Engine" by Alex Ionescu at REcon 2016 (October) https://www.youtube.com/watch?v=qCa9icMqBNM?t=48m55s a tool called DriverMon is planned for release at the conference, which uses the KSE to provide ProcMon for Drivers Will be available from https://www.crowdstrike.com/resources/community-tools/ Will announce release on Twitter in a few weeks -- Waiting for this has reinforced my belief that vaporware (or whatever is preventing the release of this tool) has served as the best deterrent preventing anyone else from running with this undocumented tech!

> My read of it Here's some reading material that you missed: https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-M… https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… http://www.threatgeek.com/2016/06/dnc_update.html https://www.threatconnect.com/guccifer-2-0-dnc-hack-fancy-bears/ > One must believe not only that Putin meddled, but that he saw Trump's victory as a sure thing and worth risking escalation over. Or that he wanted to delegitimize the Clinton presidency. > It seems likely that if someone like HRC or McCain had been in office, retaliatory military action by the US might have occurred. Nonsense. Increased economic sanctions are more effective against Russia's failing petroeconomy.

They literally half-assed their deployment process - one part enterprisey, one part "move fast and break things". Guess which part took down much of the corporate world? from Preliminary Post Incident Review at https://www.crowdstrike.com/falcon-content-update-remediation-and-guid… : "CrowdStrike delivers security content configuration updates to our sensors in two ways: Sensor Content that is shipped with our sensor directly, and Rapid Response Content that is designed to respond to the changing threat landscape at operational speed. ... The sensor release process begins with automated testing, both prior to and after merging into our code base. This includes unit testing, integration testing, performance testing and stress testing. This culminates in a staged sensor rollout process that starts with dogfooding internally at CrowdStrike, followed by early adopters. It is then made generally available to customers. Customers then have the option of selecting which parts of their fleet should install the latest sensor release (‘N’), or one version older (‘N-1’) or two versions older (‘N-2’) through Sensor Update Policies. The event of Friday, July 19, 2024 was not triggered by Sensor Content, which is only delivered with the release of an updated Falcon sensor. Customers have complete control over the deployment of the sensor — which includes Sensor Content and Template Types. ... Rapid Response Content is used to perform a variety of behavioral…

To answer some of my questions based on the "Preliminary Post Incident Review", the config file was indeed invalid, it was only checked with a (buggy) validator, and then released to the whole world at once. Never was the config file ever tested with the actual software that would read it in an actual environment like the customer machines that got this update. They don't say why it was invalid or really what the file is, but it seems like it is some kind of relatively complex set of rules that are evaluated by the kernel module. Presumably they are manually authored and reviewed and it seems possible the bug was missed in review because this was a relatively new type of rule. So this isn't a case of an incident that slipped through a rigorous testing and release process process following industry best practice, but rather a "disaster waiting to happen". Further, CrowdStrike CEO George Kurtz should have known better, considering an analogous incident happened under his watch as CTO of McAfee in 2010. https://www.crowdstrike.com/falcon-content-update-remediation-and-guid…

Recommend taking a read of CrowdStrike's write up on this [1]. The threat actor maintains a presence on the roaming exchange through compromising "at least 13 telecommunication companies". > If it's the former, then it seems very un-stealthy In this article there is one example where the outbound connectivity to the Internet was via a "SGSN emulator in a loop, attempting to connect to a set of nine pairs of International Mobile Subscriber Identity (IMSI) and Mobile Subscriber Integrated Services Digital Network (MSISDN) numbers." In this example, the transit traffic before egress to the Internet would appear to be legitimate subscriber traffic - user payload encapsulated in a PDP context / GTP tunnel to another telco's GGSN / packet gateway. > Which, maybe they don't care, but it seems like they're risking blacklisting. By compromising so many telcos, there are many points of redundancy for persistence on the roaming exchange. This threat actor has remained on telco networks for many years undetected - their techniques are apparently are quite effective. [1] https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommuni…

Taking you at your word, that's a tough position to be in. Energy is a hot sector to be attacking, so that is points in your favor, but unless it's some extension of Russian military/Wagner I'm not sure white supremacists make sense. It really doesn't make sense that they would contact you unless it's ransomware. Frankly the question I'm asking myself most right now is "is this some kind of phishing?" followed by "is this schizophrenia?" A CEO or CTO might prefer denial. If you want to pursue that route, then perhaps find a CISO or head of security of some sort, perhaps an administrator in IT. Were I in those positions I would definitely want to at least perform a few sanity checks. Politics can be awful if you don't have competent people around you. A competent security person would definitely be concerned about compromised employees. Corporate environments are likely to punish someone for coming forward greatly disincentivizing that behavior while sane companies would be happy someone took responsibility and came to them despite the risks of getting blamed. Mandiant and Crowdstrike are two entities you might consider, they are big and corporate, so hard to know how that would turn out. https://www.mandiant.com/contact-us https://www.crowdstrike.com/services/experienced-a-breach/ You could try to send e-mails to individuals, either people who have given talks at security conferences or people in local colleges. You could try people working in journalism, they might…

I may be misunderstanding this; can you help me out and be specific about what you mean by DNC email leaks? If we’re talking about the Guccifer 2.0 leaks, it seems relevant to note that in October of 2016, the US intelligence community stated that they were confident that Russia was involved. Mueller also indicted 12 Russian nationals on related charges. There is currently a fair bit of evidence that yes, the Guccifer leaks were Russian based. Now, perhaps your objection is that media outlets reported this prior to those findings. For politically charged questions like these, I’d recommend that you still include the post-facto findings I reference, since otherwise your audience could wind up with the understanding that our knowledge about the hacks is limited to the reporting you mention. Back to the question of “auditors” — let’s once again be specific. The DNC hired CrowdStrike to investigate the hack. Their initial response and follow ups are here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… CrowdStrike used stronger words than “likely.” Some of them: “We deployed our IR team and technology and immediately identified two sophisticated adversaries on the network – COZY BEAR and FANCY BEAR.” “At DNC, COZY BEAR intrusion has been identified going back to summer of 2015, while FANCY BEAR separately breached the network in April 2016.” The report does not go into detail on methods, for obvious reasons. But that is the statement…

CrowdStrike | Senior Platform / Data Engineer | Remote (or Sunnyvale), USA | REMOTE CrowdStrike is the leader in cloud-delivered next-generation endpoint protection, threat intelligence, and pre- and post-incident response services. With the ability to collect and process over 100 billion events a day, CrowdStrike has revolutionized endpoint protection by being the first and only company to unify next-generation antivirus (AV), endpoint detection and response (EDR), and a 24/7 managed hunting service — all delivered via a single lightweight agent. We are one of the World's Most 50 Innovative Companies according to MIT, and one of Forbes Most Promising Companies. Our growth and innovation are driven by incredible employees who deliver unmatched customer success. We are looking to hire a Senior Platform/Data Engineer for the Data Engineering team at CrowdStrike. The Data Engineering team operates within the Data Science organization, and provides the necessary infrastructure and automation for users to analyze and act on vast quantities of data effortlessly. The team has one of the most critical roles to play in ensuring our products are best-in-class in the industry. You will interact with product managers and other engineers in building both internal and external facing services. Technologies we work with : Golang, Python, Docker, K8, Chef, Terraform, Jenkins, Kafka, Cassandra, Postgres, Git, Spark, Hadoop, AWS etc More career openings here:…

Yeah, you're correct a lot of the emails use 2048-bit RSA for the DKIM signature. I trust those more than the 1024-bit signatures. I have a pretty heavy distrust of all of this, because from the sidelines I can't tell who is manipulating what. I don't blindly trust the cryptography because I don't know the capabilities of the adversary or what side channel attacks were present. That probably sounds stupid, but I'm feeling a whole lot of distrust of everyone involved. Following that, my assertion that hillaryclinton.com was compromised was completely evidence-free. That's a personal assumption due to the significant lack of security expertise by the maintainer of the server. There are plenty of emails sent between clintonemail.com and the DNC gmail accounts that CC Podesta and were included in the Wikileaks dumps. The DNC was hacked by two Russian actors according to CrowdStrike. I trust CrowdStrike in this assessment. https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati…

"zero evidence" is completely wrong. here's the crowdstrike writeup about the dnc hacks and their reasoning for linking it to russian state hackers: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… there were also, iirc, at least six other private security companies that came to the same conclusion, who weren't hired by the dnc. additionally, every US intelligence agency backed up the claim. again, not a proven statement, but there's a substantial amount of evidence we're aware of. >First, they attempted to claim that emails have been tampered with and then when DKIM signatures proved that hypothesis wrong, they shifted their tactics. do you have a source for the first part? afaik it was just twitter randos floating the idea i'm not a partisan in this fight. i didn't vote, i despised both candidates, but i also think both sides can be a little blind in their eagerness to paint the other as disingenuous. i'm very interested in this subject and it's one i've followed closely, and i'm reasonably sure russian state actors were behind the dnc and podesta hacks, but i also think it's worth keeping an open mind as a general principle and not to be blinded by ideological alliances.

This blog post is part of a longer trail of breadcrumbs that is spread out across multiple sources and over a long period of time. It started with the WashPo story[0] on the DNC hack and the CrowdStrike attribution (there were some good rebuttal stories at that time, I think they have changed their minds) and now you have 10-15 different sources kicking this story further down the road each day. That's how journalism is changing - rather than having 2-3 investigative reporters at one newspaper do a one year investigation then publish their in-depth series (pass go, collect pulitzer etc.) the large stories are now often broken down piecemeal and worked on in public over time. It means many more experts can work on it and the stories are better for it - but the downside is that they're very difficult to keep track of (the only way is Twitter or reddit, IMO - and the netsec reddit is horrible with approving stories). If you come into it part way you can feel lost because the writers assume you've been following along (which is a mistake) I've honestly probably read 100+ stories on this thread, likely more. At this stage you need to bring the thread back together yourself with Google or starting with the Wikipedia pages[2][3] [0] https://www.washingtonpost.com/world/national-security/russian-governm… [1]…

> Maybe I'm not up to date but what kind of evidence exactly? Could you give a source? Wired: "According to a number of top cybersecurity researchers, they're probably right." (https://www.wired.com/2016/07/heres-know-russia-dnc-hack/) Wired cites the following firms: Crowdstrike, Fidelis Cybersecurity, Mandiant... and a professor named Thomas Rid. Apparently Crowdstrike is the firm hired by the DNC specifically (https://www.washingtonpost.com/world/national-security/russian-governm… but there's more than one organization mentioned. New York Times: "American intelligence agencies have told the White House they now have “high confidence” that the Russian government was behind the theft of emails and documents from the Democratic National Committee, according to federal officials who have been briefed on the evidence." (http://www.nytimes.com/2016/07/27/us/politics/spy-agency-consensus-gro… Reuters: "U.S. intelligence officials told top congressional leaders a year ago that Russian hackers were attacking the Democratic Party, three sources familiar with the matter said on Thursday, but the lawmakers were unable to tell the targets about the hacking because the information was so secret." (http://www.reuters.com/article/us-usa-election-democrats-hack-idUSKCN1… The Daily Beast: "The researchers, at Arlington, Va.-based…

"""" CrowdStrike Services Inc., our Incident Response group, was called by the Democratic National Committee (DNC), the formal governing body for the US Democratic Party, to respond to a suspected breach. We deployed our IR team and technology and immediately identified two sophisticated adversaries on the network – COZY BEAR and FANCY BEAR. We’ve had lots of experience with both of these actors attempting to target our customers in the past and know them well. In fact, our team considers them some of the best adversaries out of all the numerous nation-state, criminal and hacktivist/terrorist groups we encounter on a daily basis. Their tradecraft is superb, operational security second to none and the extensive usage of ‘living-off-the-land’ techniques enables them to easily bypass many security solutions they encounter. In particular, we identified advanced methods consistent with nation-state level capabilities including deliberate targeting and ‘access management’ tradecraft – both groups were constantly going back into the environment to change out their implants, modify persistent methods, move to new Command & Control channels and perform other tasks to try to stay ahead of being detected. Both adversaries engage in extensive political and economic espionage for the benefit of the government of the Russian Federation and are believed to be closely linked to the Russian government’s powerful and highly capable intelligence services. COZY BEAR (also referred to in some…

> a little description of what happened other than the "Cozy Bear" story would be great. Crowdstrike has published some information on what they found: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nati… A second firm claims the same malware was used in other high profile attacks: http://news.softpedia.com/news/second-security-firm-says-russian-hacke… > BTW - crowdstrike.com was registered in 2010 with GoDaddy, not exactly trust inspiring. Google Capital and Rackspace seem to think they are legit: https://techcrunch.com/2015/07/13/security-company-crowdstrike-scores-… > From NYT I'd expect something better than "Evidence so far suggests" with zero evidence presented. Well, they've been wrong before... http://www.popsci.com/military-aviation-amp-space/article/2009-07/new-…

Crowdstrike: Senior & Junior UI Engineers - London - above average salary + bonus + options http://www.crowdstrike.com We’re a security startup that uses a realtime stream of data from our kernel module on every machine in our clients’ networks to keep out some of the world’s most sophisticated attackers. Big data like you wouldn’t believe and a whole host of fascinating engineering challenges, we’re literally changing what is possible in system security. We’re very well funded & growing fast. We’re looking for JS engineers to help build the next generation of security interfaces, lots of Ember, data visualisation and the opportunity to build in close collaboration with end users. We’re building a welcoming and flexible team that prizes collaboration over competition and gives everyone the opportunity to contribute to the direction of the team and the products we’re responsible for. Full descriptions & application below but if you’ve got questions feel free to email me (UI Lead) directly - alex dot graul at crowdstrike dot com Junior: http://j.mp/cs-ui-jnr Senior: http://j.mp/cs-ui-snr

There's already some evidence that this is happening. See: https://www.crowdstrike.com/en-us/blog/crowdstrike-researchers-identif… (note that I haven't found independent verification or reproduction of these claims).

It's a security practice. https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/shi…

I don't have any trust in these Chinese models to write code either: "CrowdStrike Research: Security Flaws in DeepSeek-Generated Code Linked to Political Triggers " [https://www.crowdstrike.com/en-us/blog/crowdstrike-researchers-identif…