The IT Nerd

This is not a good look for cybersecurity company Crowdstrike.

A bad update for the CrowdStrike Falcon antivirus product installed on Windows PCs has taken down millions of PC globally. I am hearing stories of flights being grounded, Sky News being taken off air for a few hours, and retailers being unable to sell anything.

In short, this is extraordinary bad.

This is made worse by the CEO of CrowStrike who decided to Tweet. This Tweet was not a good idea:

The problem with this Tweet is that he completely failed to apologize for basically taking down the entire planet because of a screw up with his product. If I used his product, I’d be looking to move to some other antivirus product. Because this Tweet to be frank, sucks.

There is a workaround that was posted to Reddit. But it will have to be done on a PC by PC basis. Which means that companies could be down for days. Which is of course bad.

I’ll be watching this situation and posting updates when it warrants an update. But this situation is bad and likely won’t improve for a while. And when this is resolved, CrowdStrike will have a whole lot of explaining to do.

At this year’s RSA Conference, CrowdStrike’s Joshua Shaprio said this:

In short, Crowstrike has been dealing with about one malwareless cyber issue a week during the last couple quarters reaffirming data reported earlier this year that 71% of cyberattacks were carried out without malware and highlighting the challenges cybersecurity teams face trying to combat such compromises.
Using a case study, the two illustrated the “layer A problem” involving the bad actor’s in-depth reconnaissance and use of dedicated machines to hide identities and avoid detection resulting in the threat actors set up with their own users on the network, free to exfiltrate data, compromise the cloud, and add themselves as a SQL server admin.

During their RSA keynote, both CrowdStrike CEO George Kurtz and President Michael Sentonas used a case study to illustrate the “layer A problem” involving the bad actor’s in-depth reconnaissance and use of dedicated machines to hide identities and avoid detection resulting in the threat actors set up with their own users on the network, free to exfiltrate data, compromise the cloud, and add themselves as a SQL server admin. More on that in a moment.

From an Akamai report on that attack:
 
    “The attack starts with a password brute-force on the MySQL service. Once successful, the attacker runs a sequence of queries in the database, gathering data on existing tables and users. By the end of execution, the victim’s data is gone – it’s archived in a zipped file which is sent to the attackers’ servers and then deleted from the database. A ransom note is left in a table named WARNING, demanding a ransom payment of up to 0.08 BTC.”

During their RSA keynote both Kurtz and Sentonas highlighted that without the standard malicious code to detect, companies need to consider strategies with robust telemetry gathering activities from the endpoint to the cloud, and to manage identity data with greater granularity, and, with the use of AI and machine learning, find anomalous activity among that data.

CrowdStrike CEO George Kurtz spoke about this to Bloomberg:

Dave Ratner, CEO, HYAS:

   “Increasing an organization’s visibility into the real-time activities inside the network is quickly becoming critical for business resiliency against modern attacks. The ability to identify anomalous outbound communications from both the IT and OT networks can dramatically reduce the elapsed time from infection to detection and remediation and may be the only signal that allows organizations to get ahead of an attack before data exfiltration, encryption, and other actions that impact business continuity.”

Clearly the use of AI by those who defend against attacks is growing. Just look at Google and the announcement that they made at RSA. This is something that defenders need to consider in order to keep our digital assets safe.

I have some bad news if you’re responsible for defending your organization against threat actors.

Attackers have reduced the average time required to move laterally through systems by 14% last year, down to just 84 minutes, according to a new report out by Crowdstrike, giving defenders even less time to contain breaches after the initial breakout. 

Increasing the difficulty for defenders, a full 71% of the attacks used valid credentials for access, as opposed to malware, making detection by automated systems extremely difficult, up from 62% in 2021. Using “hands on keyboard” techniques make it harder for traditional anti-malware tools to detect activity according to CrowdStrike.

Like I said, this is bad news.

Ted Miracco, CEO of Approov Mobile Security:

   “It’s important to note that no single security measure can completely prevent all types of attacks, especially social engineering attacks. That said, mobile app attestation, runtime secrets protection, and RASP can all be highly effective measures in preventing credential access, SIM swapping, and MFA fatigue in mobile applications. 

   “Attestation techniques can help not only ensure that only genuine apps, and not tampered or cloned versions, are accessing APIs, it also uses the authorized application seamlessly as the second factor before accessing sensitive data. By verifying the integrity of the app at runtime, it both prevents attackers from injecting malicious code or accessing sensitive data. Runtime secrets protection can ensure that only valid app instances running in un-compromised environments can access the API keys and secrets stored in the cloud. This can prevent attackers from accessing these secrets even if they manage to gain control of the device. RASP can monitor, detect, and instantly block computer attacks, including new threats that were unforeseen during development. By continuously analyzing app behavior and detecting anomalies, RASP can prevent “interactive intrusions” and other types of attacks.

   “It’s best to use a combination of security measures, including those mentioned above, along with other security best practices such as proper authentication and authorization, encryption, and regular security testing and updates.”

The fact that attacks are getting faster and faster to execute means that we all have to work much harder to stop organizations from being victims. And the approach outlined above can certainly help with that… If everyone adopts that approach.