Ep7: Crowd2K and the kernel, PKFail supply chain failures, Paris trains sabotage and Russian Olympic attacks
Aug 2, 2024
auto_awesome
The discussion dives deep into CrowdStrike's Windows BSOD saga and the intricacies of kernel access. A critical look at the PKFail research reveals serious vulnerabilities in secure boot technology. Listeners are intrigued by cyber sabotage linked to European train services and the historical cyber attacks related to the Olympics, particularly with Russian involvement. The conversation emphasizes the need for transparency in cybersecurity and the growing importance of software vendor liability amid increasing geopolitical tensions.
The podcast emphasizes the importance of transparency in cybersecurity incidents, spotlighting CrowdStrike's approach to improving communication regarding vulnerabilities.
Discussions on the PKFail supply chain vulnerabilities highlight the critical need for inspectability in security mechanisms to prevent bypasses.
The conversation addresses the ongoing debate around software vendor liability, particularly in light of Delta Airlines seeking damages from Microsoft and CrowdStrike.
Deep dives
Remote Work Trends
The discussion highlights the growing trend of remote work, particularly within the European context. With summer heat intensifying, the flexibility of working remotely has allowed many to choose picturesque locations, such as mountains or deserts, for their work environment. The speakers encourage listeners to explore similar options, suggesting that working from unique locales can enhance both productivity and lifestyle. This shift emphasizes the changing dynamics of work, where location becomes increasingly irrelevant to professional responsibilities.
Insights from Black Hat Conference
The podcast brings attention to the significance of the Black Hat conference in Europe, regarded as a premier event for security research and networking among professionals. The speakers reflect on its evolution from a niche technical gathering to a major event akin to RSA, noting that the quality of content remains high, particularly with international representation. They discuss their anticipation for presentations that share cutting-edge research findings, highlighting the conference's role as a platform for major announcements in cybersecurity. The event serves as a convergence point for experts to exchange ideas and techniques that push the boundaries of current understanding.
CrowdStrike Incident Analysis
Attention is focused on the CrowdStrike and Crowd2Key situation that has garnered significant attention over several weeks. A blog by David Weston from Microsoft provides detailed insights into a technical vulnerability, marking a shift towards more transparency in communication about the incident. The necessity for kernel drivers in security applications and the challenges they pose for performance are discussed, especially in relation to scanning processes. The conversation extends to the parallels drawn between antivirus technologies and gaming anti-cheat methods, emphasizing lessons to be learned from the gaming industry to improve security practices.
Legal Ramifications for Delta Airlines
The conversation turns to the ongoing legal issues escalating from the Delta Airlines incident, where the company experienced substantial operational disruptions. Reports indicate that Delta is seeking compensation from Microsoft and CrowdStrike, arguing the incident resulted in losses ranging from $350 to $500 million. The speakers express skepticism about whether such actions will hold up in court, considering existing terms of service that might protect software companies from liability. This discourse raises broader questions about the future of software liability and accountability in the tech industry amidst growing incidents of cybersecurity threats.
Challenges in Secure Boot Technology
Recent findings related to secure boot technology reveal vulnerabilities that cast doubt on its effectiveness as a security measure. The discussion draws attention to a specific incident involving the PK fail vulnerability, which demonstrated how attackers could bypass secure boot and take control of devices despite passing security checks. The speakers analyze the implications of reliance on secure boot and the necessity for third-party inspections to secure hardware effectively. They argue that ongoing improvements in collaboration between software and hardware vendors are essential to bolster system security against such threats.
Three Buddy Problem - Episode 7: In this episode, we try to close the book on the CrowdStrike Windows BSOD story, Microsoft VP David Weston’s technical documentation and issues around kernel access and OS resilience. We also discuss Binarly’s PKFail research, secure boot bypasses, Dan Geer and tech monoculture, software vendor liability issues and the need for inspectability in security mechanisms.
The conversation explores cyber angles to train service disruptions in Paris, the history of cyber operations targeting the Olympics, the lack of public acknowledgment and attribution of cyber operations by Western intelligence agencies, and the importance of transparency and case studies in understanding and discussing cyber operations.
Hosts: Juan Andres Guerrero-Saade (SentinelLabs), Costin Raiu (Art of Noh), Ryan Naraine (SecurityWeek)