Risky Business #757 – The ClownStrike cleanup continues
Jul 31, 2024
auto_awesome
Dive into the chaotic aftermath of a major cybersecurity incident involving CrowdStrike and its fallout in the insurance sector. Explore Google's email validation flaws that led to unauthorized access and examine vulnerabilities in VMware systems. Delve into the complex world of Secure Boot and hardware integrity challenges. Unpack the digital threats from North Korea, focusing on ethical dilemmas surrounding ransomware payments. Finally, hear insights on innovative cybersecurity solutions and the struggles of integrating with Microsoft's APIs.
The CrowdStrike incident has prompted major insurance industry shifts, leading to rising premiums and numerous business interruption claims due to significant operational disruptions.
Delta Airlines is pursuing legal action against CrowdStrike and Microsoft for extensive damages incurred during the outage, highlighting accountability challenges in software service contracts.
A serious vulnerability in Google Workspace's email verification process has exposed users to unauthorized account access, emphasizing the need for more stringent authentication measures in federated systems.
Deep dives
CrowdStrike Outage Impact on Insurance Sector
The recent CrowdStrike incident has triggered significant consequences for the insurance industry, prompting reinsurers to reconsider their underwriting practices. Moody's has indicated an expectation of rising premiums due to this major event, as numerous companies are now filing claims for business interruptions stemming from the outage. The interconnectedness between CrowdStrike's users and their insurance coverage has made the situation particularly precarious, with many affected businesses seeking to recoup losses. This event has highlighted the vulnerabilities in the cybersecurity landscape and its implications for the insurance market.
Delta Airlines Responds to CrowdStrike Incident
Delta Airlines was among the companies heavily affected by the CrowdStrike outage, leading to severe disruptions and extensive public scrutiny. In response, Delta has engaged legal counsel to seek damages from both CrowdStrike and Microsoft, questioning whether the contractual agreements will hold up under these extraordinary circumstances. The potential financial impact for Delta alone ranges between $300 to $500 million, raising doubts about the effectiveness of standard software licensing agreements when aligned with user experience disruptions. The case illustrates the challenges companies face in navigating accountability and liability in the software service sector.
Following the CrowdStrike outage, a discussion with cybersecurity experts from Sentinel-1 revealed contrasting update strategies in endpoint detection and response systems. These experts described their meticulous update process, which includes staggered rollouts and dynamic testing, contrasting with CrowdStrike’s approach that has been seen as less rigorous. This raises questions about the adequacy of CrowdStrike's update mechanism and whether complacency could have contributed to the operational failures. The conversation underlines the importance of proper change management in cybersecurity solutions, especially for industry leaders.
Vulnerabilities in Google Workspace Authentication
A recent bug in Google Workspace allowed users to create email-verified accounts that unwittingly enabled unauthorized access to various services linked to those accounts. This flaw occurred because certain systems failed to confirm an authentication method, leading to potential security breaches particularly aimed at cryptocurrency platforms. The incident reveals a critical vulnerability within OAuth's implementation, highlighting the risks of relying on federated authentication systems without stringent oversight. Users and organizations are now encouraged to reevaluate the robustness of their authentication frameworks to prevent similar exploits.
Concerns Over Secure Boot in BIOS Systems
A significant exposure in the Secure Boot mechanism has emerged due to a BIOS manufacturer inadvertently shipping compromised key material, raising serious concerns over platform trust. This mistake affects multiple vendors who adopted this insecure key material, potentially allowing attackers to gain persistent access through BIOS modifications. The incident illustrates the challenges faced in establishing secure and reliable boot processes that involve multiple stakeholders, particularly in the complex landscape of computing hardware. It emphasizes the need for stricter controls and monitoring within the BIOS development process to counteract advanced persistent threats.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
The insurance industry’s reaction to CrowdStrike’s mess
Google’s Workspace email validation flaw and its consequences for OAuth’d applications
Is the VMWare ESX group membership feature a CVE or an FYI?
Secureboot continues to under-deliver
North Korea’s revenue neutral intelligence services
And much, much more
This episode is sponsored by allowlisting software vendor Airlock Digital. Airlock uses a kernel driver on Windows, so Chief Executive David Cottingham joined to discuss what the CrowdStrike kernel driver bug drama means for security vendors.
This episode is also available on Youtube. If you want to ruin the magic of radio and see the faces behind the show, well, now you can!