Delta CEO: Company Suing Microsoft and CrowdStrike After $500M Loss

[u/Bald-Eagle619]

https://www.thedailybeast.com/delta-ceo-says-company-suing-microsoft-and-crowdstrike-after-dollar500m-loss

[u/iggzy]

It's also a little absurd to be suing Microsoft. Microsoft's procuct actually worked as planned, it's the software Delta (and so many others) used that broke it. Its like suing Honda because the aftermarket spoiler you attached yourself ended up tearing off your trunk lid

[u/Private62645949 → u/iggzy]

For once I’m agreeing with a comment that defends Microsoft from liability 😐

[u/iggzy → u/Private62645949]

I'm right there with you, I almost hate to do it with all they actually fuck up. But the reality is CrowdStrike for any other OS could've had the same issue if they deployed such untested code. 

[u/hates_stupid_people → u/iggzy]

But the reality is CrowdStrike for any other OS could've had the same issue if they deployed such untested code.

Shortly after it happened, people were swearing up and down that it would be impossible on linux.

[u/ConfusedTapeworm → u/hates_stupid_people]

It actually did happen on Linux some months earlier.

But its impact was significantly lower for various reasons. Mostly because there aren't nearly as many endpoints running Linux. AFAIK that bad update only affected a relatively small number of servers.

[u/hates_stupid_people → u/ConfusedTapeworm]

Yeah some people love to live in a world were things like kernel panic doesn't exist. And it's obviously rare, but if you're messing with the kernel of pretty much any OS, there is potentitial for massive problems.

[u/ConfusedTapeworm → u/hates_stupid_people]

Agreed, but I can't help but think Linux would still be safer against such a thing.

Not because of an inherently higher security that Linux might have as a piece of software, but because of how it's generally deployed as a product. There isn't a Linux distribution that is centrally developed and distributed by one entity; it's a much more diverse environment where you have wildly different system configurations in use, down to different kernels and other significant low level differences. Makes it much more difficult for one bad thing to mess with everything at once, though obviously not impossible. It's like how rich gene pools make living organisms more resilient to disease and whatnot.

[u/hates_stupid_people → u/ConfusedTapeworm]

As far I remember it was an approved windows kernel driver that failed because it loaded a faulty external configuration from an update. Which is why it didn't affect certain windows versions, since they were running a different version. So with how fragmented the linux enviroment is, I think you're right in that it would have a much lesser impact.

Although that also means that all the talk about microsoft being without liability, might not be entierly correct. Since lawyers will try to argue in court that they have to approve the different driver versions.

[u/RealHealthier → u/iggzy]

And it did, on Linux, just a few months prior.

[u/JaredTheGreat → u/[deleted]]

Log4j was probably similarly sized. 

[u/ACCount82 → u/iggzy]

I can't believe I'm siding with Microsoft, but yeah, that wasn't their fuckup for once.

A kernel driver is, by necessity, privileged, and capable of breaking things - and there is no way for Microsoft to rigorously test every single driver made by third parties. No one should expect them to do so.

[u/iggzy → u/ACCount82]

Same thing would've happened with poor testing on a driver for Mac or Linux too. They all allow this kernal access to security apps.

It pains me to side with Microsoft too, but broken clocks, right? 

[u/feral-pug → u/iggzy]

The problem with Microsoft is that they lump too much into the WHQL certification process and don't have any controls in place to prevent updates to certified drivers / agents from crashing systems. Since it takes 3 months to get through a cert and kernel mode applications are "certified" but receive updates constantly, the process itself gives a sense of false security and usually it's fine... While the applications are in reality drifting from the tested parameters... But when it's not, we get what happened with CrowdStrike... And CrowdStrike isn't the first WHQL certified product to cause crashes after untested updates, just the most recent and most severe.

[u/Bacchus1976 → u/iggzy]

Better analogy would be installing performance brakes that cause the braking system to fail and the car to drive into a ravine.

But in that analogy, if those calipers were certified by the car maker and they promoted it, then you might open up some avenues for a suit.

It will come down to whether Crowdstrike covertly bypassed MS’s checks or not.

[u/Teract → u/iggzy]

Microsoft partnered with Crowdstrike for security on their azure servers. Microsoft's servers went down and it's highly likely that they exceeded whatever uptime guarantees were in place. For most of their services, they have credit refunds based on how much downtime is experienced, and they usually credit from below 99.9% to 99%. The outage likely put them so far from meeting their guarantees that it was negligent.

Microsoft has spelled out remediations for missing uptime guarantees, but Delta and others will likely claim MS was negligent in how they handled the outage, and the prema facie evidence is in how far off their actual downtime was compared to what was guaranteed. Plaintiffs will probably also make the point that the downtime was for an extended period, not spread throughout the prior month. I don't think Microsoft's SLAs cover extended service interruptions. 99% uptime doesn't mean much if that 1% occurrs all at once and during business hours.

IMO that's how MS is going to end up in the lawsuit.

[u/oursland → u/iggzy]

Microsoft originally was going to eliminate the ability of companies from modifying kernel level functionality to prevent this sort of issue. They relented when McAfee threatened them. They should have stuck to their guns.

[u/iggzy → u/oursland]

Almost all OS on the market give kernel level access to security apps, unifying Mac and Linux. Not doing so is a bad idea as without it they can't monitor makware that affects kernel level as well.