How does Linux it self or some other software on Linux address what Crowd Strike is doing for Windows?
E: thanks for the answers :)
CrowdStrike’s Falcon Sensor agent can be and is installed on bare metal, VMs and inside Kubernetes clusters. All running Linux.
is there a use case … on Linux
It’s already installed on Linux, in massive companies all around the globe. Leadership sure thinks so.
Like it or not, most cyber insurance policies require all endpoints and hosts be secured with industry approved edr solution. Crowdstrike is a very popular multi platform player in that space. 🤷♂️
CrowdStrike Falcon is XDR product, there is hundreds of similar products available.
The role of XDR is to detect and block if some bad actor is trying to do something malicious in the machine. Old school virus signature detection is not enough anymore, you need pattern detection from network communication/DNS queries etc.
When corporation has thousands of devices to monitor the OS each of those devices Is not relevant. You need to detect if some random user logs to some Linux info display thousand kilometers away, and starts scanning the network.
Because the detection and response, needs to happen near realtime, for example Incase of cryptolockers, where all devices are encrypted within seconds, the software blocking this needs kernel level access.
I work in critical infrastructure as IT, but luckily we did not use falcon
It detects and reports bad behavior of software
Monitoring is very important when you have 1000 machines
If someone starts transferring a bunch of files to an external drive, heuristics will detect that and alert. Source: I worked at crowdstrike six years ago.
How does Linux it self or some other software on Linux address what Crowd Strike is doing for Windows?
Well, it usually drops to a black screen and kernel panics, but lately there’s been a bit of a push for parity with windows.
The Linux BSOD is quite funny. But reading from Crowd Strike’s website the Falcon product is supposed to monitor for breaches(?), so I was curious about what analogs exist in Linux or how the OS it self takes on that role.
Crowdstrike exists for Linux too. In fact, it apparently crashed RHEL and Debian a few months back. That didn’t get so much attention.
Falcon seems to be a cross between an antivirus and an intrusion detection system (IDS). There are many antiviruses on Linux, but only one FOSS AV is popular - ClamAV. As for IDS, snort is an example.
But in the true sense, Falcon is much more than just an AV and IDS. It’s a way to detect breaches and report it back to CrowdStrike’s threat detection and analysis teams. I don’t think there exists a proper alternative even in the commercial sector.
I don’t think there exists a proper alternative even in the commercial sector.
There is a handful of vendors and they indeed monitor a ton more than just viruses. The solution we’re running at the office monitors pretty much all kinds of logs (dns, dhcp, authentication, network traffic…) and it can lock down clients which are behaving wrongly enough. For example every time I change a hosts file (for a legitimate reason) on my own laptop I get a question from security team if that was intented. And it combines logs/data gathered from different systems to identify potential threats and problematic hosts and that’s why our fleet feeds in data from all kinds of devices.
I haven’t seen that many different solutions which do this, but the few I’ve worked with are a bit hit or miss with linux. The current solution has a funny feature where it breaks dpkg if the server doesn’t have certain things installed (which are not depencies on the packet itself). And they eat up a pretty decent chunk of CPU-cycles and RAM while running. But apparently someone has done the math and decided that it’s worth the additional capacity, it’s outside my pay range so I just install whatever I’m told to.
That’s a BSOD for DRM failures I think, not a generic BSOD like on Windows.
Systemd also added systemd-bsod, but it’s for boot failures.
deleted by creator
The use case is - if you are in an industry that is legally mandated to use EDR, it is an EDR product.
EDR is a massive security risk, so no.
If youre forced to install it, put it on a VM and don’t let it escape to your real machine. They can exfiltrate all your data and install malware as root.
Is there a use case for CrowdStrike on any platform? No, there isn’t. Anything that messes with the kernel at that level should be considered a security threat on the basis of potential service disruption / threat to business continuity. Do you really want to run a closed source piece of malware as a kernel module?
They completely fuck over their customers in the business continuity aspect, they become the problem and I bet that most companies would never suffer any catastrophic failure this bad if they didn’t run their software at all. No hacker would be able to take down so many systems so fast and so hard.
So what is your suggestion for a viable alternative that auditors will also accept?
Not the guy you’re asking but I agree. There would be no need for Falcon Sensor on every Windows-machine deployed inside an Enterprise (assuming that Falcon Sensor serves a purpose worth fulfilling in the first place) if the critical devices on their network were sufficiently hardened. The main problem (presumably the basis of such a solution existing) is that as soon as you have a human factor, people who must be able to access critical infrastructure as part of their job, there will be breakages of some kind. Not all of those must be malicioius or grow into an external threat. They still need to be averted of course.
I feel that CrowdStrike is an idea that seems appealing to those making technological decisions because it promises something that cannot be done by conventional means as we have known and deployed them before. I can’t say whether or how often this promise has ever enabled companies to thwart attacks at their inception, but again, I feel that in a sufficiently hardened environment, even with compromisable human actors in play, you do not need self-surveillance (at the deepest level of an OS) to this extent.
And to also address OP’s question: of course there is no need for this in a *NIX environment. There hasn’t been any significant need for antivirus of any kind in any of the UNIX-based world including macOS. So really this isn’t about whether an anti-malware solution in itself can satisfy the needs of a company per se, the requirements very much follow the potential attack vectors that are opened up by an existing infrastructure. In other words, when your environment is Windows-based, you are bound to deploy more extensive security countermeasures. Because they are necessary.
Some may say that this is due to market-share, but to those I say, has the risk-profile of running a Linux-based server changed over the last 20 years? They certainly have become a lot more common in that timeframe. One example I can think of was a ransomware exploit on a Linux-based NAS-brand, I think it was QNAP. This isn’t a holier than thou argument. Any system can be compromised. Period. The only thing you can ensure is that the necessary investment to break your system will always be higher than the potential gain. So I guess another way to put this is that in a Windows-based environment your own investment into ensuring said fact will always be higher.
But don’t get me wrong, I don’t mean to say Windows needs to be removed from the desks of office-workers. Really this failure and all these photographs of publically visible bluescreens (and all the ones in datacenters and server-rooms that we didn’t see) shows that Windows has way too strong of a foothold in places where plenty smart people are employed to find solutions that best serve the interests of their employers, including interests (i.e. security and privacy) that they are unaware of because they can’t be printed on a balance-sheet.
As if taking down the systems is the biggest cybersecurity threat a company might have.
