A recent faulty configuration file in CrowdStrike’s Falcon platform caused a significant IT disruption, rendering millions of Windows machines inoperable. The result was a multi-day outage event, which affected critical sectors such as airlines, banks, and hospitals, and underscored the immense responsibility and potential risk associated with kernel accessibility given to a third-party security solution.
The recent behavior update, intended to enhance the detection of lateral movement techniques, introduced a defect that led to widespread system crashes and resulted in the “Blue Screen of Death,” necessitating manual intervention to restore functionality. While larger IT teams might resolve these issues within days, smaller businesses could face weeks of disruption, highlighting the need for more robust preventive measures.
.png?width=790&height=395&name=Blast%20Radius%20Fallout_800x400.1.1%20(1).png)
The Ripple Effects
The CrowdStrike outage impacted approximately 8.5 million devices globally, a relatively small percentage of the total Windows install base. However, the damage was significant due to the critical nature of the affected systems. CrowdStrike’s Falcon platform is used by over 70% of Fortune 2000 companies, meaning that this outage disrupted essential operations in sectors where reliability and security are paramount. The incident caused major disruptions, bringing operations to a standstill and requiring extensive manual efforts for recovery.
Cybercriminals Exploit the Chaos
In the aftermath of the CrowdStrike incident, cybercriminals have quickly adapted to exploit the situation. Phishing emails mimicking CrowdStrike communications have been used to deliver wiper and Remcos malware, targeting multiple entities. These emails, disguised as legitimate updates, trick victims into downloading malicious payloads.
One notable attack involved a payload identified as a wiper that specifically targeted Israeli entities, delivered through phishing emails with attached PDFs. This attack underscores the importance of robust cybersecurity measures and vigilance in the face of evolving threats.
Technical attack details
- Delivery Method: Phishing emails with PDF attachments mimicking CrowdStrike communications, suggesting downloading an update for Windows servers.
- Payload: A wiper using the CypherIT Loader to load a .NET payload that wipes all drives and uploads the operation to a Telegram bot.
- Identified Group: The attack references “Gaza Hackers Team Handala Machine,” which appears related to an Iranian hacking team.
- Attack Chain: Similar to the previously published CryptoIT chain, leveraging AutoIt to execute the final payload.
Morphisec #AMTD successfully stopped the attack during runtime tampering activities aimed at evading security solutions.
Key Indicators:
- PDF SHA1: cdfa4966d7a859b09a411f0d90efbf822b2d6671
- Payload SHA1: 7AD3E161579E4153B1F130CC8ED3EA3AC18F397D
- Download URL: hxxps://link[.]storjshare[.]io/s/jvktcsf5ypoak5aucs6fn6noqgga/crowdstrikesupport/update.zip?download=1
- Bot First Name: n****r (see below)
- Bot Username: Css788bot
- Bot User ID: 7277950797
- Chat ID: 7436061126
The Need for Enhanced Security Measures
The CrowdStrike outage vividly underscores the critical limitations of relying solely on signature-based detection methods for cybersecurity. Signature-based detection, which identifies threats by comparing them to known malware behavior, is inherently reactive.
This method depends on the prior identification and cataloging of threats, which means it can only protect against known threats. However, the landscape of cyber threats is continually evolving, with adversaries developing new, sophisticated methods that can evade these traditional defenses.
Machine learning by itself is not enough. A prevention-first security approach is needed—one that proactively anticipates and mitigates threats before they can cause harm. This approach must be integrated with existing Endpoint Detection and Response (EDR) solutions to provide a comprehensive security posture that can adapt to the dynamic nature of modern cyber threats.
Source – Gartner Guide to Endpoint Security Concepts 29 May 2024 – ID G00811632
What’s Next: Reevaluating the Future of EDR Solutions Post-Incident
As many IT professionals spend their weekends addressing the fallout from the CrowdStrike incident, questions about the future of CrowdStrike and potential alternatives are emerging. It’s essential to clarify that this discussion is not intended to criticize CrowdStrike. Alongside Microsoft and SentinelOne, CrowdStrike remains one of the leaders in the Endpoint Detection and Response (EDR) category. These companies have invested millions into developing robust products, and for many organizations, choosing one of these three is a logical decision.
While Microsoft presents an attractive alternative due to its licensing model, and CrowdStrike may face some legal challenges from this event, it’s likely that CrowdStrike will overcome these obstacles quickly.
However, this incident will undoubtedly have broader implications for the industry including:
- More Rigorous Testing for Signature Updates: To prevent similar occurrences, rigorous testing of signature updates will be increased.
- Delayed Update Releases: Updates may not be released as promptly, as vendors will need to ensure their reliability and safety.
- Reduced Sensitivity: The need for additional indicators to identify malicious behavior may reduce the sensitivity of detection mechanisms, potentially putting EDR solutions 2-3 steps behind cyber adversaries.
These points highlight the inherent limitations of relying solely on EDR solutions. Despite their widespread adoption and the emergence of Extended Detection and Response (XDR) solutions, organizations continue to experience breaches. EDR vendors often find themselves half a step behind sophisticated attackers. Therefore, a proper layered approach is necessary, one that complements existing EDR solutions with robust, proactive, and prevention-first security measures.
The Future of Cybersecurity is Automated Moving Target Defense
Automated Moving Target Defense (AMTD) offers a revolutionary solution to the challenges posed by traditional security methods. Unlike conventional EDR solutions that primarily rely on signatures and behavioral analysis, AMTD employs a proactive, prevention-first security strategy. This strategy significantly enhances the defense mechanisms by continuously altering the attack surfaces, thereby preventing cybercriminals from gaining a stable foothold.
The core principle of AMTD is based on the concept of making the target environment dynamic and unpredictable. By constantly morphing system configurations, IP addresses, and other critical parameters, AMTD creates a moving target that is exceedingly difficult for attackers to hit. This continuous change disrupts the attackers’ ability to perform reconnaissance and execute their malicious plans, effectively neutralizing threats in real-time. This dynamic defense mechanism does not rely on frequent updates or predefined signatures, which means it can protect against both known and unknown threats, including zero-day exploits and advanced persistent threats (APTs).
Source – Reference Architecture Brief: Endpoint Security 16 February 2024 – ID G00802490
Read more about AMTD here.
Expanded Key Benefits of AMTD
- Low Impact on Performance:
- Minimal Resource Usage: AMTD operates with minimal performance overhead on system resources such as CPU and RAM, ensuring that security does not come at the expense of system performance.
- Uninterrupted Operations: The low impact on performance allows business operations to continue smoothly without noticeable slowdowns or disruptions.
- Prevention-First Security:
- Proactive Defense: By dynamically altering the attack surface, AMTD prevents attackers from gaining a foothold, providing reliable, proactive threat prevention without relying on signatures.
- Real-Time Threat Neutralization: Upon detecting malicious activity, AMTD instantly neutralizes threats at the point of execution, limiting potential damage and preventing the spread of infections.
- Minimal Maintenance:
- Reduced Update Frequency: Unlike traditional security solutions that require frequent updates, AMTD does not depend on constant signature updates, reducing the maintenance burden on IT teams.
- Ease of Deployment: AMTD’s straightforward deployment process ensures quick and efficient setup, allowing organizations to enhance their security posture without significant overhead.
- Enhanced Security Posture:
- Comprehensive Coverage: AMTD provides a robust layer of security that complements existing EDR solutions, enhancing overall protection against sophisticated and evasive threats.
- High-Fidelity Alerts: AMTD generates high-fidelity alerts that significantly reduce false positives, improving the efficiency and effectiveness of Security Operations Centers (SOCs).
- Cost-Effectiveness:
- Reduced Breach Costs: By preventing breaches early, AMTD reduces the frequency and impact of security incidents, saving organizations the costs associated with mitigating attacks and data breaches.
- Improved Total Cost of Ownership (TCO): The proactive nature of AMTD ensures long-term cost savings by minimizing the need for constant updates and reducing the workload on security teams.
- Compliance and Regulatory Alignment:
- Regulatory Compliance: Implementing AMTD helps organizations stay ahead of compliance and regulatory requirements, protecting data and reputation.
- Enhanced Audit Scores: By boosting audit scores and helping achieve compliance, AMTD can contribute to reduced cyber insurance premiums, further enhancing overall cybersecurity posture.
- Full Protection for Legacy Operating Systems:
- Compatibility with Older Systems: AMTD provides comprehensive protection for legacy operating systems that are often vulnerable due to lack of updates or inherent security weaknesses.
- Reliable Last Line of Defense: For organizations that must rely on older technology, AMTD offers a dependable security solution that operates independently of traditional detection methods.
Shifting to a Prevention-first Security Approach
The recent CrowdStrike incident serves as a stark reminder of the vulnerabilities inherent in our current cybersecurity strategies. As cybercriminals continue to advance their tactics, organizations must adopt more robust and proactive measures to protect their critical systems. Automated Moving Target Defense (AMTD) offers a powerful approach to prevention-first security — one that ensures robust protection without impacting business operations or sacrificing security.
No matter where your stance is on this matter we are here to help. For organizations transitioning to Microsoft Defender, or any other endpoint security solution, AMTD provides a seamless integration that enhances your new security setup, ensuring no gaps during the migration.
For those continuing with CrowdStrike but seeking to bolster their defenses, AMTD complements your existing solution, offering an additional layer of real-time, proactive protection against sophisticated threats. Learn how AMTD bridges the CrowdStrike gap.
And for organizations mandated to reduce dependency on CrowdStrike, AMTD offers a reliable, standalone solution that integrates smoothly with your current infrastructure, providing robust security without the need for constant updates.
By incorporating AMTD into your cybersecurity strategy, you can achieve real-time protection and enhance your overall security posture. This proactive approach ensures that your organization remains resilient against advanced and unknown threats, maintaining operational continuity and safeguarding critical assets.
For more information on how Morphisec’s Automated Moving Target Defense can enhance your security posture, book a personalized demo today.
MITRE ATT&CK TTPs – created by AI
- Phishing – T1566
- Cybercriminals exploited the chaos following the CrowdStrike outage by sending phishing emails that mimicked CrowdStrike communications.
- These emails delivered wiper and Remcos malware through malicious PDF attachments.
- Malicious File Execution – T1203
- Phishing emails contained PDF attachments that prompted users to download an update for Windows servers, leading to the execution of malicious payloads.
- Data Destruction – T1485
- The payload identified as a wiper targeted systems by wiping all drives and uploading the operation to a Telegram bot.
- Command and Control – T1071
- The wiper payload communicated with a Telegram bot to upload the results of its destructive actions.
- Credential Dumping – T1003
- The incident highlights the need for robust cybersecurity measures to prevent credential theft during chaotic situations.