Delta sues CrowdStrike over software update that prompted mass flight disruptions
Reuters
WASHINGTON, Oct 25 (Reuters) - Delta Air Lines on Friday sued cybersecurity firm CrowdStrike in a Georgia state court after a global outage in July caused mass flight cancellations, disrupted travel plans of 1.3 million customers and cost the carrier more than $500 million.
Delta's lawsuit filed in Fulton County Superior Court called the faulty software update from CrowdStrike "catastrophic" and said the firm "forced untested and faulty updates to its customers, causing more than 8.5 million Microsoft Windows-based computers around the world to crash."
The July 19 incident led to worldwide flight cancellations and hit industries around the globe including banks, health care, media companies and hotel chains.
"Delta’s claims are based on disproven misinformation, demonstrate a lack of understanding of how modern cybersecurity works, and reflect a desperate attempt to shift blame for its slow recovery away from its failure to modernize its antiquated IT infrastructure," CrowdStrike said late on Friday.
In a recent research, SafeBreach Labs researcher Alon Leviev exposed a new attack technique that could compromise the security of fully patched Windows 11 systems. This technique, dubbed Windows Downdate, involves manipulating the Windows Update process to downgrade critical system components, effectively resurrecting previously patched vulnerabilities.
The attack was initially reported in August 2024 at Black Hat USA 2024 and DEF CON 32. Researchers have now published additional details to enhance public understanding of the attack.
One such vulnerability is the “ItsNotASecurityBoundary” Driver Signature Enforcement (DSE) bypass, which allows attackers to load unsigned kernel drivers. This bypass allows attackers to replace a verified security catalogue with a malicious version, enabling the loading of unsigned kernel drivers.
According to SafeBreach’s blog post shared with Hackread.com ahead of publishing on Saturday, by leveraging Windows Downdate, attackers can target specific components, such as the “ci.dll” module essential for parsing security catalogues, and downgrade them to a vulnerable state, enabling the exploitation of this bypass and gaining kernel-level privileges.
After this "advanced telemetry" provided initial evidence, Sophos developed a special "kernel implant" that allowed even more advanced monitoring and collection of arbitrary files without the system owner having a chance to detect it:
"April 23 - May 10, 2020: Forward Deployment Tooling
[...] X-Ops developed a specialized kernel implant that could be deployed on devices that Sophos knew with high probability were controlled by groups conducting malicious exploit research. The tool enabled remote collection of files and logs without visible userland artifacts."
They then installed this monitoring module on systems that they were sufficiently sure were being used for malicious purposes – Sophos speaks of "high confidence", but does not qualify this further. This happened for the first time, without the knowledge or consent of the owner, on July 9, 2020, on a system that Sophos had identified as a test object of the perpetrators via the telemetry data, among other things. Sophos does not explain how it specifically installed this kernel extension on individual systems. But in the following years, Sophos installed this kernel rootkit on other systems that they had classified as suspicious. I have not yet received an answer to my questions to Sophos about the implementation and scope of these activities.
The FBI said today that it removed Chinese malware from 4,258 US-based computers and networks by sending commands that forced the malware to use its "self-delete" function.
The People's Republic of China (PRC) government paid the Mustang Panda group to develop a version of PlugX malware used to infect, control, and steal information from victim computers, the FBI said. "Since at least 2014, Mustang Panda hackers then infiltrated thousands of computer systems in campaigns targeting US victims, as well as European and Asian governments and businesses, and Chinese dissident groups," the FBI said.
The malware has been known for years, but many Windows computers were still infected while their owners were unaware. The FBI learned of a method to remotely remove the malware from a French law enforcement agency, which had gained access to a command-and-control server that could send commands to infected computers.
flanker (./2210) :Pourquoi une bonne nouvelle ?
The FBI learned of a method to remotely remove the malware from a French law enforcement agency, which had gained access to a command-and-control server that could send commands to infected computers.
Ça sent la DGSI qui aide le FBI, ça : plutôt une bonne nouvelle
merci
flanker (./2214) :Par contre, je pense que le cadre légal français ne permet pas ce genre d'opérations, ou en tout cas ce n'est pas très clair (malgré ce qu'en pense la DGGN).
Ça montre qu’on a des capacités que le FBI n’a pas
