CrowdStrike Blog

Taking you at your word, that's a tough position to be in.

Energy is a hot sector to be attacking, so that is points in your favor, but unless it's some extension of Russian military/Wagner I'm not sure white supremacists make sense. It really doesn't make sense that they would contact you unless it's ransomware.

Frankly the question I'm asking myself most right now is "is this some kind of phishing?" followed by "is this schizophrenia?"

A CEO or CTO might prefer denial. If you want to pursue that route, then perhaps find a CISO or head of security of some sort, perhaps an administrator in IT. Were I in those positions I would definitely want to at least perform a few sanity checks. Politics can be awful if you don't have competent people around you. A competent security person would definitely be concerned about compromised employees. Corporate environments are likely to punish someone for coming forward greatly disincentivizing that behavior while sane companies would be happy someone took responsibility and came to them despite the risks of getting blamed.

Mandiant and Crowdstrike are two entities you might consider, they are big and corporate, so hard to know how that would turn out.

https://www.mandiant.com/contact-us

https://www.crowdstrike.com/services/experienced-a-breach/

You could try to send e-mails to individuals, either people who have given talks at security conferences or people in local colleges.

You could try people working in journalism, they might…

I may be misunderstanding this; can you help me out and be specific about what you mean by DNC email leaks?

If we’re talking about the Guccifer 2.0 leaks, it seems relevant to note that in October of 2016, the US intelligence community stated that they were confident that Russia was involved. Mueller also indicted 12 Russian nationals on related charges. There is currently a fair bit of evidence that yes, the Guccifer leaks were Russian based.

Now, perhaps your objection is that media outlets reported this prior to those findings. For politically charged questions like these, I’d recommend that you still include the post-facto findings I reference, since otherwise your audience could wind up with the understanding that our knowledge about the hacks is limited to the reporting you mention.

Back to the question of “auditors” — let’s once again be specific. The DNC hired CrowdStrike to investigate the hack. Their initial response and follow ups are here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/

CrowdStrike used stronger words than “likely.” Some of them:

“We deployed our IR team and technology and immediately identified two sophisticated adversaries on the network – COZY BEAR and FANCY BEAR.”

“At DNC, COZY BEAR intrusion has been identified going back to summer of 2015, while FANCY BEAR separately breached the network in April 2016.”

The report does not go into detail on methods, for obvious reasons. But that is the statement…

""""
CrowdStrike Services Inc., our Incident Response group, was called by the Democratic National Committee (DNC), the formal governing body for the US Democratic Party, to respond to a suspected breach. We deployed our IR team and technology and immediately identified two sophisticated adversaries on the network – COZY BEAR and FANCY BEAR. We’ve had lots of experience with both of these actors attempting to target our customers in the past and know them well. In fact, our team considers them some of the best adversaries out of all the numerous nation-state, criminal and hacktivist/terrorist groups we encounter on a daily basis. Their tradecraft is superb, operational security second to none and the extensive usage of ‘living-off-the-land’ techniques enables them to easily bypass many security solutions they encounter. In particular, we identified advanced methods consistent with nation-state level capabilities including deliberate targeting and ‘access management’ tradecraft – both groups were constantly going back into the environment to change out their implants, modify persistent methods, move to new Command & Control channels and perform other tasks to try to stay ahead of being detected. Both adversaries engage in extensive political and economic espionage for the benefit of the government of the Russian Federation and are believed to be closely linked to the Russian government’s powerful and highly capable intelligence services.

COZY BEAR (also referred to in some…

> Maybe I'm not up to date but what kind of evidence exactly? Could you give a source?

Wired: "According to a number of top cybersecurity researchers, they're probably right." (https://www.wired.com/2016/07/heres-know-russia-dnc-hack/) Wired cites the following firms: Crowdstrike, Fidelis Cybersecurity, Mandiant... and a professor named Thomas Rid. Apparently Crowdstrike is the firm hired by the DNC specifically (https://www.washingtonpost.com/world/national-security/russian-government-hackers-penetrated-dnc-stole-opposition-research-on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7-7b6c1998b7a0_story.html) but there's more than one organization mentioned.

New York Times: "American intelligence agencies have told the White House they now have “high confidence” that the Russian government was behind the theft of emails and documents from the Democratic National Committee, according to federal officials who have been briefed on the evidence." (http://www.nytimes.com/2016/07/27/us/politics/spy-agency-consensus-grows-that-russia-hacked-dnc.html)

Reuters: "U.S. intelligence officials told top congressional leaders a year ago that Russian hackers were attacking the Democratic Party, three sources familiar with the matter said on Thursday, but the lawmakers were unable to tell the targets about the hacking because the information was so secret." (http://www.reuters.com/article/us-usa-election-democrats-hack-idUSKCN10N00D)

The Daily Beast: "The researchers, at Arlington, Va.-based…

They literally half-assed their deployment process - one part enterprisey, one part "move fast and break things".

Guess which part took down much of the corporate world?

from Preliminary Post Incident Review at https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/ :

"CrowdStrike delivers security content configuration updates to our sensors in two ways: Sensor Content that is shipped with our sensor directly, and Rapid Response Content that is designed to respond to the changing threat landscape at operational speed.

...

The sensor release process begins with automated testing, both prior to and after merging into our code base. This includes unit testing, integration testing, performance testing and stress testing. This culminates in a staged sensor rollout process that starts with dogfooding internally at CrowdStrike, followed by early adopters. It is then made generally available to customers. Customers then have the option of selecting which parts of their fleet should install the latest sensor release (‘N’), or one version older (‘N-1’) or two versions older (‘N-2’) through Sensor Update Policies.

The event of Friday, July 19, 2024 was not triggered by Sensor Content, which is only delivered with the release of an updated Falcon sensor. Customers have complete control over the deployment of the sensor — which includes Sensor Content and Template Types.

...

Rapid Response Content is used to perform a variety of behavioral…

CrowdStrike | Senior Platform / Data Engineer | Remote (or Sunnyvale), USA | REMOTE

CrowdStrike is the leader in cloud-delivered next-generation endpoint protection, threat intelligence, and pre- and post-incident response services. With the ability to collect and process over 100 billion events a day, CrowdStrike has revolutionized endpoint protection by being the first and only company to unify next-generation antivirus (AV), endpoint detection and response (EDR), and a 24/7 managed hunting service — all delivered via a single lightweight agent. We are one of the World's Most 50 Innovative Companies according to MIT, and one of Forbes Most Promising Companies. Our growth and innovation are driven by incredible employees who deliver unmatched customer success.

We are looking to hire a Senior Platform/Data Engineer for the Data Engineering team at CrowdStrike. The Data Engineering team operates within the Data Science organization, and provides the necessary infrastructure and automation for users to analyze and act on vast quantities of data effortlessly. The team has one of the most critical roles to play in ensuring our products are best-in-class in the industry. You will interact with product managers and other engineers in building both internal and external facing services.

Technologies we work with : Golang, Python, Docker, K8, Chef, Terraform, Jenkins, Kafka, Cassandra, Postgres, Git, Spark, Hadoop, AWS etc

More career openings here:…