Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Crowdstrike like many EDRs uses mutually authenticated TLS to send the data over the network to their cloud.


OP said:

> Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text.

So this person claims the data isn't send using TLS. I didn't verify the claim myself though.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: