31–40 of 104 posts
On another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't have kernel level access?
The Linux version of CS sensor defaults to being installed as a kernel module as well.
Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.
Crowdstrike is finished? Ha! SolarWinds got the US government hacked by the Russians and they still exist.
How is the * (star / asterisk) character allowed in the file name? I thought such characters are forbidden by Windows. https://learn.microsoft.com/en-us/windows/win32/fileio/namin... How did the tool even manage to create such a file?
On another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't have kernel level access?
The Linux version of CS sensor defaults to being installed as a kernel module as well.
Kernel panic observed after booting 5.14.0-427.13.1.el9_4.x86_64 by falcon-sensor process -- https://access.redhat.com/solutions/7068083 -- 1 month ago
https://cyberplace.social/@GossiTheDog/112812260542179660 > I've obtained copies of the .sys driver files Crowdstrike customers have. They're garbage. Each customer appears to have a different one. https://cyberplace.social/@GossiTheDog/112812454405913406 > The .sys files causing the issue are channel update files, they cause the top level CS driver to crash as they're invalidly formatted. It's unclear how/why Crowds…
On another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't have kernel level access?
How is the * (star / asterisk) character allowed in the file name? I thought such characters are forbidden by Windows. https://learn.microsoft.com/en-us/windows/win32/fileio/namin... How did the tool even manage to create such a file?
it's deleting all matching files
Just kernel drivers. To know what is inside, you can disassemble them with https://github.com/NationalSecurityAgency/ghidra
These files are apparently just definitions/input for the actual CrowdStroke driver, that presumably someone named .sys so it sounds more scary and important. Peak irony then that you can just delete them. Surely an antivirus should recognize when its being rollbacked?
Don't you have to be in recovery mode, with it switched off, to do that?