Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is in C-00000291*.sys?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 104 posts

Re: Ask HN: What is in C-00000291*.sys?

#51

Post by aaron695 »

pdw wrote: post #36
alex_f_k wrote: post #24

https://cyberplace.social/@GossiTheDog/112812260542179660 > I've obtained copies of the .sys driver files Crowdstrike customers have. They're garbage. Each customer appears to have a different one. https://cyberplace.social/@GossiTheDog/112812454405913406 > The .sys files causing the issue are channel update files, they cause the top level CS driver to crash as they're invalidly formatted. It's unclear how/why Crowds…

They might just be encrypted with a customer-specific key. That wouldn't surprise me.

No the hashes are the same.

There are different files that can differ between customers.

9ca565965198cf1a5073ce974c5826d14aa3ac3cf574b3d2d2e7f80624b9ed90 = C-00000291-00000000-00000033.sys = https://www.virustotal.com/gui/file/9ca565965198cf1a5073ce97...

61486fe1aa690260bd846245f0fac204b26f41ed83f66e962cb548837f3ceb98 = C-00000291-00000000-00000057.sys = https://www.virustotal.com/gui/search/61486fe1aa690260bd8462...

Re: Ask HN: What is in C-00000291*.sys?

#52

Post by bhouston »

ciabattabread wrote: post #25
neverminder wrote: post #14

Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.

Crowdstrike is finished? Ha! SolarWinds got the US government hacked by the Russians and they still exist.

The SolarWinds stock has never recovered from its high before the hack. And it is on a downward trend.

Re: Ask HN: What is in C-00000291*.sys?

#53

Post by bhouston »

BrentOzar wrote: post #20
neverminder wrote: post #14

Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.

> Crowdstrike is finished Unlikely, just as Solarwinds wasn't finished when they distributed malware that got government agencies hacked. You underestimate the slow turning radius of giant company purchasing departments.

As I posted elsewhere, the SolarWinds stock has never recovered from its high before the hack. And it is on a downward trend.

Re: Ask HN: What is in C-00000291*.sys?

#54

Post by Someone »

petesergeant wrote: post #40
stefan_ wrote: post #29

Earlier quoted context omitted.

These files are apparently just definitions/input for the actual CrowdStroke driver, that presumably someone named .sys so it sounds more scary and important. Peak irony then that you can just delete them. Surely an antivirus should recognize when its being rollbacked?

> that you can just delete them Don't you have to be in recovery mode, with it switched off, to do that?

I don’t have a Windows setup, let alone one with CrowdStrike installed, but for this, you have to be in recovery mode to boot, not necessarily to be able to delete that file. For that, admin access may be enough.

Re: Ask HN: What is in C-00000291*.sys?

#57

Post by dathinab »

lordnacho wrote: post #10

It's a crowdstrike update file with a bug in it, from what I gather. This makes your Windows machine go blue screen and stop working as it starts up. If you manage to remove it by various methods, it doesn't run and you're fine. More informed people will give you more details, but this kind of AV software often has privileged access to the OS, so it can scan your files. The same privileged access also means it can re…

> By contrast your ordinary python or VBA script should not be able to blue screen your machine, especially not during startup.

This is misleading. If you run a python or VBA script on startup with elevated permissions to e.g. setup a driver (with a bug) or do hardware configurations (in a way which doesn't work) then it will as much blue screen as a sys file.

The issue is not that it's a `.sys` file, but that a high privilege administrative task run at startup fails so hard that it blue screens.

(In windows the sys file extension is basically just a marker that the file is part of the "system" without being clear what it is, it can be anything from a data blob,over a data base, over python/VBA files to a device driver or a blob combining multiple of such things. They mostly contain device drivers and hardware configuration, but there are some which are basically just the equivalent of /etc/hostname)

Re: Ask HN: What is in C-00000291*.sys?

#58

Post by martopix »

neverminder wrote: post #14

Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.

> Crowdstrike is finished

Boeing is still there... we'll see

Re: Ask HN: What is in C-00000291*.sys?

#59

Post by sokoloff »

codetrotter wrote: post #28
alex_f_k wrote: post #26

Earlier quoted context omitted.

Star is part of a command to delete any file matching a wildcard `C-00000291*.sys` meaning "starts with 'C-00000291', has any kind of text after that and ends with '.sys'". Actual files appear to differ for every machine

This exchange reminds me of a time many years ago where I was reading a computer magazine and they talked about “Windows 9x” and I thought they were referring to some version of Windows that I had never heard of. Only a couple of years later did I understand that it was simply a shorthand for talking about Windows 95 and Windows 98. Edit: And looking now at Wikipedia apparently it also covers Windows Me. (The Millenn…

Also the reason that Microsoft skipped from Windows 8 to Windows 10. Too much risk of apps testing the first 8 characters of the Windows version against "Windows 9" and concluding they were running on 95/98 rather than 9.

Re: Ask HN: What is in C-00000291*.sys?

#60

Post by dathinab »

neverminder wrote: post #30
taneliv wrote: post #22

Earlier quoted context omitted.

Enterprise Linuxes also employ Crowdstrike or similar "security" products as mandatory part of their IT deployments. Often (always?) this is due to companies wanting certification for their secure processes, in order to sell to government or large corporations that require them.

Crowdstrike in their official statement said "Linux and MacOS not affected". Are there any reports stating otherwise?

not affected because the bug is in the windows specific code, not because it works so much different on linux
Post reply on HN