Can someone share a link to a copy of the offending channel file. Now a crowd strike customer, but interested in poking at its contents. Thanks!
Ask HN: What is in C-00000291*.sys?
81–90 of 104 posts
Re: Ask HN: What is in C-00000291*.sys?
#82Earlier quoted context omitted.
They might just be encrypted with a customer-specific key. That wouldn't surprise me.
They weren't last time I looked. They seem to contain a bunch of different things, but you can absolutely download and parse them without needing to decrypt anything. If you have a Crowdstrike customer ID (CID) — which you can pull from any device that has the implant — you can request any channel file you want from their file server. Ask for metahash+/cfs/channelfiles/0000000291/ /C-00000291-00000000-00000001.sys an…
Could you please upload it to some place and share a link. Curious to examine the contents.
Re: Ask HN: What is in C-00000291*.sys?
#83Earlier quoted context omitted.
Yeah, but heads will have to roll for this one, the world will be calling for blood, so who better if not "the guy"?
When the world calls for blood against your organization, it's a test of the organization's character: will they throw a scapegoat under the bus (even if there is a directly responsible person) or will they defend their staff, accept fault, and demonstratively improve process?
The answer is yes
Re: Ask HN: What is in C-00000291*.sys?
#84Earlier quoted context omitted.
> that you can just delete them Don't you have to be in recovery mode, with it switched off, to do that?
I don’t have a Windows setup, let alone one with CrowdStrike installed, but for this, you have to be in recovery mode to boot, not necessarily to be able to delete that file. For that, admin access may be enough.
You do need to be in safe mode.
Re: Ask HN: What is in C-00000291*.sys?
#85Re: Ask HN: What is in C-00000291*.sys?
#86Earlier quoted context omitted.
They weren't last time I looked. They seem to contain a bunch of different things, but you can absolutely download and parse them without needing to decrypt anything. If you have a Crowdstrike customer ID (CID) — which you can pull from any device that has the implant — you can request any channel file you want from their file server. Ask for metahash+/cfs/channelfiles/0000000291/ /C-00000291-00000000-00000001.sys an…
Could you please upload it to some place and share a link. Curious to examine the contents.
I woke up after they'd already pulled the bad update, and I don't have an affected system.
If I look at the C-00000291-00000000-00000032.sys version that Crowdstrike LFO serves me, I get something that looks superficially reasonable (not random garbage or full of zeroes).
I would share it, but my understanding is that channel files specifically can have different contents for different customers (as opposed to other files like their Linux kernel drivers, which is definitely the same giant .xz blob for everyone). So I'd rather not upload something that's potentially tied to a specific customer/company without asking for permission
But if you have a valid customer ID from Crowdstrike, I'm happy to point you the little tool I use. You can request old versions of channel files from LFO and look at the diff as much as you like. But I can't guarantee you'll actually be getting a file that's obviously broken or full of zeroes like some people are describing. My C291 0.32 looks superficially normal.
Re: Ask HN: What is in C-00000291*.sys?
#87The most successful malware of 2024, even though it only does denial of service.
So far.
Re: Ask HN: What is in C-00000291*.sys?
#88Does anyone understand what a channel file is? Some sort of patch/dll that a driver loads?
Re: Ask HN: What is in C-00000291*.sys?
#89Specifically, if the file is corrupted, in what way is it corrupt? I’m fascinated by how this issue occurred.
> I’m fascinated by how this issue occurred.
NGO, i think, discovered that parsing random data can lead to interesting results.l
Re: Ask HN: What is in C-00000291*.sys?
#90Does anyone understand what a channel file is? Some sort of patch/dll that a driver loads?
It's a binary format specific to Crowdstrike for delivering updates. It's not a DLL or a plain patch, it's their own file format. And they have a lot of different things in there (config, regularly updated data, instructions to download the next driver version, etc etc)