Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is in C-00000291*.sys?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 104 posts

Re: Ask HN: What is in C-00000291*.sys?

#21

Post by neverminder »

yuvadam wrote: post #17
neverminder wrote: post #14

Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.

Just a small reminder that's it's never "the guy" and always "the process", or lack thereof.

Yeah, but heads will have to roll for this one, the world will be calling for blood, so who better if not "the guy"?

Re: Ask HN: What is in C-00000291*.sys?

#22

Post by taneliv »

neverminder wrote: post #14

Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.

Enterprise Linuxes also employ Crowdstrike or similar "security" products as mandatory part of their IT deployments. Often (always?) this is due to companies wanting certification for their secure processes, in order to sell to government or large corporations that require them.

Re: Ask HN: What is in C-00000291*.sys?

#24

Post by alex_f_k »

https://cyberplace.social/@GossiTheDog/112812260542179660

> I've obtained copies of the .sys driver files Crowdstrike customers have. They're garbage. Each customer appears to have a different one.

https://cyberplace.social/@GossiTheDog/112812454405913406

> The .sys files causing the issue are channel update files, they cause the top level CS driver to crash as they're invalidly formatted. It's unclear how/why Crowdstrike delivered the files and I'd pause all Crowdstrikes updates temporarily until they can explain.

Re: Ask HN: What is in C-00000291*.sys?

#25

Post by ciabattabread »

neverminder wrote: post #14

Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.

Crowdstrike is finished? Ha!

SolarWinds got the US government hacked by the Russians and they still exist.

Re: Ask HN: What is in C-00000291*.sys?

#26

Post by alex_f_k »

rvba wrote: post #23
Conasg wrote: post #8

Specifically, if the file is corrupted, in what way is it corrupt? I’m fascinated by how this issue occurred.

I wonder if the * (asterisk / star) character in its name isnt causing the issue.

Star is part of a command to delete any file matching a wildcard `C-00000291*.sys` meaning "starts with 'C-00000291', has any kind of text after that and ends with '.sys'". Actual files appear to differ for every machine

Re: Ask HN: What is in C-00000291*.sys?

#27

Post by alserio »

neverminder wrote: post #21
yuvadam wrote: post #17

Earlier quoted context omitted.

Just a small reminder that's it's never "the guy" and always "the process", or lack thereof.

Yeah, but heads will have to roll for this one, the world will be calling for blood, so who better if not "the guy"?

the management that enabled the process. And follow the chain to the top, they are paid very well to own the risks

Re: Ask HN: What is in C-00000291*.sys?

#28

Post by codetrotter »

alex_f_k wrote: post #26
rvba wrote: post #23

Earlier quoted context omitted.

I wonder if the * (asterisk / star) character in its name isnt causing the issue.

Star is part of a command to delete any file matching a wildcard `C-00000291*.sys` meaning "starts with 'C-00000291', has any kind of text after that and ends with '.sys'". Actual files appear to differ for every machine

This exchange reminds me of a time many years ago where I was reading a computer magazine and they talked about “Windows 9x” and I thought they were referring to some version of Windows that I had never heard of.

Only a couple of years later did I understand that it was simply a shorthand for talking about Windows 95 and Windows 98.

Edit: And looking now at Wikipedia apparently it also covers Windows Me. (The Millennium Edition that came between Windows 98 and Windows XP.) https://en.wikipedia.org/wiki/Windows_9x

Re: Ask HN: What is in C-00000291*.sys?

#29

Post by stefan_ »

novaRom wrote: post #11

Just kernel drivers. To know what is inside, you can disassemble them with https://github.com/NationalSecurityAgency/ghidra

These files are apparently just definitions/input for the actual CrowdStroke driver, that presumably someone named .sys so it sounds more scary and important.

Peak irony then that you can just delete them. Surely an antivirus should recognize when its being rollbacked?

Re: Ask HN: What is in C-00000291*.sys?

#30

Post by neverminder »

taneliv wrote: post #22
neverminder wrote: post #14

Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.

Enterprise Linuxes also employ Crowdstrike or similar "security" products as mandatory part of their IT deployments. Often (always?) this is due to companies wanting certification for their secure processes, in order to sell to government or large corporations that require them.

Crowdstrike in their official statement said "Linux and MacOS not affected". Are there any reports stating otherwise?
Post reply on HN