Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike Official RCA is now out [pdf]

crowdstrike.com

Post reply on HN
Print view View original

1–10 of 39 posts

Re: CrowdStrike Official RCA is now out [pdf]

#4

Post by portugalportuga »

kinda sounds like this was a regex bug?

> The selection of data in the channel file was done manually and included a regex wildcard matching criterion in the 21st field for all Template Instances, meaning that execution of these tests during development and release builds did not expose the latent out-of-bounds read in the Content Interpreter when provided with 20 rather than 21 inputs.

Re: CrowdStrike Official RCA is now out [pdf]

#5

Post by Terretta »

Add a new threat actor to the list, those pesky parameter counts actively trying to evade detection:

"This parameter count mismatch evaded multiple layers of build validation and testing, as it was not discovered during the sensor release testing process, the Template Type (using a test Template Instance) stress testing or the first several successful deployments of IPC Template Instances in the field."

Curious that csagent.sys isn't mentioned until last page, p. 12:

"csagent.sys is CrowdStrike’s file system filter driver, a type of kernel driver that registers with components of the Windows operating system…"

Re: CrowdStrike Official RCA is now out [pdf]

#6

Post by studmuffin650 »

portugalportuga wrote: post #4

kinda sounds like this was a regex bug? > The selection of data in the channel file was done manually and included a regex wildcard matching criterion in the 21st field for all Template Instances, meaning that execution of these tests during development and release builds did not expose the latent out-of-bounds read in the Content Interpreter when provided with 20 rather than 21 inputs.

Sounds more like a off by 1 bug that was hidden by regexs if I'm reading correctly

Re: CrowdStrike Official RCA is now out [pdf]

#8

Post by mrguyorama »

That's a lot of words to say "We did not test a file that gets ingested by a kernel level program, not even once"

At no point did they deploy this file to a computer they owned and attempted to boot it. They purposely decided to deploy behavior to every computer they could without even once making sure it wouldn't break from something stupid.

Are these people fucking nuts?

I do more testing than this and I might be incompetent. Also nothing I touch will kill millions of PCs. I get having pressure put on you from above, I get being encouraged to cut corners so some shithead can check off a box on his yearly review and make more money while stiffing you on your raise, I get making mistakes.

But like, fuck man, come on.

Post reply on HN