Technical Details on Today's Outage
crowdstrike.com
Technical Details on Today's Outage
1–10 of 136 posts
Re: Technical Details on Today's Outage
#2I'm not a big expert but honestly this read like a bunch of garbage.
> Although Channel Files end with the SYS extension, they are not kernel drivers.
OK, but I'm pretty sure usermode software can't cause a BSOD. Clearly something running in kernel mode ate shit and that brought the system down. Just because a channel file not in kernel mode ate shit doesn't mean your kernel mode software isn't culpable. This just seems like a sleezy dodge.
Re: Technical Details on Today's Outage
#3Can someone who actually understands what CrowdStrike does explain to me why on earth they don't have some kind of gradual rollout for changes? It seems like their updates go out everywhere all at once, and this sounds absolutely insane for a company at this scale.
Re: Technical Details on Today's Outage
#4Where are the technical details?
Re: Technical Details on Today's Outage
#5I'm not a big expert but honestly this read like a bunch of garbage. > Although Channel Files end with the SYS extension, they are not kernel drivers. OK, but I'm pretty sure usermode software can't cause a BSOD. Clearly something running in kernel mode ate shit and that brought the system down. Just because a channel file not in kernel mode ate shit doesn't mean your kernel mode software isn't culpable. This just se…
The kernel driver reads the channel files. It choked on this one, and crashed.
Re: Technical Details on Today's Outage
#6I'm not a big expert but honestly this read like a bunch of garbage. > Although Channel Files end with the SYS extension, they are not kernel drivers. OK, but I'm pretty sure usermode software can't cause a BSOD. Clearly something running in kernel mode ate shit and that brought the system down. Just because a channel file not in kernel mode ate shit doesn't mean your kernel mode software isn't culpable. This just se…
The kernel driver reads the channel files. It choked on this one, and crashed.
That's what I thought. So saying "it's not a kernel mode driver" is technically true, but I don't need to explain why it's a bunch of nonsense to try to damage control their incompetence.
Re: Technical Details on Today's Outage
#7Can someone who actually understands what CrowdStrike does explain to me why on earth they don't have some kind of gradual rollout for changes? It seems like their updates go out everywhere all at once, and this sounds absolutely insane for a company at this scale.
Truly, how the extent the damage was so widespread is my main question at this point.
Everyone has a buggy release at some point, but impacting global customers at this level is damn near unforgivable.
Heads need to roll for this oversight.
Re: Technical Details on Today's Outage
#8I'm not a big expert but honestly this read like a bunch of garbage. > Although Channel Files end with the SYS extension, they are not kernel drivers. OK, but I'm pretty sure usermode software can't cause a BSOD. Clearly something running in kernel mode ate shit and that brought the system down. Just because a channel file not in kernel mode ate shit doesn't mean your kernel mode software isn't culpable. This just se…
It doesn't read to me as trying to dodge anything. They aren't saying "they're not kernel drivers, so everything is OK", they're saying "seeing the .sys on the filenames, you might think they're kernel drivers, but as it happens they're something else".
(Maybe there's some subtext that I'm missing, but I don't see how saying "these aren't kernel drivers" makes them look any better, and I do see why they might say it to be informative, so it looks like to me like they're doing the latter.)
Re: Technical Details on Today's Outage
#9Where are the technical details?
Yeah, this PR statement is pretty much devoid of information other than it is not a cyber attack.
Re: Technical Details on Today's Outage
#10Can someone who actually understands what CrowdStrike does explain to me why on earth they don't have some kind of gradual rollout for changes? It seems like their updates go out everywhere all at once, and this sounds absolutely insane for a company at this scale.
It sounds like Channel files are just basically definition updates in normal antivirus software; it's not actually code, just some stuff on what the software should "look out for".
And it sounds like they shipped some malformed channel file and the software that interprets it can't handle malformed inputs and ate shit. That software happened to be kernel mode, and also marked as boot-critical, so it if falls over, it causes a BSOD and inability to boot.
and it's kind of understandable that channel files might seem safe to update constantly without oversight, but that's just assuming that the file that interprets the channel file isn't a bunch of dogshit code.