A reminder why switching off auto-update is a thing.
It looks like it wasn’t a software update, it was a AV definitions update, so internal to the CA application.
CrowdStrike Update: Windows Bluescreen and Boot Loops
151–160 of 1001 posts
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#152Thanks god all the critical infrastructure in my country is still on MS DOS!
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#153If it's true that a bad patch was the reason for this I assume someone, or multiple people, will have a really bad day today. Makes me wonder what kind of testing they have in place for patches like this, normally I wouldn't expect something to go out immediately to all clients but rather a gradual rollout. But who knows, Microsoft keeps their master keys on a USB stick while selling cloud HSM so maybe Crowdstrike ju…
Doesn't matter what testing exists. More scale. More complexity. More Bugs.
Its like building a gigantic factory farm. And then realizing that environment itself is the birthing chamber and breeding ground of superbugs with the capacity to wipe out everything.
I used to work at a global response center for big tech once upon a time. We would get hundreds of issues, we couldn't replicate cause we literally have to set up our own govt or airline or bank or telco to test certain things.
So I used to joke with the corporate robots to just hurry up and take over govts, airlines, banks and telcos already, cause thats the only path to better control.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#154So Crowdstrike protects your computers from cyber attacks. But who is going to protect you from Crowdstrike?
Not Microsoft, that’s for sure
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#155CyberStrike offers a temporary solution for crashed systems
Cyberstike has given users a potential way to fix their systems.
Boot Windows into Safe Mode or the Windows Recovery Environment (you can do that by holding down the F8 key before the Windows logo flashes on screen) Navigate to the C:WindowsSystem32driversCrowdstrike directory Locate the file matching “C-00000291.sys” file, right click and rename it to “C-00000291.renamed” Boot the host normally.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#156We are a major CS client, with 50k windows-based endpoints or so. All down. There exists a workaround but CS does not make it clear whether this means running without protection or not. (The workaround does get the windows boxes unstuck from the boot loop, but they do appear offline in the CS host management console - which of course may have many reasons).
Does CS actually offer any real protection? I always thought it was just feel-good software, that Windows had caught up to separating permissions since after XP or so. Either one is lying/scamming, but which one?
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#157There appears to be a workaround but my question is how are they going to get all of these endpoints out of a BSOD loop?
Might need to manually do it. Depends on if there is any lower level admin access than windows for each system.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#158The only surprising thing is that this doesn't happen every month.
Nobody understands their runtime environment. Most IT org's long ago "surrendered" control and understanding of it, and now even the "management" of it (I use the term loosely) is outsourced.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#159Absolutely shameful display of how the cure can be worse than the disease. It's nonsense snake oil and security theater such as this that throws the cyber"security" industry into disrepute. One may as well have just installed McAfee Anti Virus.
This has been the story of the antivirus "industry" all along. They simultaneously seem to employ actual bona-fide security researchers while also making sure none of their software products are ever touched by people you could even refer to as "developers". I can't even imagine the noise at Microsoft from all the crash reports solely caused by antivirus software written by utter clowns injecting into other programs and, as here, into the kernel.
Previous: https://infosec.exchange/@wdormann/112530285189478825
Previous: https://thehackernews.com/2022/05/chinese-hackers-caught-exp...
Previous: https://www.ftc.gov/news-events/news/press-releases/2024/02/...
Previous: https://www.fortiguard.com/psirt/FG-IR-24-015
...
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#160Maybe they do perform canary deployments and Australia was the canary?
Certainly feels like it's disproportionately affecting us down under.