Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

techcommunity.microsoft.com

Post reply on HN
Print view View original

41–50 of 66 posts

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#41

Post by LASR »

concerned_user wrote: post #12
ssahoo wrote: post #9

Earlier quoted context omitted.

They recommend crowdstrike to customers. Now they are trying to at least skim some good will. Also bad a kernel module that can ruin the OS is partially their fault.

I also think Microsoft should be responsible, they gave the keys to sign the kernel driver so I expect that driver to at least be subject to regular testing and scrutiny not just when initial release was made.

Signing is meant only to verify the identity of the organization producing the signed artifact.

It’s not meant to signify that it’s bug-free.

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#42

Post by SoftTalker »

ssahoo wrote: post #9
Bognar wrote: post #7

Earlier quoted context omitted.

They could say "third party kernel modules are installed at your own risk" and provide the usual level of business hours support. CrowdStrike fucked up and Microsoft is helping its customers recover from CrowdStrike's fuckup.

They recommend crowdstrike to customers. Now they are trying to at least skim some good will. Also bad a kernel module that can ruin the OS is partially their fault.

That the OS needs a product like Crowdstrike in order to be safely used is also their fault.

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#43

Post by rdtsc »

It's interesting Microsoft is dealing with this. I wonder how they feel about CS? Can't imagine they are happy with them. So I would guess it's less of "let's work with our friends at CS" and more like "Those $#%!, they made a mess and we're left to clean it up".

I've already heard from multiple non-technical people presenting this as a "Microsoft problem". "Omg, did you hear what Microsoft just did to their customers?". I don't know if CS subtly pulling strings to look less guilty, but probably just happens by simple association "blue screen of death = Windows problem". Can't image Microsoft is too happy to take this kind of a reputational hit.

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#44

Post by hedora »

rdtsc wrote: post #43

It's interesting Microsoft is dealing with this. I wonder how they feel about CS? Can't imagine they are happy with them. So I would guess it's less of "let's work with our friends at CS" and more like "Those $#%!, they made a mess and we're left to clean it up". I've already heard from multiple non-technical people presenting this as a "Microsoft problem". "Omg, did you hear what Microsoft just did to their customer…

Yep; was at a restaurant yesterday, and it sounds like they got hit with the CloudStrike Linux outage a month or so ago.

They had no idea the two were probably the same vendor.

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#45

Post by hedora »

baq wrote: post #34
bloopernova wrote: post #28

Did anyone write a script to remove the file directly from VM disks, rather than booting the OS? Or does crowdstrike somehow prevent that solution?

I imagine having an unencrypted disk in 2024 can be most charitably called 'an oversight', so there's little point in attempting to deal with them. (Remember we're talking about boxes with crowdstrike installed...)

Are there VM platforms that can encrypt disks without giving the host access to the disk? Sure, they could use TPM or something, but that doesn't solve the problem.

Worst case, I imagine you could boot to the bootloader menu, then scrape the unwrapped bitlocker key from RAM.

(I agree that the org that mandated cloudstrike would collectively lay an egg if they realized this was possible.)

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#46

Post by hedora »

NelsonMinar wrote: post #20

This tool requires you physically plug in a UBS device and then touch the keyboard. One at a time. I can imagine it has to be this way but ouch, that is a lot of manual work. At least it's simple enough to train someone to do it.

Now you've got me wondering about the pile of regulatory fail that leads a company to install cloudstrike for endpoint security, but also to ship kiosks with physically accessible, bootable USB ports.

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#47

Post by stefan_ »

rdtsc wrote: post #43

It's interesting Microsoft is dealing with this. I wonder how they feel about CS? Can't imagine they are happy with them. So I would guess it's less of "let's work with our friends at CS" and more like "Those $#%!, they made a mess and we're left to clean it up". I've already heard from multiple non-technical people presenting this as a "Microsoft problem". "Omg, did you hear what Microsoft just did to their customer…

Well there is at least one way which they should be dealing with it, which is to immediately revoke the current CrowdStroke kernel driver. Surely that thing can't be kept loaded ready to explode at the next malformed "channel update". God knows the vendor can't be trusted to ensure that.

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#48

Post by hedora »

qingcharles wrote: post #33
ok123456 wrote: post #27

They should add CS Falcon to their malware definitions in Windows Defender. Crowdstrike has proved that its software is indistinguishable from malware. Also, while they're at it, add Trellex.

If you're running CrowdStrike I would think Windows Defender is probably disabled, no?

They could push a windows update that nukes CrowdStrike and re-enables Windows Defender. I'm pretty sure they've done that sort of thing in the past.

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#49

Post by dbcurtis »

rdtsc wrote: post #43

It's interesting Microsoft is dealing with this. I wonder how they feel about CS? Can't imagine they are happy with them. So I would guess it's less of "let's work with our friends at CS" and more like "Those $#%!, they made a mess and we're left to clean it up". I've already heard from multiple non-technical people presenting this as a "Microsoft problem". "Omg, did you hear what Microsoft just did to their customer…

> but probably just happens by simple association "blue screen of death = Windows problem"

This certainly happens. Before driver signing, an extremely common cause of BSODs was a page fault in the kernel caused by a driver bug that failed to lock down a page during I/O. Only if you had the hex codes of the various exceptions memorized would you be in a position to tell a driver-caused BSOD from some other cause. So.... "it must be Windows again". This was a powerful motivation for MSFT to start a driver validation lab that they forced vendors through.

And then... you have OS/2 -- where they actually used more than two security rings. Kernel in ring 0, user space in ring 3, and drivers in ring 1. Now the kernel can properly blame the driver. But of course, that can't be ported to CPU's with only 2 security levels.

Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints

#50

Post by augusto-moura »

hedora wrote: post #44
rdtsc wrote: post #43

It's interesting Microsoft is dealing with this. I wonder how they feel about CS? Can't imagine they are happy with them. So I would guess it's less of "let's work with our friends at CS" and more like "Those $#%!, they made a mess and we're left to clean it up". I've already heard from multiple non-technical people presenting this as a "Microsoft problem". "Omg, did you hear what Microsoft just did to their customer…

Yep; was at a restaurant yesterday, and it sounds like they got hit with the CloudStrike Linux outage a month or so ago. They had no idea the two were probably the same vendor.

Sorry for the ignorance, but what is this Crowdstrike Linux outage you mention? Couldn't find any easily accessible news on it
Post reply on HN