8 ms·
Ask HN: What is in C-00000291*.sys?
- Si1ent 2y agoDoes anyone have the BSoD dump file when it crashed? our a C-00000291-00000000-00000032.sys output de-identified ?
- brettermeier 2y agoContext: CrowdStrike (https://news.ycombinator.com/item?id=41002195 https://news.ycombinator.com/item?id=41002195)
- cobalt60 2y agohttps://news.ycombinator.com/item?id=41002195 https://news.ycombinator.com/item?id=41002195
- H8crilA 2y agoThe most successful malware of 2024, even though it only does denial of service.
- deleted 2y ago[deleted]
- paulnpace 2y agoSeems DoS "just works".
- sebazzz 2y agoIts a different kind of distributed denial of service (DDoS).
- hackeraccount 2y agoSo far.
- deleted 2y ago[deleted]
- AverageIdiot 2y agoHm, is there any website that explains why C-00000291*.sys caused the widespread BSODs? For example, was it some kind of definition file that was accessing invalid memory locations?
- craxdevil7 2y agohttps://medium.com/@confusedcyberwarrior/when-security-becomes-the-threat-the-crowdstrike-incident-9bbaeab9db9d https://medium.com/@confusedcyberwarrior/when-security-becom...
- longdustytrail 2y agoThis is just generic speculation
- deleted 2y ago[deleted]
- Conasg 2y agoSpecifically, if the file is corrupted, in what way is it corrupt? I’m fascinated by how this issue occurred.
- zmatt 2y agoCrowdstrike has published some technical details: https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/ https://www.crowdstrike.com/blog/falcon-update-for-windows-h...
- tomesco 2y agoIt likely contains a bug but is an uncorrupted file. Corrupted to me means the file was changed or modified in a way from it's intended state and likely won't run anymore.
- rvba 2y agoI wonder if the * (asterisk / star) character in its name isnt causing the issue.
- alex_f_k 2y agoStar is part of a command to delete any file matching a wildcard `C-00000291*.sys` meaning "starts with 'C-00000291', has any kind of text after that and ends with '.sys'". Actual files appear to differ for every machine
- codetrotter 2y agoThis exchange reminds me of a time many years ago where I was reading a computer magazine and they talked about “Windows 9x” and I thought they were referring to some version of Windows that I had never heard of. Only a couple of years later did I understand that it was simply a shorthand for talking about Windows 95 and Windows 98. Edit: And looking now at Wikipedia apparently it also covers Windows Me. (The Millennium Edition that came between Windows 98 and Windows XP.) https://en.wikipedia.org/wiki/Windows_9x https://en.wikipedia.org/wiki/Windows_9x
- lordnacho 2y agoIt's a crowdstrike update file with a bug in it, from what I gather. This makes your Windows machine go blue screen and stop working as it starts up. If you manage to remove it by various methods, it doesn't run and you're fine. More informed people will give you more details, but this kind of AV software often has privileged access to the OS, so it can scan your files. The same privileged access also means it can really mess things up if it's not well tested. By contrast your ordinary python or VBA script should not be able to blue screen your machine, especially not during startup.
- dathinab 2y ago> By contrast your ordinary python or VBA script should not be able to blue screen your machine, especially not during startup. This is misleading. If you run a python or VBA script on startup with elevated permissions to e.g. setup a driver (with a bug) or do hardware configurations (in a way which doesn't work) then it will as much blue screen as a sys file. The issue is not that it's a `.sys` file, but that a high privilege administrative task run at startup fails so hard that it blue screens. (In windows the sys file extension is basically just a marker that the file is part of the "system" without being clear what it is, it can be anything from a data blob,over a data base, over python/VBA files to a device driver or a blob combining multiple of such things. They mostly contain device drivers and hardware configuration, but there are some which are basically just the equivalent of /etc/hostname)
- schroeding 2y agoEvery Windows executable can crash a Windows system with the SE_SHUTDOWN_NAME privilege (which, contrary to the name, not only allows safe normal shutdowns) if they want to, though, which most of the time every user has. The "if they want to" part is the difference, kernel drivers can easily cause BSoDs on accident, e.g. by writing to an invalid address, normal processes can't, they have to jump through hoops by choice.
- novaRom 2y agoJust kernel drivers. To know what is inside, you can disassemble them with https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra
- stefan_ 2y agoThese files are apparently just definitions/input for the actual CrowdStroke driver, that presumably someone named .sys so it sounds more scary and important. Peak irony then that you can just delete them. Surely an antivirus should recognize when its being rollbacked?
- petesergeant 2y ago> that you can just delete them Don't you have to be in recovery mode, with it switched off, to do that?
- commercialnix 2y agoIt provides the electrolytes Windows craves.
- amarcheschi 2y agoOn another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't have kernel level access?
- tastroder 2y agoThe Linux version of CS sensor defaults to being installed as a kernel module as well.
- anothernewdude 2y agoWho would trust that?
- fragmede 2y agoyour employer's IT department
- pdw 2y agoAnd especially their auditors
- braiamp 2y agoThis is a management move. IT probably wasn't in the loop, since this effectively reduce the responsibilities of IT in terms of compliance.
- inkyoto 2y agoThe cyber unit within IT is more likely, those ones are besotted with ticking compliance checkboxes, the delegation of responsibility and a game of musical chairs at any cost. It is even more likely that IT was at loggerheads with cyber, but nowadays cyber seems to be able to trump everything and everyone.
- nopcode 2y agoI work in a customer-facing role for a similar product. The handful of customers that asked about kernel modules / drivers saw it as a plus not a con.
- neverminder 2y agoWouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.
- yuvadam 2y agoJust a small reminder that's it's never "the guy" and always "the process", or lack thereof.
- neverminder 2y agoYeah, but heads will have to roll for this one, the world will be calling for blood, so who better if not "the guy"?
- alserio 2y agothe management that enabled the process. And follow the chain to the top, they are paid very well to own the risks
- averageRoyalty 2y agoMore importantly, the companies that enabled auto update from a vendor to production rather than having a validation process. This sort of issue can happen with any vendor, penalising the vendor won't help with the next time this happens.
- gquere 2y agoWas there a way to not enable these channel updates? If so, would you still check all the mandatory security measures when being audited?
- averageRoyalty 2y ago
- rvba 2y agoHow is the * (star / asterisk) character allowed in the file name? I thought such characters are forbidden by Windows. https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file https://learn.microsoft.com/en-us/windows/win32/fileio/namin... How did the tool even manage to create such a file?
- copywrong2 2y agoecho lol > 'l*l'; ls 'l*l' I bet it's a glob pattern and indicates "anything"
- fragmede 2y agoit's deleting all matching files
- martyvis 2y agoThere was only one file matching it on my machine. The * just saves typing.
- alex_f_k 2y agohttps://cyberplace.social/@GossiTheDog/112812260542179660 https://cyberplace.social/@GossiTheDog/112812260542179660 > I've obtained copies of the .sys driver files Crowdstrike customers have. They're garbage. Each customer appears to have a different one. https://cyberplace.social/@GossiTheDog/112812454405913406 https://cyberplace.social/@GossiTheDog/112812454405913406 > The .sys files causing the issue are channel update files, they cause the top level CS driver to crash as they're invalidly formatted. It's unclear how/why Crowdstrike delivered the files and I'd pause all Crowdstrikes updates temporarily until they can explain.
- pdw 2y agoThey might just be encrypted with a customer-specific key. That wouldn't surprise me.
- tux3 2y agoThey weren't last time I looked. They seem to contain a bunch of different things, but you can absolutely download and parse them without needing to decrypt anything. If you have a Crowdstrike customer ID (CID) — which you can pull from any device that has the implant — you can request any channel file you want from their file server. Ask for metahash+/cfs/channelfiles/0000000291/<YOUR CUSTOMER ID>/C-00000291-00000000-00000001.sys and you should get something that starts with: 00000000: aaaa aaaa 0100 2301 0000 0500 0000 0000 ......#......... 00000010: 0100 0000 4808 0000 2c08 0000 0600 0004 ....H...,....... That's a channel file, unencrypted.
- screwgauge1 2y agoCould you please upload it to some place and share a link. Curious to examine the contents.
- tux3 2y agoI woke up after they'd already pulled the bad update, and I don't have an affected system. If I look at the C-00000291-00000000-00000032.sys version that Crowdstrike LFO serves me, I get something that looks superficially reasonable (not random garbage or full of zeroes). I would share it, but my understanding is that channel files specifically can have different contents for different customers (as opposed to other files like their Linux kernel drivers, which is definitely the same giant .xz blob for everyone). So I'd rather not upload something that's potentially tied to a specific customer/company without asking for permission But if you have a valid customer ID from Crowdstrike, I'm happy to point you the little tool I use. You can request old versions of channel files from LFO and look at the diff as much as you like. But I can't guarantee you'll actually be getting a file that's obviously broken or full of zeroes like some people are describing. My C291 0.32 looks superficially normal.
- benmmurphy 2y agoA malware delivery platform sponsored by the US security state. All customers get customised versions nothing to see here.
- yert14 2y agoNew to IT, but this sure seems like a huge security risk. Even though the CEO and others have said otherwise. People who are more experienced, please let me know if I am wrong.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- screwgauge1 2y agoCan someone share a link to a copy of the offending channel file. Now a crowd strike customer, but interested in poking at its contents. Thanks!
- ltadeut 2y agoDoes anyone understand what a channel file is? Some sort of patch/dll that a driver loads?
- tux3 2y agoIt's a binary format specific to Crowdstrike for delivering updates. It's not a DLL or a plain patch, it's their own file format. And they have a lot of different things in there (config, regularly updated data, instructions to download the next driver version, etc etc)
- Si1ent 2y agoDoes anyone have the BSoD dump file our the C-00000291-00000000-00000001.sys de-identified to analyze both
- megvt08 2y agoDoes anyone have the actual file, I have a copy but it seems to be a good version unfortunately. Really appreciate if anyone can upload it here