5 ms·

>The first and easiest is simply to try to reboot affected machines over and over, which gives affected machines multiple chances to try to grab CrowdStrike's n

>The first and easiest is simply to try to reboot affected machines over and over, which gives affected machines multiple chances to try to grab CrowdStrike's non-broken update before the bad driver can cause the BSOD. I thought it was BSOD'ing on boot? I don't understand how this works. It auto-updates on boot? From the internet?

JumpCrisscross 2y ago
> It auto-updates on boot? From the internet? Apparently!
- avidphantasm 2y ago
  Probably has to do this early on in the boot process so as not to require a reboot after update because of Windows’s silly pessimistic file locking.
  - mschuster91 2y ago
    > because of Windows’s silly pessimistic file locking To be honest I prefer that over the #nix way of doing things. In Windows, you have exactly one file any given path can refer to - in Linux or Mac, it may depend on which directory's inode is seen as the root node by your process (e.g. chroot or container), or whether mounts are at play, or a file/directory got deleted and replaced by something else. Particularly the last scenario keeps tripping me every once in a while.
ukuina 2y ago
Yes, that is as bad as it sounds.
Ekaros 2y ago
I love how this is solution for security, while sounding like most insanely unsecure thing...
- InsideOutSanta 2y ago
  I mean, this is every antivirus software. "Let's run some antivirus vendor's code on your system that opens literally every file on your system, regardless of how it got there." Yeah, that's a great idea and not at all a huge attack vector.
  - gpderetta 2y ago
    You forgot the "... while in kernel mode".
- TillE 2y ago
  What, the auto-updating part? Obviously the client is verifying signatures (or using TLS with a client certificate, whatever), not just accepting whatever random file comes down the pipe.
  - Ekaros 2y ago
    Even then, how many affected machines there are? Tens of thousands, hundreds of thousands? Compromise these servers and even possible signing server and you have largest bot net or general compromise in history... It is not unreasonable to think that this sort of software could get compromised.
  - pas 2y ago
    A few more years and maybe they will add this newfangled super-innovative thing, invented by those esoteric academics at U of Haskell ... this new thing -- umm, what was it called -- try-catch perhaps.
- pas 2y ago
  this is a solution for "afterthought security" only.
tux3 2y ago
One of the first things the falcon driver does on boot is connect to the server, report some basic info, and start loading these data files, the "channel" files that Crowdstrike frequently updates. The BSOD is because one of the data files that they previously pushed is horribly mangled, and their driver explodes about it. But if you get lucky, the driver can receive an update notification on boot, connect to the separate file server, and finish overwriting the broken file on disk before the rest of the driver (that would crash) has loaded the broken file And they do all of that very early on boot. The justification being that you don't want the antivirus to start booting after a rootkit has already installed itself
- dboreham 2y ago
  WTF? Trust in the kernel should be Microsoft's responsibility and only theirs. Actually why is MS even allowing this crap code to run in their kernel? Isn't that a trust-destroying event?
  - Ekaros 2y ago
    Probably history and then some possible anti-trust litigation. As asking market leader not allow access to kernel like this would somehow be anti-trust violation...
  - munchler 2y ago
    Drivers have to run in the kernel in order to access hardware and other low-level system resources. That's how pretty much every mainstream OS works. For example, here's the guide for writing kernel-mode drivers in Linux: https://docs.kernel.org/driver-api/driver-model/overview.html https://docs.kernel.org/driver-api/driver-model/overview.htm... One might ask whether an anti-virus really needs to run inside the kernel, but the answer might reasonably be yes.
    - jug 2y ago
      Yes, I'm no security expert by any means but I'd assume that e.g. a rootkit would be best defeated by a kernel driver. So, this isn't really what's getting on my nerves here. Just how it auto updates and get pushed throughout the organizations without a smidge of quality assurance. Smaller businesses... Sure, I get it. They don't have the resources to set up infra for this, but those... airliners... and hospitals. WTF. I read some org thinking they might not even be able to provide anesthesia. Seriously. What.
TestingWithEdd 2y ago
Does this mean a computer without internet access and with CrowdStrike would be unable to start up?
- ryanjshaw 2y ago
  How did it get broken then?
  - TestingWithEdd 2y ago
    As in, does the OS require the internet so CrowdStrike can send telemetry data OR will it skip that step and just boot the OS like normal?
- ozzcer 2y ago
  Surely a computer without internet would not have received the update?
  - TestingWithEdd 2y ago
    But then would CrowdStrike stop the startup saying it requires network connectivity to initialize or something? Just wondering how invasive the app is
    - Jtsummers 2y ago
      No, it'd boot up just fine without a network connection (as long as it didn't have this borked update).
- indigodaddy 2y ago
  That would seem crazy. Maybe there is a crowdstrike onprem “master server” that is supposed to be available internally? Just spitballing, have no idea really

JumpCrisscross 2y ago

> It auto-updates on boot? From the internet? Apparently!

avidphantasm 2y ago
Probably has to do this early on in the boot process so as not to require a reboot after update because of Windows’s silly pessimistic file locking.
- mschuster91 2y ago
  > because of Windows’s silly pessimistic file locking To be honest I prefer that over the #nix way of doing things. In Windows, you have exactly one file any given path can refer to - in Linux or Mac, it may depend on which directory's inode is seen as the root node by your process (e.g. chroot or container), or whether mounts are at play, or a file/directory got deleted and replaced by something else. Particularly the last scenario keeps tripping me every once in a while.

ukuina 2y ago

Yes, that is as bad as it sounds.

Ekaros 2y ago

I love how this is solution for security, while sounding like most insanely unsecure thing...

InsideOutSanta 2y ago
I mean, this is every antivirus software. "Let's run some antivirus vendor's code on your system that opens literally every file on your system, regardless of how it got there." Yeah, that's a great idea and not at all a huge attack vector.
- gpderetta 2y ago
  You forgot the "... while in kernel mode".
TillE 2y ago
What, the auto-updating part? Obviously the client is verifying signatures (or using TLS with a client certificate, whatever), not just accepting whatever random file comes down the pipe.
- Ekaros 2y ago
  Even then, how many affected machines there are? Tens of thousands, hundreds of thousands? Compromise these servers and even possible signing server and you have largest bot net or general compromise in history... It is not unreasonable to think that this sort of software could get compromised.
- pas 2y ago
  A few more years and maybe they will add this newfangled super-innovative thing, invented by those esoteric academics at U of Haskell ... this new thing -- umm, what was it called -- try-catch perhaps.
pas 2y ago
this is a solution for "afterthought security" only.

tux3 2y ago

One of the first things the falcon driver does on boot is connect to the server, report some basic info, and start loading these data files, the "channel" files that Crowdstrike frequently updates. The BSOD is because one of the data files that they previously pushed is horribly mangled, and their driver explodes about it. But if you get lucky, the driver can receive an update notification on boot, connect to the separate file server, and finish overwriting the broken file on disk before the rest of the driver (that would crash) has loaded the broken file And they do all of that very early on boot. The justification being that you don't want the antivirus to start booting after a rootkit has already installed itself

dboreham 2y ago
WTF? Trust in the kernel should be Microsoft's responsibility and only theirs. Actually why is MS even allowing this crap code to run in their kernel? Isn't that a trust-destroying event?
- Ekaros 2y ago
  Probably history and then some possible anti-trust litigation. As asking market leader not allow access to kernel like this would somehow be anti-trust violation...
- munchler 2y ago
  Drivers have to run in the kernel in order to access hardware and other low-level system resources. That's how pretty much every mainstream OS works. For example, here's the guide for writing kernel-mode drivers in Linux: https://docs.kernel.org/driver-api/driver-model/overview.html https://docs.kernel.org/driver-api/driver-model/overview.htm... One might ask whether an anti-virus really needs to run inside the kernel, but the answer might reasonably be yes.
  - jug 2y ago
    Yes, I'm no security expert by any means but I'd assume that e.g. a rootkit would be best defeated by a kernel driver. So, this isn't really what's getting on my nerves here. Just how it auto updates and get pushed throughout the organizations without a smidge of quality assurance. Smaller businesses... Sure, I get it. They don't have the resources to set up infra for this, but those... airliners... and hospitals. WTF. I read some org thinking they might not even be able to provide anesthesia. Seriously. What.

TestingWithEdd 2y ago

Does this mean a computer without internet access and with CrowdStrike would be unable to start up?

ryanjshaw 2y ago
How did it get broken then?
- TestingWithEdd 2y ago
  As in, does the OS require the internet so CrowdStrike can send telemetry data OR will it skip that step and just boot the OS like normal?
ozzcer 2y ago
Surely a computer without internet would not have received the update?
- TestingWithEdd 2y ago
  But then would CrowdStrike stop the startup saying it requires network connectivity to initialize or something? Just wondering how invasive the app is
  - Jtsummers 2y ago
    No, it'd boot up just fine without a network connection (as long as it didn't have this borked update).
indigodaddy 2y ago
That would seem crazy. Maybe there is a crowdstrike onprem “master server” that is supposed to be available internally? Just spitballing, have no idea really