4 ms·
"Load a kernel module and then verify it" is not the way any remotely competent engineer would do things. (...which doesn't rule out the possibility that CS wa
by wk_end 2y ago
"Load a kernel module and then verify it" is not the way any remotely competent engineer would do things.
(...which doesn't rule out the possibility that CS was doing it.)
- justinclift 2y agoThe ClownStrike Falcon software that runs on both Linux and macOS was incredibly flaky and a constant source of kernel problems at my previous work place. We had to push back on it regardless of the security team's (strongly stated) wishes, just to keep some of the more critical servers functional. Pretty sure "competence" wasn't part of the job description of the ClownStrike developers, at least for those pieces. :( :( :(
- soraminazuki 2y agoClownStrike left kernel panics unfixed for a year until macOS deprecated kernel extensions altogether. It was scary because crash logs indicated that memory was corrupted while processing network packets. It might've been exploitable.