3 ms·
CrowdStrike does this trick where it replaces the file (being transferred over a network socket) with zeroes if it matches the malware signature. Assuming that
by execveat 2y ago
CrowdStrike does this trick where it replaces the file (being transferred over a network socket) with zeroes if it matches the malware signature. Assuming that these are the malware signature files themselves, a match wouldn't be surprising.
- bombcar 2y agoCrowStrike foot gunning itself would be amusing, if expected.
- kristjansson 2y agoFar and away the most entertaining of the possible root causes.
- tsavo 2y agoThis actually makes the most sense, and would help explain how the error didn't occur during testing (in good faith, I assume it was tested). In testing, the dev may have worked from their primary to deploy the update to a series of secondary drives, then sequential performed a test boot from each secondary drive configured for each supported OS version. A shortcut/quick way to test that would've bypassed how their product updates in customer environments, also bypassing checks their software may have performed (in this case, overwriting their own file's contents).