4 ms·
Although it's a .sys file, it's not a device driver. "Although Channel Files end with the SYS extension, they are not kernel drivers." https://www.crowdstrike
by crustycoder 2y ago
Although it's a .sys file, it's not a device driver.
"Although Channel Files end with the SYS extension, they are not kernel drivers."
https://www.crowdstrike.com/blog/technical-details-on-todays-outage/ https://www.crowdstrike.com/blog/technical-details-on-todays...
- teeheelol 2y agoYeah it's a way of delivering a payload to the driver, which promptly crashed. Which is horrible!
- crustycoder 2y agoHorrible for sure, not least because hackers now know that the channel file parser is fragile and perhaps exploitable. I haven't seen any significant discussion about follow-on attacks, it's all been about rolling back the config file rather than addressing the root cause, which is the shonky device driver.
- OhMeadhbh 2y agoI suspect the wiley hackors have known how fragile that code is for years.