5 ms·
Did anyone write a script to remove the file directly from VM disks, rather than booting the OS? Or does crowdstrike somehow prevent that solution?
by bloopernova 2y ago
Did anyone write a script to remove the file directly from VM disks, rather than booting the OS? Or does crowdstrike somehow prevent that solution?
- baq 2y agoI imagine having an unencrypted disk in 2024 can be most charitably called 'an oversight', so there's little point in attempting to deal with them. (Remember we're talking about boxes with crowdstrike installed...)
- hedora 2y agoAre there VM platforms that can encrypt disks without giving the host access to the disk? Sure, they could use TPM or something, but that doesn't solve the problem. Worst case, I imagine you could boot to the bootloader menu, then scrape the unwrapped bitlocker key from RAM. (I agree that the org that mandated cloudstrike would collectively lay an egg if they realized this was possible.)
- bloopernova 2y agoAhh, right. You'd need bitlocker keys. Although I wonder if the central key server could be queried to obtain each host's key? Also makes me wonder about a software configuration management system that operated on disks while the virtual hosts were powered down. With windows it feels like that'd be at least very difficult, but Linux could definitely be managed that way. Like an immutable operating system where changes can only come from the central controller, and the OS itself is written with that in mind. Dunno what benefit that might bring, but it's a fun mental excursion.
- TiredOfLife 2y agoAnd what OS with what security product do you think the central key server runs?
- bloopernova 2y agoWell, sure, the central key server will have been affected by this, but that's one VM to remediate/restore and would hopefully be done first. Or at least once people realize the key server is also down.