4 ms·
I don’t run CrowdStrike and to the best of my knowledge haven’t had it installed on one of my systems (something similar ran on my machine at the last corporate
by jonhohle 2y ago
I don’t run CrowdStrike and to the best of my knowledge haven’t had it installed on one of my systems (something similar ran on my machine at the last corporate Jon I had), so correct me if I’m wrong.
It seems great pains are made to ensure the CS driver is installed first _and_ cannot be uninstalled (presumably the remote monitor will notice) or tampered with (signed driver).
Then the driver goes and loads unsigned data files that can be arbitrarily deleted by end users? Can these files also be arbitrarily added by end users to get the driver to behave in ways that it shouldn’t? What prevents a malicious actor from writing a malicious data file and starting another cascade of failing machines or worse, getting kernel privileges?
- mr_mitm 2y agoThese files cannot be deleted or modified by the user, even with admin privs. That would make it trivial to disable the antivirus. It's only possible by mounting the file system in a different OS, which is typically prevented by Bitlocker.
- jonhohle 2y agoThe files are deletable through safe mode, no? I’m assuming they are writable by a program outside of the driver, right?
- mr_mitm 2y agoYes, but you need the Bitlocker key to get into safe mode
- discostrings 2y agoNot in the BitLocker configurations I've seen over the last few days. The file is deletable as a local administrator in safe mode without the BitLocker recovery key in at least some configurations.