3 ms·
In princple, yes, if you have third-party Ring 0 kernel-mode drivers, they could crash a POSIX system as well as a windows one. But that doesn't seem to be wha
by red_admiral 2y ago
In princple, yes, if you have third-party Ring 0 kernel-mode drivers, they could crash a POSIX system as well as a windows one.
But that doesn't seem to be what happened here.
Random idea that I haven't fully thought through: continue to run the kernel at Ring 0 and userland at Ring 3, but move "tools" like this to Ring 1.
- doikor 2y agoProblem with that is the tool can’t protect the system from any bad actor who gets ring 0 access. And even if it has ring 0 access it can’t really verify anything without secureboot or something like it verifying that nothing else started before it. This is also why Riots anti cheat runs as ring 0 as it has to protect the game against the owner/admin of the machine. (And after that there is still bios or firmware level exploits)
- ahazred8ta 2y agoWindows has an official ELAM Early Launch AntiMalware framework, which Crowdstrike complies with. The Crowdstrike driver is right where it's supposed to be, according to Microsoft.