teeheelol

6 ms·

31.
by teeheelol 2y ago
Yeah it's a way of delivering a payload to the driver, which promptly crashed. Which is horrible!
32.
by teeheelol 2y ago
Windows does have that and does do that. Crowdstrike does stuff at UEFI level to install itself again.
33.
by teeheelol 2y ago
Smaller. No one has heard of us :)
34.
by teeheelol 2y ago
Windows does do that. Crowdstrike sticks it back in at the UEFI level by the looks, because you know, "security".
35.
by teeheelol 2y ago
Wiz is another bastard that impacted us yesterday. We had to fight it while it was making AWS snapshots constantly. Literally it killed our MTTR. This whole sector needs to rethink itself. In the CIA triangle it's all about the I and a
36.
by teeheelol 2y ago
Looking at the contents of c:\windows\system32\drivers\crowdstrike suggests it does all sorts of weird shit right down to injecting itself into UEFI and futzing with firmware. It's literally in everything. Unfortunately "security&
37.
by teeheelol 2y ago
Exactly this. This is a faulty and dangerous product from conception to execution.
38.
by teeheelol 2y ago
The issue is where it is integrated. You could arguably implement CrowdStrike in BPF on Linux. On NT they literally hook NT syscalls in the kernel from a driver they inject into kernel space which is much bad juju. As for macOS, you have no
39.
by teeheelol 2y ago
100% agree. I'm starting to think these vendors are a higher risk and cost than not having them.
40.
by teeheelol 2y ago
If that can break a kernel driver and lead to a blue screen then the code in the kernel driver is shit and that means the product is shit and a liability.
41.
by teeheelol 2y ago
Because our security guys are fuckwits. (I am operations management and fought against this product and approach for months)
42.
by teeheelol 2y ago
We do that. CS literally entirely pushed this over our staging system and straight into production.
43.
by teeheelol 2y ago
AWS is not any better really on this. In fact 2 years ago (to the day!) we had a complete AZ outage in our local AWS region. This resulted in their control plane going nuts and being unable to shut down or start new instances. Then capacity
44.
by teeheelol 2y ago
Yeah we have a staging and test process where we run their updated Falcon sensor releasees. They shit all over our controls and went to production. This says we don't control it and should not trust it. It is being removed.
45.
by teeheelol 2y ago
Yeah in context we have about 1000 remote workers down. We have to call them and talk through each machine because we can't fix them remotely because they are stuck boot looping. A large proportion of these users are non-technical.
46.
by teeheelol 2y ago
That would make sense but it appears everyone is doing EBS snapshots in our regions like mad so they aren't restoring. Spoke to our AWS account manager (we are a big big big org) and they have contention issues everywhere. I really wan
47.
by teeheelol 2y ago
That's not really the problem here. The problem is allowing a single vendor, with a reputation of fucking up over and over again, to push code into your production systems at will with no testing on your part.
48.
by teeheelol 2y ago
Throwaway account... CrowdStrike in this context is a NT kernel loadable module (a .sys file) which does syscall level interception and logs then to a separate process on the machine. It can also STOP syscalls from working if they are tryin