> I've obtained copies of the .sys driver files Crowdstrike customers have. They're garbage. Each customer appears to have a different one.
https://cyberplace.social/@GossiTheDog/112812454405913406
> The .sys files causing the issue are channel update files, they cause the top level CS driver to crash as they're invalidly formatted. It's unclear how/why Crowdstrike delivered the files and I'd pause all Crowdstrikes updates temporarily until they can explain.
If you have a Crowdstrike customer ID (CID) — which you can pull from any device that has the implant — you can request any channel file you want from their file server.
Ask for metahash+/cfs/channelfiles/0000000291/<YOUR CUSTOMER ID>/C-00000291-00000000-00000001.sys and you should get something that starts with:
00000000: aaaa aaaa 0100 2301 0000 0500 0000 0000 ......#.........
00000010: 0100 0000 4808 0000 2c08 0000 0600 0004 ....H...,.......
If I look at the C-00000291-00000000-00000032.sys version that Crowdstrike LFO serves me, I get something that looks superficially reasonable (not random garbage or full of zeroes).
I would share it, but my understanding is that channel files specifically can have different contents for different customers (as opposed to other files like their Linux kernel drivers, which is definitely the same giant .xz blob for everyone). So I'd rather not upload something that's potentially tied to a specific customer/company without asking for permission
But if you have a valid customer ID from Crowdstrike, I'm happy to point you the little tool I use. You can request old versions of channel files from LFO and look at the diff as much as you like. But I can't guarantee you'll actually be getting a file that's obviously broken or full of zeroes like some people are describing. My C291 0.32 looks superficially normal.
There are different files that can differ between customers.
9ca565965198cf1a5073ce974c5826d14aa3ac3cf574b3d2d2e7f80624b9ed90 = C-00000291-00000000-00000033.sys = https://www.virustotal.com/gui/file/9ca565965198cf1a5073ce97...
61486fe1aa690260bd846245f0fac204b26f41ed83f66e962cb548837f3ceb98 = C-00000291-00000000-00000057.sys = https://www.virustotal.com/gui/search/61486fe1aa690260bd8462...
More informed people will give you more details, but this kind of AV software often has privileged access to the OS, so it can scan your files. The same privileged access also means it can really mess things up if it's not well tested.
By contrast your ordinary python or VBA script should not be able to blue screen your machine, especially not during startup.
This is misleading. If you run a python or VBA script on startup with elevated permissions to e.g. setup a driver (with a bug) or do hardware configurations (in a way which doesn't work) then it will as much blue screen as a sys file.
The issue is not that it's a `.sys` file, but that a high privilege administrative task run at startup fails so hard that it blue screens.
(In windows the sys file extension is basically just a marker that the file is part of the "system" without being clear what it is, it can be anything from a data blob,over a data base, over python/VBA files to a device driver or a blob combining multiple of such things. They mostly contain device drivers and hardware configuration, but there are some which are basically just the equivalent of /etc/hostname)
The "if they want to" part is the difference, kernel drivers can easily cause BSoDs on accident, e.g. by writing to an invalid address, normal processes can't, they have to jump through hoops by choice.
It is even more likely that IT was at loggerheads with cyber, but nowadays cyber seems to be able to trump everything and everyone.
Kernel panic observed after booting 5.14.0-427.13.1.el9_4.x86_64 by falcon-sensor process -- https://access.redhat.com/solutions/7068083 -- 1 month ago
[CrowdStrike Falcon® Pro: Antivirus with Threat Intelligence](https://www.crowdstrike.com/products/bundles/falcon-pro/)
Peak irony then that you can just delete them. Surely an antivirus should recognize when its being rollbacked?
Don't you have to be in recovery mode, with it switched off, to do that?
Only a couple of years later did I understand that it was simply a shorthand for talking about Windows 95 and Windows 98.
Edit: And looking now at Wikipedia apparently it also covers Windows Me. (The Millennium Edition that came between Windows 98 and Windows XP.) https://en.wikipedia.org/wiki/Windows_9x
NGO, i think, discovered that parsing random data can lead to interesting results.l
How does that pass a security audit in the first place?
Yeah, ideally management should know better. But management aren’t usually engineers. Even when they are, they don’t deal with the code on a day to day basis. They usually know much less about the actual processes and risks than the engineers on the ground.
The question of "who is ultimately responsible" changes based on how we see the organisation. In organisations where the chief decides everything, its up to the chief to decide if they should place blame on someone or not. In a modern corporation, people at the bottom of the hierarchy are shielded from the consequences of their actions by the corporation. But there's also a weird form of infantilisation that goes along with that. We don't actually trust people on the ground to take responsibility for the work they do. All responsibility goes up the management hierarchy, along with control, power and pay. Its sort of assumed that people who haven't been promoted are too incompetent to make important choices.
I don't think thats the final form of how high functioning teams should work. Its noble that you're willing to put your head on the chopping block, but I think its also really important to give maximal agency to your employees. And that includes making people feel responsible and empowered to fix problems when they see them. You get more out of people by treating them like adults, not children. And they learn more, and I think that's usually, in the long run, better for everyone.
I agree that if a company has a bad process, employees shouldn't be fired over it. But I also think if you're an employee in a company with a bad process, you should fight to make the process better. Never let yourself be complicit in a mistake like this.
This is wrong. If a company is developing that kind of software is the responsibility of the company to provide a certain level of QA before they release software. And no, it's not that "engineers are pushing out shitty code", but that the shitty company allows shitty code to be deployed in customers' machines.
What matters is how this was deployed without any testing.
Only for the loosers.
One analogy is rounding - one rounding makes no difference to a transaction, but multiple systems rounding the same direction can have a large scale impact. It's not always rounding money - it can be error handling. A stops at the error, B goes on, turns out they're not in sync.
Which guy is it? The person who pressed the button? The manager who gave that person more than one task that day? The people who didn't sufficiently test the detection process? The people who wrote the specs without sufficient understanding of the full impact? The person who decided to layoff the people who knew the impact three months ago?
Unlikely, just as Solarwinds wasn't finished when they distributed malware that got government agencies hacked. You underestimate the slow turning radius of giant company purchasing departments.
SolarWinds got the US government hacked by the Russians and they still exist.
Boeing is still there... we'll see
We thought about Microsoft the same way, some 15 years ago. /s
I thought such characters are forbidden by Windows.
https://learn.microsoft.com/en-us/windows/win32/fileio/namin...
How did the tool even manage to create such a file?
I bet it's a glob pattern and indicates "anything"