Hacker News Reader

Comment by TowerTall | Hacker News Reader

> Thorough testing of all configurations of Windows is likely impossible - but it's clear this one affected so many it was a common one - why was this not caught?

You might want to investigte the technical details of what CrowdStrike driver actually do. It has the ability to load a configuration file that contains code and then execute that code. Crowdstrike uses their own update server. Microsoft has validated the driver but when the driver has the ability to connect to CrowdStriks servers and download code, it is hard to blame Microsoft for not checking this code. Had CrowdStrike instead chosen to use Windows Update for this, Microsoft would have checked and caught this, but CrowdStrike decided to bypass Microsoft and use their own update servers instead.

View on HN

That's the point I was making through - the rigor here failed here by Microsoft allowing companies to push this kind of stuff with only some kind of basic sign-off in the distant past that they get the keys to do this.

If Crowdstrike didn't have the capacity to test this, either they should be handing it off to Microsoft to deliver through their channels, or they need to be forced to increase the testing capacity and improve the processes in their delivery (as do all companies with root-level access here)

> load a configuration file that contains code and then execute that code

Citation needed (sorry!).

Of the reports I've read, the most technical of those only say the config files were full of null bytes, which when parsed/loaded by Crowdstrike's driver then in-turn caused their driver to perform a null deference.

...this doesn't mean that those files contain executable code; just that their driver code was sloppy for not validating file input (presumably their parser took a null-byte in its input as as equivalent to a null (i.e. an empty reference) in its internal data structures. To my knowledge, there's no indication or hint of CrowdStrike's driver doing anything like loading arbitrary binary code from those config files - or memory-mapping those files - and directly executing it via JMP or CALL or some Windows kernel functgion.

////

Apparently the the Windows kernel does allow drivers to have RWX pages (yikes!?), so I'll admit that it's possible that CrowdStrike's driver was doing this, but surely any competent driver/kernel-mode devs knows to never do this? (unless you're writing malware, I guess?): https://community.osr.com/t/windows-kernel-writeable-and-exe...

> > load a configuration file that contains code and then execute that code

> Citation needed (sorry!).

I'm unable to validate Dave's statements[0] but he's an retired Microsoft engineer who appears to know his stuff.

I definitely don't expect CrowdStrike to piss off their investors - they are and will be sweeping this under the rug, and possibly will change company name due to trashed reputation.

[0] https://www.youtube.com/watch?v=wAzEJxOo1ts

> it is hard to blame Microsoft for not checking this code

I don't blame Microsoft for the mistakes of Cloudstrike. I DO blame Microsoft for clearly fishing in troubled waters, trying to get back control during a crisis.

Reply on news.ycombinator.com