b&q still crowdstruck?

no response ...

Indeed, and what smart Alec came up with that scheme for driving a coach and horses through the "secure by design" architecture that normally would have made that level of bug impossible?

I appreciate they need to respond quickly to emerging threats, but if you are going to find a way to modify the behaviour of kernel level code

(Now their "mechanism" is out of the bag, I can see people bad actors looking for ways to exploit their kernel level driver to run unsigned malicious code at ring 0 - much the same way that malware authors leveraged the Sony rootkit they sneaked onto peoples PCs with dodgy audio CDs)

I've not understood exactly what it is these CrownThingy people were doing? What is the service they supposedly provide, and why is it necessary? What is the problem they are presumably solving?

I think they were in charge of essentially auto-updating all corporate windows and ensuring it was virus free and making it secure against hacking

AIUI you install their 'malware' server at kernel level and it spends its time looking for and smashing malware.

I am not sure why they were installing updates to windows, unless it was updates to their own servers.

It is all faintly reminiscent of that sci fi film, where a large security company is in fact a front for the biggest cybercriminal outfit of all time

Why? Doesn't Windows come with something which already does that? Not the updating, perhaps, but then I would have expected these outfits to have their own IT departments which scheduled updates depending on the availability requirements for a particular desktop. I might also have expected any large outfit to have all their corporate stuff nation-wide on their own private network (using 10.x.x.x, perhaps) to then be gatewayed at their network boundary.

I continue to be astonished that for example NHS entities get hacked and/or blackmailed and people seem to consider this normal.

In message snipped-for-privacy@mid.individual.net>, Tim Streater snipped-for-privacy@streater.me.uk> writes

Supposedly. Running on W10, a few months back, I got a couple of warnings about trojans. The warnings came not from Windows Defender (the inbuilt AV), but from the backup system (the W7 utility). That was identifying files in my Firefox and Thunderbird caches that supposedly contained trojans. The odd thing was that the dates on those files were from months earlier.

I suspect that part of the reason that NHS systems get hacked is that with the best will in the world, they don't have (can't get ?) good IT people to set things up to prevent it, and as we've seen, outsourcing it isn't always a good move (Horizon, many NHS projects, ...).

Adrian

The whole idea is like car leasing. Outsource the whole thing to someone else and turn a loss making personell filled IT department into a simple write off against taxes.

They are better at fixing people than computers

If that device driver does what I think (and I do have a Microsoft glass here in front of me from the compatibility testing "plugfest" I went to) it attaches to a hook in the higher levels of the filesystem stack. It can monitor what files are being opened, and look at the data being read. This is of course critical to looking at them and seeing if they contain viruses.

How that updated driver got past QA in Crowdstrike, or for that matter Microsoft, is another matter entirely.

Andy

It wasn't a driver, but a data file for new virus signatures (or similar). And it wasn't validated properly when it was read in.

My understanding is that it was a file containing all zeros. If it had a simple chjecksum-to-zero, it would have passed that, but that's just a guess.

I conclude from these replies that no-one knows why these outfits are not just relying on Defender to do this job.

Possibly Defender is not considered to get updates quickly enough. I haven't actually used Windows much in the last few years, but I don't think I ever saw a Defender update that wasn't part of the scheduled monthly bunch. It's very rare for MS to do an 'out of band' update, and the only one I can call to mind was for the unbelievable Windows MetaFile vulnerability, long before Defender existed.

Also, people became accustomed over decades to having to hire third-party utilities to keep their Windows installations reasonably safe, and probably assumed that when Defender finally appeared, it was unlikely to be as good as the products from companies with years of experience.

There may even, with some large businesses and therefore very large amounts of money at stake, be a certain amount of lobbying* involved.

It want a driver apparently, it was a script that loaded a driver or something. Missing a period or something.

CrowdStrike produces a suite of security software products for businesses, designed to protect computers from cyberattacks.

The Falcon Sensor product, CrowdStrike's vulnerability scanner, installs an endpoint sensor at the operating system kernel level on individual computers to detect and prevent threats.[12]

Patches are routinely distributed by CrowdStrike to its clients to enable their computers to address new threats.[13] "

Which makes it kernel level heuristic detection. But some of the analysis comes from uploading the patterns seen, to CrowdStrike, for analysis.

A Hacker News user claimed that on the evening of Friday, 19 April 2024, that Crowdstrike issued a flawed software update that crashed computers running

Debian Linux

builds and kept them from rebooting normally. The user also claims that CrowdStrike acknowledged the bug a day later and weeks later determined the cause. "

"May 2024 incident

On 13 May 2024, it was reported on the Rocky Linux forums that servers with CrowdStrike software may freeze after upgrading to Rocky Linux 9.4.[62]

CrowdStrike reported that they were aware of the problem as it was the same issue due to a Linux Sensor in user mode combined with specific 6.x kernel versions."

So the mechanism is different in Linux. Not that the description, at face value, makes sense.

An example of crafting a Sensor for Linux, would be Wireshark. Either the PCAP runs as root, or the PCAP is a service (daemon) which is elevated to provide a service to ordinary user accounts. You would not normally leave Wireshark running all the time. If the PCAP ran without elevation, it would be pretty useless.

Paul

Ring 3 is up here, with the User

Ring 0 is down here, with the Kernel. Ring 0 is the land of privilege, direct HW register access.

P-Code ===> Driver (unchanged, WHQL, signed) ===> Shenanigans shoot out this side... (Dynamic) interprets P-Codes. A form of (Poorly tested) interpreted language. The Driver is just an engine, without intel. P-code is the intelligence.

And you don't even need CrowdStrike, to have Windows trouble.

My 5950X started acting up about three weeks ago. It would go to a black screen (not a BSOD). The power meter I have connected to the mains cord, would register 54 Watts (when idle is 36 watts). It's like the CPU halted (halt on all cores). The elevated power, could be the BIOS leaving VCore at a little higher value. Or, there really was a loop construct at work. If it was looping (railed on one core), the mains cord would have read around 115 watts or so. (Machine full power is 224 watts.)

The CPU is not defective, because it runs fine on the other machine.

Linux was also used to test the CPU and original motherboard, and it runs fine too. No halt there.

There is no eventvwr.msc entry. The log indicates a dirty shutdown event (similar to what happens on a power drop). There is no Machine Check Error (MCE), which would be a normal way of recording rancid silicon. There is no BSOD. There is no evidence.

On teh Internetz, the word is this can be stopped by modifying the C state settings... which I COULD NOT FIND in the BIOS :-/ Such is life in the year 2024. That's a bandaid, not a solution by the way.

You don't need Crowdstrike, to drop a "modern" machine.

Paul

Bit if you have it, it sure helps.

Dave Plummer, a retired Microsoft developer, has a Youtube video with some details.

"CrowdStrike IT Outage Explained by a Windows Developer"

Paul

Among other things (AV, intrusion detection etc) they do patch management - making sure that all relevant security fixes etc are applied promptly before they can be exploited. They have endpoints for most platforms including Windows, Linux, and Mac.

Since most successful exploits in the wild are against unpatched systems, this kind of service is considered close to essential for production systems that are internet facing.

Windows will generally take care of its own patching, but patch managers deal with all the installed software including apps, drivers, middleware etc.

Microsoft verified the kernel mode driver and signed it. Had they updated the driver, it would have had to go through the windows hardware evaluation process again. So to circumvent that they instead had the kernel driver read a downloaded config file to allow it to modify its behaviour without any code changes. That config file was all zeros, and they did not validate the content before acting on it.