![]() ![]() ![]() ![]() |
|
neb:
1: if useriq == room_temp goto 1
Now this I will need to remember for later re-use; such a useful phrase!
Overall I’m really pleased with how my first day working at Crowdstrike went yesterday.
A couple of minor mistakes, no biggie…
ππ€£π
When truth is stranger than fiction: Someone mentioned that this would hit Crowdstroke's stock price, and I commented that Equifax recovered its pre-breach value in 12 months and has skyrocketed since then:
Given Crowdstroke's newly-acquired global mindshare, it could recover even quicker than Equifax did: "Everyone depends on this company, their shares have gotta be undervalued until now".
And sure enough, in under a day:
https://www.forbes.com/sites/dereksaul/2024/07/19/crowdstrike-stock-tanks-15-set-for-worst-day-since-2022/
The CrowdStrike selloff is an “an overreaction to a temporary setback,” Rosenblatt analyst Catharine Trebnick wrote in a note to clients Friday. It’s a “compelling buying opportunity” as it creates a window for investors to buy into a high-quality, growth-oriented cybersecurity company at a discounted valuation,” Trebnick continued.
Is there any other industry where a company that caused global outages of banks, airlines, government departments, hospitals, trains, and buses is a "compelling buying opportunity"?
The memes are starting to flood social media π
Technical Details
On Windows systems, Channel Files reside in the following directory:
C:\Windows\System32\drivers\CrowdStrike\
and have a file name that starts with βC-β. Each channel file is assigned a number as a unique identifier. The impacted Channel File in this event is 291 and will have a filename that starts with βC-00000291-β and ends with a .sys extension. Although Channel Files end with the SYS extension, they are not kernel drivers.
Channel File 291 controls how Falcon evaluates named pipe1 execution on Windows systems. Named pipes are used for normal, interprocess or intersystem communication in Windows.
The update that occurred at 04:09 UTC was designed to target newly observed, malicious named pipes being used by common C2 frameworks in cyberattacks. The configuration update triggered a logic error that resulted in an operating system crash
sudo:
The memes are starting to flood social media π
That's generous. We call it "Office 359" at work.
Wheelbarrow01:Overall I’m really pleased with how my first day working at Crowdstrike went yesterday.
A couple of minor mistakes, no biggie…ππ€£π
clinty: Crowd strike have blogged the technical details of what happened
A bit light on detail there. The crash resulted from an access violation, dereferencing an incorrectly initialised pointer (not a NULL pointer as some reports indicate).
The code which caused the crash may well have been years old and only triggered by the new configuration.
SirHumphreyAppleby:
clinty: Crowd strike have blogged the technical details of what happened
A bit light on detail there. The crash resulted from an access violation, dereferencing an incorrectly initialised pointer (not a NULL pointer as some reports indicate).
The code which caused the crash may well have been years old and only triggered by the new configuration.
Sounds like a Crowdstrike design and process failure on top of Microsoft having crap kernel boot safety all at once.
Even if Crowdstrike get the processes right I'm wondering if they would consider moving over to a memory safe language.
Microsoft really need to sort out the kernel driver boot to make it safer or even outright restrict it at a system level - something like a repeat kernel boot failure rollback should be the bare minimum. I remember Apple closing off System Level Kernel Extensions in BigSur (you can still do it but its a pita to set now) if you need full system access now it needs to be done at User level - Crowdstrike complied with that and it works just fine on macOS.
Some resources:
Helping our customers through the CrowdStrike outage - The Official Microsoft Blog
Tech-Alert-Windows-crashes-related-to-Falcon-Sensor-2024-07-19.pdf (crowdstrike.com)
Recover AWS resources affected by the CrowdStrike Falcon agent | AWS re:Post (repost.aws)
Technical Details: Falcon Update for Windows Hosts | CrowdStrike
Please support Geekzone by subscribing, or using one of our referral links: Samsung | AliExpress | Wise | Sharesies | Hatch | GoodSync | Backblaze backup
Previously known as psycik
Home Assistant: Gigabyte AMD A8 Brix, Home Assistant with Aeotech ZWave Controller, Raspberry PI, Wemos D1 Mini, Zwave, Shelly Humidity and Temperature sensors
Media:Chromecast v2, ATV4 4k, ATV4, HDHomeRun Dual
Server Host Plex Server 3x3TB, 4x4TB using MergerFS, Samsung 850 evo 512 GB SSD, Proxmox Server with 1xW10, 2xUbuntu 22.04 LTS, Backblaze Backups, usenetprime.com fastmail.com Sharesies Trakt.TV Sharesight
Our IT Dept. has put out an email advising that we could possibly have a few BSoD issues tomorrow morning when we all start up our laptops.
Could be an interesting start to the week.
neb:
Is there any other industry where a company that caused global outages of banks, airlines, government departments, hospitals, trains, and buses is a "compelling buying opportunity"?
Wait and see. We'll talk again when the alternatives have been implemented worldwide. The BSI (German Federal Office for Information Security) has already announced consequences for public infrastructure. π
- NET: FTTH, OPNsense, 10G backbone, GWN APs, ipPBX
- SRV: 12 RU HA server cluster, 0.1 PB storage on premise
- IoT: thread, zigbee, tasmota, BidCoS, LoRa, WX suite, IR
- 3D: two 3D printers, 3D scanner, CNC router, laser cutter
|
![]() ![]() ![]() ![]() |