@pancake @thephd

Reading #CrowdStrike's own technical details publication, which is light on technical details, there is an implication that the "channel file" in question is not even code at all, but a data file, the rough equivalent of an AV signature file. (CrowdStrike does not really explain to the world what its "channel files" are.) The implication is that whatever processed the updated data file is not good at handling corrupted data.

https://mastodonapp.uk/@JdeBP/112820518952555749

@cavyherd @GramrgednAngel @Violinknitter

(… Continued)

But (conversely) if you got the update Thursday evening before you powered off to go home and your work PC has not been booted up since, you may have the other kind of luck. (-:

@cavyherd @GramrgednAngel @Violinknitter

It really all depends from timing.

For example: I've read reports from people who lucked out and missed the update because contrary to the instructions of their IT people they turned off their office PCs on Thursday evening, and by the time they turned them on the next morning, the update had been withdrawn. So their PCs never had the bad "channel file".

(Continued …)
#CrowdStrike #MO821132

@ampersine @shanselman

Yes. I caught up on that after I had caught up on the FediVerse posts.

I have a suspicion that the NULs thing is one of those Chinese Whispers distortions of someone talking about NULL pointers, in turn because they've just guessed that that was the STOP that occurred. (alas, see https://mastodonapp.uk/@JdeBP/112813708543808092, though)

I've certainly not seen an authoritative analysis of the specific crash that happens, yet, and certainly #CrowdStrike has not supplied one.

It turns out that there is an even lower barrier that kept this from being Linux panic day than it at first seemed.

It now transpires that the "channel file" involved is not used on the Linux version of #CrowdStrike's Falcon system, because it applies to NT's named pipes.

So if it had simply been a bad "channel file" common to more platforms instead, Black Friday could have been a hat trick combo of Microsoft Windows being taken down, Linux systems panicking, and Microsoft's #MO821132.

@chrisg

It's not even technically correct.

https://mastodonapp.uk/@JdeBP/112813114562289051

@shanselman

I saw an unsubstantiated claim this morning that the "channel file" to delete was full of NULs. If true, then the failure cannot even be down to a bad line of code, as it would also involve whatever tool generated the bad data file going very wrong.

However:

I am inclined to disbelieve this claim, as (for starters) this would result in a file without a valid PE header and a "channel file" is notionally an NT driver file as far as I can tell.

@cynicalsecurity

Read them and find out.

https://crowdstrike.com/terms-conditions/

You are looking for §8.2 and §8.6.

For people looking for a Sci-Fi precursor to #CrowdStrike, read the 1984 novel ORA:CLE by Kevin O'Donnell Jr and pay attention to what WFD90 does at the climax of the story.

My message was not quite that. (-:

https://toot.wales/@JdeBP/112812621722851842

@c0nsid3rate

I had.

https://mastodonapp.uk/@JdeBP/112812232357055399

I thought that I was idly speculating a Sci-Fi scenario that would not happen.

@wood5y

… and #CrowdStrike Falcon is available for them as well.

The wacky notion that in order to prevent bad programs from being downloaded and run on one's computers, one runs a program that *automatically* downloads and runs programs on one's computer (and runs them with extra privileges in kernel space), is not confined to a single operating system.

https://mastodonapp.uk/@JdeBP/112813114562289051

@witewulf

As someone who is 1 Degree Of Kevin Bacon away from someone who directly suffered problems with contacting a G.P., to me that seems a very uninformed question.

Just following the #CloudStrike hashtag that day would have yielded reports of healthcare, emergency, and public information systems that were taken down. Even if one hadn't had the 'phone call that I had.

https://mastodonapp.uk/@JdeBP/112812900655314583

@koteisaev

On the contrary. (-:

https://mastodonapp.uk/@JdeBP/112813207576019825

#CrowdStrike #MO821132
#TheTerminator

@aroundthehills

I've been thinking along much the same lines. I posted about the #BadJournalism involving the stock images of BSODs, yesterday.

What I've also noticed is how many news services, including several that should know better, have put Microsoft's branding on their news stories instead of #CrowdStrike's. Forbes, The Independent, and Mashable, for example.

I'm sure that CrowdStrike's PR people are gleeful that the public gets to view this as another MS thing.

@GramrgednAngel @Violinknitter @cavyherd

The #CrowdStrike update was pushed on Thursday, Austin Texas (where the company is located) time.

@Brad_Rosenheim

Heh! You can add doing database work with an actual database application, instead of with Microsoft Excel, to your list of objections to nail to the church door.

There are people who would use Excel to hammer such a nail in.

(-:

@nelsonakis

That's skewing what's average by excluding a fair whack of people. People who work for companies/institutions are PC users, too. And it's not even that all of them have one PC for work and another PC for personal use.

@nelsonakis

They were, inasmuch as there were people with company/instutition-issued PCs working from home, or away from the office, with #CrowdStrike as the institutional anti-malware software.