christian_taillon (@christian_tail)
twiiit.com
You're correct. Full of zeros at least.

…according to a Twitter post by the Chief Informational Security Officer of Grand Canyon Education.

So, does anyone else find it odd that the file that caused everything CrowdStrike to freak out, C-00000291-
00000000-00000032.sys was 42KB of blank/null values, while the replacement file C-00000291-00000000-
00000.033.sys was 35KB and looked like a normal, if not obfuscated sys/.conf file?

Also, apparently CrowdStrike had at least 5 hours to work on the problem between the time it was discovered and the time it was fixed.

  • @Gork@lemm.eeEnglish
    42•5 months ago

    Ah, makes sense. I guess a driver would completely freak out if that file gave no instructions and was just like “…”

      • @planish@sh.itjust.worksEnglish
        37•5 months ago

        That’s what the BSOD is. It tries to bring the system back to a nice safe freshly-booted state where e.g. the fans are running and the GPU is not happily drawing several kilowatts and trying to catch fire.

        • TimeSquirrel
          -11•5 months ago

          No try-catch, no early exit condition checking and return, just nuke the system and start over?

          • AatubeOP
            22•5 months ago

            what do you propose, run faulty code that could maybe actually nuke your system, not just memory but storage as well?

          • KogasaEnglish
            17•5 months ago

            Catch and then what? Return to what?

          • 𝙲𝚑𝚊𝚒𝚛𝚖𝚊𝚗 𝙼𝚎𝚘𝚠English
            11•5 months ago

            Windows assumes that you installed that AV for a reason. If it suddenly faults, who’s to say it’s a bug and not some virus going ham on the AV? A BSOD is the most graceful exit you could do, ignoring and booting a potentially compromised system is a fairly big no-no (especially in systems that feel the need to install AV like this in the first place).

          • Morphit English
            9•5 months ago

            A page fault can be what triggers a catch, but you can’t unwind what a loaded module (the Crowdstrike driver) did before it crashed. It could have messed with Windows kernel internals and left them in a state that is not safe to continue. Rather than potentially damage the system, Windows stops with a BSOD. The only solution would be to not allow code to be loaded into the kernel at all, but that would make hardware drivers basically impossible.

          • @reddit_sux@lemmy.worldEnglish
            7•5 months ago

            BSOD is the ultimate catch statement of the OS. It will gracefully close all open data streams and exit. Of course it is not the usual exit so it gives a graphic representation of what not have gone wrong.

            If it would have been nuking it wouldn’t show anything.

      • @Kaboom@reddthat.comEnglish
        6•5 months ago

        For most things, yes. But if someone were to compromise the file, stopping when they see it invalid is probably a good idea for security