Technology

60016 readers

2616 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

586

CrowdStrike broke Debian and Rocky Linux months ago, but no one noticed (www.neowin.net)

submitted 5 months ago by hal_5700X@sh.itjust.works to c/technology@lemmy.world

83 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] quinkin@lemmy.world 82 points 5 months ago (3 children)

Additionally, organizations should approach CrowdStrike updates with caution

We would if we were able to control their "deployable content".

[–] ISOmorph@feddit.org 46 points 5 months ago* (last edited 5 months ago)

I read on another thread that an admin was emulating a testing environment by blocking CrowdStrike IPs on their firewall for the whole network before each update, with the exception of a couple machines. It's stupid that he has to do this but hey, his network was unaffected

[–] AlecSadler@sh.itjust.works 8 points 5 months ago (1 children)

Serious question, can you not? There isn't an option to...like...set a review system first?

[–] EncryptKeeper@lemmy.world 16 points 5 months ago (1 children)

For antivirus definitions? No, and you wouldn’t want to.

[–] AlecSadler@sh.itjust.works 6 points 5 months ago (2 children)

But it sounds like this added files / drivers or something, not just antivirus rules?

[–] SeeJayEmm@lemmy.procrastinati.org 26 points 5 months ago (3 children)

Turns out it was a content update that caused the driver to crash but the update itself wasn't a driver (as per their latest update.)

[–] wolfylow@lemmy.world 22 points 5 months ago

Found this post that explains what happened in detail: https://lemmy.ohaa.xyz/post/3522666

As an application developer (rather than someone who can/does code operating systems) I was just left open-mouthed …

Looks like they’re delivering “code as content” to get around the rigour of getting an updated driver authorised by MS. I realise they can’t wait too long for driver approval for antivirus releases but surely - surely - you have an ironclad QA process if you’re playing with fire like this.

[–] AlecSadler@sh.itjust.works 3 points 5 months ago

Oh, wow.

[–] b161@lemmy.blahaj.zone 2 points 5 months ago (2 children)

Do you know if the sensor update policy had been set to N-2 would this have avoided the issue?

[–] starneld@infosec.pub 7 points 5 months ago (1 children)

Setting the update policy to N-2 (or any other configuration) would not have avoided the issue. The Falcon sensor itself wasn’t updated, which is what the update policy controls. As it turns out, you cannot control the content channel updates - you simply always get the updates.

[–] b161@lemmy.blahaj.zone -1 points 5 months ago

💀 Fucking hell CrowdStrike.

[–] quinkin@lemmy.world 2 points 5 months ago

No it would not.

[–] mox@lemmy.sdf.org 4 points 5 months ago

https://nitter.poast.org/patrickwardle/status/1814343502886477857

[–] corsicanguppy@lemmy.ca 3 points 5 months ago

We would if we were able to control their “deployable content”.

Minimum safe distance.