TechTakes

1377 readers

57 users here now

Big brain tech dude got yet another clueless take over at HackerNews etc? Here's the place to vent. Orange site, VC foolishness, all welcome.

This is not debate club. Unless it’s amusing debate.

For actually-good tech, you want our NotAwfulTech community

founded 1 year ago

MODERATORS

[email protected]

126

Crowdstrike takes out last remaining threat vector (the users) (infosec.exchange)

submitted 3 months ago* (last edited 3 months ago) by [email protected] to c/[email protected]

30 comments fedilink hide all child comments

The machines, now inaccessible, are arguably more secure than before.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 4 points 3 months ago* (last edited 3 months ago) (1 children)

(update: disproven by Crowdstrike’s blog post).

How do you mean? The current top post on the blog seems to mention .sys files as part of the problem very prominently.

Channel file "C-00000291*.sys" with timestamp of 0527 UTC or later is the reverted (good) version. Channel file "C-00000291*.sys" with timestamp of 0409 UTC is the problematic version.

[–] [email protected] 11 points 3 months ago (2 children)

https://www.crowdstrike.com/blog/technical-details-on-todays-outage/

This is not related to null bytes contained within Channel File 291 or any other Channel File.

That to me implied that the channel file wasn't actually necessarily corrupt (or as corrupt as people thought), but that it triggered a logic error. In particular this point implies that it wasn't from garbage zero bytes in the file.

(That said I could have worded this better, in my defense I'm sick in bed and only half thinking straight)

[–] [email protected] 6 points 3 months ago

I see, thank you.

[–] [email protected] 3 points 3 months ago (1 children)

yeah that phrase of "null bytes" reads like addressing one of the rumours

"what was the problem?" "well it wasn't null bytes" "so.. what was it then?" "have definitely eliminated null bytes from the running!"

[–] [email protected] 4 points 3 months ago

Aside but I have been in some weird as heck discussions about how to phrase public blog posts. A few times I've had to point out some phrasing is so cryptic that no one will even know what we're talking about, and really there's nothing wrong with being a bit clearer about what we want to express. Sometimes you'd like companies want the audience to be bewildered and confused; and I'm not totally sure where this instinct comes from.

(Though in this case they probably don't want to share too much yet for stonk or legal reasons)