Replying to @CroodSolutions @SamunoskeX and 3 others
You're correct.
Full of zeros at least.
christian_taillon
465 posts
christian_taillon
@christian_tail
Cyber geek who enjoys hunting for evil and doesn't like bullies. Can close Vim without Google... That's about it. Probably sipping ☕.
Opinions are my own.
- Replying to @CroodSolutions @SamunoskeX and 3 othersMy only theories... 1. Corrupted File - Not correctly transferred or improperly written to disk. 2. Error in File Creation - Bug or issue in the development pipeline. 3. Malicious Content - Created to disrupt operations
- Replying to @postmindfuck @CroodSolutions and 4 othersI have no deep knowledge, but I am very curious. I actually became an expert this morning. ;) I haven't rebooted a Windows device in years, but I - just like everyone else on twitter - am now an expert at BSOD and I am full of ideas ;)
- Replying to @christian_tail @CroodSolutions and 4 othersThe .sys files responsible for the issue, named C-00000291-*.sys, cause the actual CS driver (CSAgent.sys) to crash, possibly due to their invalid formatting. Not sure why. I wish CrowdStrike would inform us more comprehensively rather than leaving us to piece this together.
- Replying to @christian_tail @CroodSolutions and 4 othersWhat will be more interesting at this point is CSAgent.sys, which may reference these .sys files. Which explains the new 33 file. I've been using ClownStrike.
- Replying to @christian_tail @CroodSolutions and 4 othersFull txt too long for X. 32 is bad. 33 is fixed. c2076a538892265f10a2da864dc0f8b9 C-00000291-00000000-00000032.sys f3e1448dcdc79d9e5759a9a09e9d5c80 C-00000291-00000000-00000033.sys
- Mallard Spider’s Qakbot is being delivered with a new strategy, Windows Script files (.wsf). Malicious JS embedded within the certificate portion of .wsf file. Stay vigilant!
- Replying to @CroodSolutions @SamunoskeX and 3 othersWhile I am pontificating with little evidence: There seem to be variations of this 3x series channel file. I wonder if it is something that is based on the OS flavor. Others have also reported my first observed c2076***0f8b9, but there are other corrupted versions as well.
- Replying to @christian_tail @CroodSolutions and 4 othersRegarding the speculation of the 2015 first-seen date in VT. I believe this is not related to Crowdstrike at all. One submission file name is `dbwen-US.res`, LirbreOffice Database wizard functionalities resource files. This just also happened to have the same null bytes.
- Crowdstrike came out with a Falcon Windows Host Recovery Tool. It helps create a bootable USB for just this task. Many of us have been using live Linux boot USBs (or images for Virtual infrastructure). If you're still struggling with the Crowdstrike outage, this tool simplifies
- This is my big problem with this. Mistakes will happen. I'm sure I make more than the average dev at CrowdStrike. Out-of-band content updates ignoring customer rollout/update policy should not include changes that have the capacity to BSOD.Replying to @patrickwardleNote "channel updates ...bypassed client's staging controls and was rolled out to everyone regardless" resetera.com/threads/window… A few IT folks who had set the CS policy to ignore latest version confirmed this was, ya, bypassed, as this was "content" update (vs. a version update)
- Replying to @RobertMLeeIndeed. It's painful to hear finance and tech influencers call it a store of value and even an inflation hedge. At best it's a speculative asset. Too bad. I think crypto's strength was never as a store of value or growth investment but as a decentralized exchange of value.
- Replying to @jaikeysarraf @CroodSolutions and 4 othersAlmost certainly. There is just a significantly high probability that the threats were not nationally so ;) We will see as more information comes out, I'm relatively confident that, like CrowdStrikes legal team is posting, this was a mistake that they fixed. We shall see.
- Replying to @BaryLevy_ @CroodSolutions and 4 othersThat is what we all couldn't figure out this morning. I figured things crashed earlier because it wasn't the correct format. It was Channel File content for the System Driver CSAgent.sys.
