CrowdStrike cyberinsecurity technology causes widespread BSOD

Hackerspace Information Security
1
1 Like
2

Working my way through said issue right now.

Success using the following workaround.

3 Likes
3

I’m gathering from other sources that simply rebooting up to fifteen times fixes the issue in some instances.

1 Like
4

If it puts itself in a boot loop, that might count for something.

For most applications, that probably takes more time than the documented work around.

It might come into play for some remote places without remote kvm/ilo, maybe.

5

Getting certain … demos … to do the workaround may prove challenging, walking them through it possibly moreso.

6

obamartclick

1 Like
7

Have you tried turning it off and on again. Have you tried turning it off and on again. Have you tried turning it off and on again. Have you tried turning it off and on again. Have you tried turning it off and on again. Have you tried turning it off and on again. Have you tried turning it off and on again. Have you tried turning it off and on again. Have you tried turning it off and on again. Have you tried turning it off and on again.

2 Likes
8

So I gather there’s an actual method to this insanity:

  1. The OS fully boots and remains stable for something like 1-2 seconds
    (saw this myself a few times attempting the restore process)
  2. Networking comes up at about this time and the machine configures itself (i.e. DHCP and the adapter decides it can Tx/Rx traffic)
  3. If during the brief (1) • (2) window…
    1. The local CrowdStrike Client acts quickly
    2. Receives a command from the distribution channel
    3. Nukes the offending .sys file
  4. … The machine will either remain stable or next reboot should stay up
1 Like
9

I’m doing contract FPGA work on flight control electronics for an enterprise engineering company. I have one of their laptops that connects via VPN, so no chance to get distro channel command :frowning:

Tried the recommended fix by opening a cmd window in recovery options. But this is at user level and admin level is required to access (or even view) the CrowdStrike files.

After waiting over an hour on hold for IT support, booted into Safe mode and was given a temp admin PW to log in and then delete the offending file. Restart and birds are singing, the sky is blue (but not the screen).

The bad thing about the old mainframe days with dumb terminals was that a mainframe problem took everyone down. The upside is that fixing the mainframe issue got everyone back online. Was that half-full or half-empty?

2 Likes
10

Who needs cyberattacks when you have CrowdStrike?

1 Like
11

Can anyone spell class-action lawsuit?

Shorted any CrowdStrike stock lately?

1 Like
12

If I was a writer for the Babylon Bee, the latest headline would be:

CrowdStrike steals the FUBAR of the year award from Boeing

1 Like
13

I think mine is better…

2 Likes
14

Breaking news: CrowdStrike uses four-bit technology…

15
16

Conversation in rallye car:

Navigator: Turn left at STOP.
Driver: Left at STOP?
Navigator: Right.
Driver: Turn right at STOP?
Navigator: No, turn left.
Driver: Turn left at STOP?
Navigator: Correct.

Gotta love the English language. But it is much better than Deutsch (German), Japanese and Russian…

2 Likes
17

That’s a lot of reboot, reboot, reboot, reboot, reboot, reboot, reboot, reboot, reboot, reboot, reboot, reboot, reboot, reboot and damn it I said reboot.

Atleast it’s not “Up up down down left right”

1 Like
18

The cost of that insurance will be much higher in the future if they can get it at all…

1 Like
19

Duh!

1 Like
20

It is not just Windows?