5 ms·

> Whilst Crowdstrike are going to cop a potentially existential-threatening amount of blame, an application shouldn't be able to do this kind of damage to an op

• Reason077 2y ago
  > "they install a kernel driver" And therein lies the problem!
  • Tech-Untangler 2y ago
    Not like they have an option. Kernel drivers are required.
    • viraptor 2y ago
      There's a grey area between "kernel drivers are required for crowdstrike" and "windows is not modular enough to expose necessary functionality to userspace". It could be solved differently given enough motivation.
      • viraptor 2y ago
        An expanded explanation with the third option of: even with existing options, it was really badly implemented - https://social.treehouse.systems/@marcan/112812791936639598 https://social.treehouse.systems/@marcan/112812791936639598
    • Reason077 2y ago
      Are they? Apple has pretty much banned kernel drivers (kexts) in macOS on Apple Silicon. When they were still used, they were a common cause of crashes and instability, not to mention potential gaping security holes. Most things that third-party kernel drivers used to do (device drivers, file systems, etc) are now done just as well, and much more safely, in userspace. I'm surprised if Microsoft isn't heading in this direction too? Presumably, Crowdstrike runs on macOS without a kernel extension?
      • cywick 2y ago
        > Presumably, Crowdstrike runs on macOS without a kernel extension? That's correct: CrowdStrike now only installs an "Endpoint Security" system extension and a "Network" system extension on macOS, but no kernel extension anymore.
        • lucasRW 2y ago
          Whatever protection is implemented in user-land can be removed from user-land too. This is why most EDR vendors are now gradually relying on kernel based mechanisms rather than doing stuff like injecting their DLL in a process, hooking syscalls, etc...
          • JackSlateur 2y ago
            This is wrong, there are many facilities that, once applied, cannot be modified (unless reboot)
            • lucasRW 2y ago
              Such as ?
              • JackSlateur 2y ago
                Random example: https://man.openbsd.org/OpenBSD-7.3/msyscall https://man.openbsd.org/OpenBSD-7.3/msyscall This is a syscall used by userspace to tell the kernel which memory portion is allowed to do syscalls This syscall can only be used once : once the linker has done it, the kernel will refuse extra calls (so allowing more memory pages is not possible)
                • lucasRW 2y ago
                  First, we were talking about EDR in Windows usermode. Second, still, that doesn't change anything. You can make your malware jmp to anywhere so that the syscall actually comes from an authorized page. In fact, in windows environment, this is actively done ("indirect syscalls"), because indeed, having a random executable directly calling syscalls is a clear indicator that something is malicious. So they take a detour and have a legitimate piece of code (in ntdll) do the syscall for them.
    • mrweasel 2y ago
      The original Windows NT had microkernel architecture, where a driver/server could not crash the OS. So no, Crowdstrike didn't have an option really, but Microsoft did. As PC got faster, Microsoft could have returned to the microkernel architecture, or at least focused on isolating drivers better.
      • DaoVeles 2y ago
        Yep, this is technical legacy in action.
      • jsheard 2y ago
        They've done it to a degree but only for graphics drivers, Windows is (AFAIK) unique amongst the major OSes in that it can nearly always recover from a GPU driver or hardware crash without having to reboot. It makes sense that they would focus on that since graphics drivers are by far the most complex ones on most systems and there are only 3 vendors to coordinate API changes with, but it would be nice if they broadened it to other drivers over time.
      • nullindividual 2y ago
        NT was never a true microkernel. Most drivers are loaded into the kernel. Display drivers being a huge pain point, subsequently rolled back to user space in 2000, and printer drivers being the next pain point, but primarily with security -- hence moving to a Microsoft-supplied universal print driver, finally in Windows 11.
    • tyho 2y ago
      Required for crowdstrike to do what crowdstrike does. Which is mostly useless security theatre.
    • adrianN 2y ago
      The people installing crowdstrike have an option: Don't install it.
  • simfoo 2y ago
    Yep. We can't migrate our workstations to Ubuntu 24.04 because Crowdstrikes falcon kernel modules don't support the kernel version yet. Presumably they wanted to move to EBPF but I'm guessing that hasn't happened yet. Also: I can't find the source code of those kernel modules - they likely use GPL-only symbols, wouldn't that be a GPL violation?
    • actionfromafar 2y ago
      Probably only a violation if you distribute the linked result. Not if you only install it.
      • saagarjha 2y ago
        How would you install it without them distributing it?
        • diffeomorphism 2y ago
          Two different "it". As an analogy: selling pizza Hawaii is dicey, but you can sell pineapple slices and customers can add those to their pizza themselves.
        • tpush 2y ago
          They mean distributing Linux + the module together. Like e.g. shipping the Nvidia kernel module alone is fine, but shipping a Linux distro with that module preinstalled is not fine.
    • rkangel 2y ago
      The generally accepted (but not well tested) legal position is that it's ok to have a proprietary kernel module that is dynamically loaded. You can, for instance, ask a running kernel if it is "tainted" by having loaded a non-GPL module.
      • immibis 2y ago
        GPL exported symbols are the ones that are thought to be so tightly coupled to the kernel implementation that if you are using them, you are writing a derivative work of the kernel.
  • selfmodruntime 2y ago
    So what? Crowdstrike is a kernel AV. How else would you solve this?
  • mr_mitm 2y ago
    It's a design decision. People want the antivirus to protect them even if an attacker exploits a local privilege escalation vulnerability or if an attacker that compromised an admin account (which happens all the time in Windows environments) wants to load malicious software. That's kind of the point of these things. Somebody exploits a memory vulnerability of one of the hundreds of services on a system, the antivirus is supposed to prevent that, and to their benefit, Crowdstrike is very good at this. If it didn't run in the kernel, an attacker with root can deactivate the antivirus. Since it's a kernel module, the attacker needs to load a signed kernel module, which is much harder to achieve.
    • jsheard 2y ago
      Presumably Crowdstrikes driver also has the ELAM flag which guarantees it will be loaded before any other third party drivers, so even if a malicious driver is already installed they have the opportunity to preempt it at boot. https://learn.microsoft.com/en-us/windows-hardware/drivers/install/early-launch-antimalware https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
      • chrisjj 2y ago
        > guarantees it will be loaded before any other third party drivers Point of information. "Guarantee" and "any" are unsubstantiated by that MS article.
        • jsheard 2y ago
          If we are being pedantic then an ELAM driver can't be guaranteed to load before another ELAM driver of course, but only a small list of vetted vendors are able to sign ELAM drivers so it is very unlikely that malware would be able to gain that privilege. That's the whole point.
          • chrisjj 2y ago
            Not pedantic. Just accurate. > an ELAM driver can't be guaranteed to load before another ELAM driver of course, Thanks for the correction.