7 ms·

Not like they have an option. Kernel drivers are required.

viraptor 2y ago
There's a grey area between "kernel drivers are required for crowdstrike" and "windows is not modular enough to expose necessary functionality to userspace". It could be solved differently given enough motivation.
- viraptor 2y ago
  An expanded explanation with the third option of: even with existing options, it was really badly implemented - https://social.treehouse.systems/@marcan/112812791936639598 https://social.treehouse.systems/@marcan/112812791936639598
Reason077 2y ago
Are they? Apple has pretty much banned kernel drivers (kexts) in macOS on Apple Silicon. When they were still used, they were a common cause of crashes and instability, not to mention potential gaping security holes. Most things that third-party kernel drivers used to do (device drivers, file systems, etc) are now done just as well, and much more safely, in userspace. I'm surprised if Microsoft isn't heading in this direction too? Presumably, Crowdstrike runs on macOS without a kernel extension?
- cywick 2y ago
  > Presumably, Crowdstrike runs on macOS without a kernel extension? That's correct: CrowdStrike now only installs an "Endpoint Security" system extension and a "Network" system extension on macOS, but no kernel extension anymore.
  - lucasRW 2y ago
    Whatever protection is implemented in user-land can be removed from user-land too. This is why most EDR vendors are now gradually relying on kernel based mechanisms rather than doing stuff like injecting their DLL in a process, hooking syscalls, etc...
    - JackSlateur 2y ago
      This is wrong, there are many facilities that, once applied, cannot be modified (unless reboot)
      - lucasRW 2y ago
        Such as ?
        JackSlateur 2y ago
        Random example: https://man.openbsd.org/OpenBSD-7.3/msyscall https://man.openbsd.org/OpenBSD-7.3/msyscall This is a syscall used by userspace to tell the kernel which memory portion is allowed to do syscalls This syscall can only be used once : once the linker has done it, the kernel will refuse extra calls (so allowing more memory pages is not possible)
        lucasRW 2y ago
        First, we were talking about EDR in Windows usermode. Second, still, that doesn't change anything. You can make your malware jmp to anywhere so that the syscall actually comes from an authorized page. In fact, in windows environment, this is actively done ("indirect syscalls"), because indeed, having a random executable directly calling syscalls is a clear indicator that something is malicious. So they take a detour and have a legitimate piece of code (in ntdll) do the syscall for them.
  - tankenmate 2y ago
    One would hope that Crowdstrike does a similar thing on Linux and relies on fanotify and/or ebpf instead of using a kernel module. The other upside to this would be not having to wait for Crowdstrike to be constantly updating their code for newer kernels.
    - wjdp 2y ago
      I believe so but would like better details. We used to use another provider that depended on exact kernel versions whereas the falcon-sensor seems quite happy with kernel updates.
    - BodyCulture 2y ago
      Wait, you still will be using CS? Why?
mrweasel 2y ago
The original Windows NT had microkernel architecture, where a driver/server could not crash the OS. So no, Crowdstrike didn't have an option really, but Microsoft did. As PC got faster, Microsoft could have returned to the microkernel architecture, or at least focused on isolating drivers better.
- DaoVeles 2y ago
  Yep, this is technical legacy in action.
- jsheard 2y ago
  They've done it to a degree but only for graphics drivers, Windows is (AFAIK) unique amongst the major OSes in that it can nearly always recover from a GPU driver or hardware crash without having to reboot. It makes sense that they would focus on that since graphics drivers are by far the most complex ones on most systems and there are only 3 vendors to coordinate API changes with, but it would be nice if they broadened it to other drivers over time.
- nullindividual 2y ago
  NT was never a true microkernel. Most drivers are loaded into the kernel. Display drivers being a huge pain point, subsequently rolled back to user space in 2000, and printer drivers being the next pain point, but primarily with security -- hence moving to a Microsoft-supplied universal print driver, finally in Windows 11.
tyho 2y ago
Required for crowdstrike to do what crowdstrike does. Which is mostly useless security theatre.
adrianN 2y ago
The people installing crowdstrike have an option: Don't install it.

There's a grey area between "kernel drivers are required for crowdstrike" and "windows is not modular enough to expose necessary functionality to userspace". It could be solved differently given enough motivation.

viraptor 2y ago
An expanded explanation with the third option of: even with existing options, it was really badly implemented - https://social.treehouse.systems/@marcan/112812791936639598 https://social.treehouse.systems/@marcan/112812791936639598

Reason077 2y ago

Are they? Apple has pretty much banned kernel drivers (kexts) in macOS on Apple Silicon. When they were still used, they were a common cause of crashes and instability, not to mention potential gaping security holes. Most things that third-party kernel drivers used to do (device drivers, file systems, etc) are now done just as well, and much more safely, in userspace. I'm surprised if Microsoft isn't heading in this direction too? Presumably, Crowdstrike runs on macOS without a kernel extension?

cywick 2y ago
> Presumably, Crowdstrike runs on macOS without a kernel extension? That's correct: CrowdStrike now only installs an "Endpoint Security" system extension and a "Network" system extension on macOS, but no kernel extension anymore.
- lucasRW 2y ago
  Whatever protection is implemented in user-land can be removed from user-land too. This is why most EDR vendors are now gradually relying on kernel based mechanisms rather than doing stuff like injecting their DLL in a process, hooking syscalls, etc...
  - JackSlateur 2y ago
    This is wrong, there are many facilities that, once applied, cannot be modified (unless reboot)
    - lucasRW 2y ago
      Such as ?
      - JackSlateur 2y ago
        Random example: https://man.openbsd.org/OpenBSD-7.3/msyscall https://man.openbsd.org/OpenBSD-7.3/msyscall This is a syscall used by userspace to tell the kernel which memory portion is allowed to do syscalls This syscall can only be used once : once the linker has done it, the kernel will refuse extra calls (so allowing more memory pages is not possible)
        lucasRW 2y ago
        First, we were talking about EDR in Windows usermode. Second, still, that doesn't change anything. You can make your malware jmp to anywhere so that the syscall actually comes from an authorized page. In fact, in windows environment, this is actively done ("indirect syscalls"), because indeed, having a random executable directly calling syscalls is a clear indicator that something is malicious. So they take a detour and have a legitimate piece of code (in ntdll) do the syscall for them.
- tankenmate 2y ago
  One would hope that Crowdstrike does a similar thing on Linux and relies on fanotify and/or ebpf instead of using a kernel module. The other upside to this would be not having to wait for Crowdstrike to be constantly updating their code for newer kernels.
  - wjdp 2y ago
    I believe so but would like better details. We used to use another provider that depended on exact kernel versions whereas the falcon-sensor seems quite happy with kernel updates.
  - BodyCulture 2y ago
    Wait, you still will be using CS? Why?

mrweasel 2y ago

The original Windows NT had microkernel architecture, where a driver/server could not crash the OS. So no, Crowdstrike didn't have an option really, but Microsoft did. As PC got faster, Microsoft could have returned to the microkernel architecture, or at least focused on isolating drivers better.

DaoVeles 2y ago
Yep, this is technical legacy in action.
jsheard 2y ago
They've done it to a degree but only for graphics drivers, Windows is (AFAIK) unique amongst the major OSes in that it can nearly always recover from a GPU driver or hardware crash without having to reboot. It makes sense that they would focus on that since graphics drivers are by far the most complex ones on most systems and there are only 3 vendors to coordinate API changes with, but it would be nice if they broadened it to other drivers over time.
nullindividual 2y ago
NT was never a true microkernel. Most drivers are loaded into the kernel. Display drivers being a huge pain point, subsequently rolled back to user space in 2000, and printer drivers being the next pain point, but primarily with security -- hence moving to a Microsoft-supplied universal print driver, finally in Windows 11.

tyho 2y ago

Required for crowdstrike to do what crowdstrike does. Which is mostly useless security theatre.

adrianN 2y ago

The people installing crowdstrike have an option: Don't install it.