7 ms·
> Presumably, Crowdstrike runs on macOS without a kernel extension? That's correct: CrowdStrike now only installs an "Endpoint Security" system extension and a
by cywick 2y ago
> Presumably, Crowdstrike runs on macOS without a kernel extension?
That's correct: CrowdStrike now only installs an "Endpoint Security" system extension and a "Network" system extension on macOS, but no kernel extension anymore.
- lucasRW 2y agoWhatever protection is implemented in user-land can be removed from user-land too. This is why most EDR vendors are now gradually relying on kernel based mechanisms rather than doing stuff like injecting their DLL in a process, hooking syscalls, etc...
- JackSlateur 2y agoThis is wrong, there are many facilities that, once applied, cannot be modified (unless reboot)
- lucasRW 2y agoSuch as ?
- JackSlateur 2y agoRandom example: https://man.openbsd.org/OpenBSD-7.3/msyscall https://man.openbsd.org/OpenBSD-7.3/msyscall This is a syscall used by userspace to tell the kernel which memory portion is allowed to do syscalls This syscall can only be used once : once the linker has done it, the kernel will refuse extra calls (so allowing more memory pages is not possible)
- lucasRW 2y agoFirst, we were talking about EDR in Windows usermode. Second, still, that doesn't change anything. You can make your malware jmp to anywhere so that the syscall actually comes from an authorized page. In fact, in windows environment, this is actively done ("indirect syscalls"), because indeed, having a random executable directly calling syscalls is a clear indicator that something is malicious. So they take a detour and have a legitimate piece of code (in ntdll) do the syscall for them.
- tankenmate 2y agoOne would hope that Crowdstrike does a similar thing on Linux and relies on fanotify and/or ebpf instead of using a kernel module. The other upside to this would be not having to wait for Crowdstrike to be constantly updating their code for newer kernels.
- wjdp 2y agoI believe so but would like better details. We used to use another provider that depended on exact kernel versions whereas the falcon-sensor seems quite happy with kernel updates.
- BodyCulture 2y agoWait, you still will be using CS? Why?