Cybersecurity
  • https://newsroom.tiktok.com/en-us/tiktok-facts-how-we-secure-personal-information-and-store-data
    https://newsroom.tiktok.com/en-us/tiktok-facts-how-we-secure-personal-information-and-store-data
    NEWSROOM.TIKTOK.COM
    TikTok Facts: How we secure personal information and store data
    In our last post, we introduced TikTokTruths and explored the facts about some of the most common misperceptions about how TikTok handles data related to things like location and GPS, keystrokes, and
    0 Comments 0 Shares 92 Views 0 Reviews
  • User Mode vs Kernel Mode. Apparently, the CrowdStrike's Falcon Sensor runs in Kernel Mode, indicative of the .sys file extension for the file in question that was corrupt (aka glitchy, buggy). The Falcon Sensor is a DRIVER (Location: c:\windows\system32\drivers\CrowdStrike\C-00000291*.sys). In Windows, Drivers run in Kernel Mode. The faulty driver caused a Kernel Panic. The Kernel Panic caused the Blue Screen of Death (BSOD) on the Windows Platform (a system protection mechanism triggered by corrupted drivers, incompatible software... etc.). In turn, this activated the Windows recovery mode. Solution on the USER's END: Remove the faulty driver (and all of its sub-files). Solution at CrowdStrike was to roll back the update that included the faulty driver. Rinse (of discrepancies). Test. Repeat (the rollout) without incident. The question remains: WHY was the driver faulty/corrupt :). CrowdStrike does not seem to be addressing this vital issue. They claim that the file worked fine in the test rollout but not in the actual rollout. Either this is a lie and it was rolled out without testing OR, something happened between the end of testing and the beginning of rollout to corrupt this file. What is that something? Who did that something. How? When, And well, we know Why :). The intentions behind corrupting a file or code or data, system, platform, etc. is to cause disruption (havoc, chaos, panic, loss..). So, we got the testing. We got the rollout. We don't know the in-between (What, Who, How). We know the end result: disruption. We need to get to that in-between to learn what happened and how. That's the only time we'd know that this was/ was not a cyberattack.

    NOTE: C-00000291*.sys means any file starting with C-00000291 and ending in .sys
    User Mode vs Kernel Mode. Apparently, the CrowdStrike's Falcon Sensor runs in Kernel Mode, indicative of the .sys file extension for the file in question that was corrupt (aka glitchy, buggy). The Falcon Sensor is a DRIVER (Location: c:\windows\system32\drivers\CrowdStrike\C-00000291*.sys). In Windows, Drivers run in Kernel Mode. The faulty driver caused a Kernel Panic. The Kernel Panic caused the Blue Screen of Death (BSOD) on the Windows Platform (a system protection mechanism triggered by corrupted drivers, incompatible software... etc.). In turn, this activated the Windows recovery mode. Solution on the USER's END: Remove the faulty driver (and all of its sub-files). Solution at CrowdStrike was to roll back the update that included the faulty driver. Rinse (of discrepancies). Test. Repeat (the rollout) without incident. The question remains: WHY was the driver faulty/corrupt :). CrowdStrike does not seem to be addressing this vital issue. They claim that the file worked fine in the test rollout but not in the actual rollout. Either this is a lie and it was rolled out without testing OR, something happened between the end of testing and the beginning of rollout to corrupt this file. What is that something? Who did that something. How? When, And well, we know Why :). The intentions behind corrupting a file or code or data, system, platform, etc. is to cause disruption (havoc, chaos, panic, loss..). So, we got the testing. We got the rollout. We don't know the in-between (What, Who, How). We know the end result: disruption. We need to get to that in-between to learn what happened and how. That's the only time we'd know that this was/ was not a cyberattack. NOTE: C-00000291*.sys means any file starting with C-00000291 and ending in .sys
    0 Comments 0 Shares 75 Views 0 Reviews
  • Interesting
    https://www.kolide.com/blog/how-to-tell-if-crowdstrike-falcon-sensor-is-running
    Interesting https://www.kolide.com/blog/how-to-tell-if-crowdstrike-falcon-sensor-is-running
    WWW.KOLIDE.COM
    How to Tell If CrowdStrike Falcon Sensor Is Running
    Get in-depth information about the Falcon sensor agent using both generic osquery and Kolide.
    0 Comments 0 Shares 75 Views 0 Reviews
  • CrowdStrike Falcon Platform Fix: Windows:

    1. Boot Windows into Safe Mode or WRE.
    2. Go to C:\Windows\System32\drivers\CrowdStrike
    3. Locate and delete files matching "C-00000291*.sys"
    4. Boot normally.
    CrowdStrike Falcon Platform Fix: Windows: 1. Boot Windows into Safe Mode or WRE. 2. Go to C:\Windows\System32\drivers\CrowdStrike 3. Locate and delete files matching "C-00000291*.sys" 4. Boot normally.
    0 Comments 0 Shares 74 Views 0 Reviews
  • The McDonalds, Burger King, and Wendys of VPNs are NordVPN, ExpressVPN and Surfshark. Next best bet is CyberGhost. And then, for some great reason, they work best in developing countries... NordVPN is, of course, my first choice....
    The McDonalds, Burger King, and Wendys of VPNs are NordVPN, ExpressVPN and Surfshark. Next best bet is CyberGhost. And then, for some great reason, they work best in developing countries... NordVPN is, of course, my first choice....
    0 Comments 0 Shares 51 Views 0 Reviews
  • 1 Comments 0 Shares 209 Views 0 Reviews
  • 0 Comments 0 Shares 122 Views 0 Reviews
More Stories
Chatbox

Join the group to join the chatbox