Ask HN: What is in C-00000291*.sys?

It likely contains a bug but is an uncorrupted file. Corrupted to me means the file was changed or modified in a way from it's intended state and likely won't run anymore.

rvba2• 2 years ago

I wonder if the * (asterisk / star) character in its name isnt causing the issue.

alex_f_k2• 2 years ago

Star is part of a command to delete any file matching a wildcard `C-00000291*.sys` meaning "starts with 'C-00000291', has any kind of text after that and ends with '.sys'". Actual files appear to differ for every machine

hulitu3• 2 years ago

I’m fascinated by how this issue occurred.

NGO, i think, discovered that parsing random data can lead to interesting results.l

zmatt• 2 years ago

Crowdstrike has published some technical details: https://www.crowdstrike.com/blog/falcon-update-for-windows-h...

AverageIdiot• 2 years ago

Hm, is there any website that explains why C-00000291*.sys caused the widespread BSODs? For example, was it some kind of definition file that was accessing invalid memory locations?

craxdevil7• 2 years ago

https://medium.com/@confusedcyberwarrior/when-security-becom...

longdustytrail• 2 years ago

This is just generic speculation

lordnacho• 2 years ago

It's a crowdstrike update file with a bug in it, from what I gather. This makes your Windows machine go blue screen and stop working as it starts up. If you manage to remove it by various methods, it doesn't run and you're fine.

More informed people will give you more details, but this kind of AV software often has privileged access to the OS, so it can scan your files. The same privileged access also means it can really mess things up if it's not well tested.

By contrast your ordinary python or VBA script should not be able to blue screen your machine, especially not during startup.

dathinab2• 2 years ago

By contrast your ordinary python or VBA script should not be able to blue screen your machine, especially not during startup.

This is misleading. If you run a python or VBA script on startup with elevated permissions to e.g. setup a driver (with a bug) or do hardware configurations (in a way which doesn't work) then it will as much blue screen as a sys file.

The issue is not that it's a `.sys` file, but that a high privilege administrative task run at startup fails so hard that it blue screens.

(In windows the sys file extension is basically just a marker that the file is part of the "system" without being clear what it is, it can be anything from a data blob,over a data base, over python/VBA files to a device driver or a blob combining multiple of such things. They mostly contain device drivers and hardware configuration, but there are some which are basically just the equivalent of /etc/hostname)

schroeding• 2 years ago

Every Windows executable can crash a Windows system with the SE_SHUTDOWN_NAME privilege (which, contrary to the name, not only allows safe normal shutdowns) if they want to, though, which most of the time every user has.

The "if they want to" part is the difference, kernel drivers can easily cause BSoDs on accident, e.g. by writing to an invalid address, normal processes can't, they have to jump through hoops by choice.

novaRom• 2 years ago

Just kernel drivers. To know what is inside, you can disassemble them with https://github.com/NationalSecurityAgency/ghidra

stefan_• 2 years ago

These files are apparently just definitions/input for the actual CrowdStroke driver, that presumably someone named .sys so it sounds more scary and important.

Peak irony then that you can just delete them. Surely an antivirus should recognize when its being rollbacked?

petesergeant• 2 years ago

that you can just delete them

Don't you have to be in recovery mode, with it switched off, to do that?

commercialnix• 2 years ago

It provides the electrolytes Windows craves.

JakDrako• 2 years ago

That one is just water unfortunately.

qorrect• 2 years ago

Water like from the toilet?

uKVZe85V• 2 years ago

I'm Not Sure.

amarcheschi• 2 years ago

On another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't have kernel level access?

tastroder• 2 years ago

The Linux version of CS sensor defaults to being installed as a kernel module as well.

anothernewdude• 2 years ago

Who would trust that?

fifteen1506• 2 years ago

via Reddit, don't know where so can't credit:

Kernel panic observed after booting 5.14.0-427.13.1.el9_4.x86_64 by falcon-sensor process -- https://access.redhat.com/solutions/7068083 -- 1 month ago

fp64• 2 years ago

It's not an anti-virus, it's intended to monitor all and everything on the machine. You^WAn attacker might want to hide what you're doing and thus it runs at that level.

geor9e• 2 years ago

You may be right but they do market it as "Next-Generation Antivirus (NGAV)"/"Antivirus with Threat Intelligence" probably because it's a word people are familiar with

[CrowdStrike Falcon® Pro: Antivirus with Threat Intelligence](https://www.crowdstrike.com/products/bundles/falcon-pro/)

neverminder3• 2 years ago

Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.

yuvadam• 2 years ago

Just a small reminder that's it's never "the guy" and always "the process", or lack thereof.

neverminder3• 2 years ago

Yeah, but heads will have to roll for this one, the world will be calling for blood, so who better if not "the guy"?

SirMaster• 2 years ago

So it's "the guy" who's job was to make and enforce "the process", got it.

BrentOzar• 2 years ago

Crowdstrike is finished

Unlikely, just as Solarwinds wasn't finished when they distributed malware that got government agencies hacked. You underestimate the slow turning radius of giant company purchasing departments.

bhouston2• 2 years ago

As I posted elsewhere, the SolarWinds stock has never recovered from its high before the hack. And it is on a downward trend.

taneliv• 2 years ago

Enterprise Linuxes also employ Crowdstrike or similar "security" products as mandatory part of their IT deployments. Often (always?) this is due to companies wanting certification for their secure processes, in order to sell to government or large corporations that require them.

neverminder3• 2 years ago

Crowdstrike in their official statement said "Linux and MacOS not affected". Are there any reports stating otherwise?

ciabattabread• 2 years ago

Crowdstrike is finished? Ha!

SolarWinds got the US government hacked by the Russians and they still exist.

janice1999• 2 years ago

Interestingly SolarWinds is headquartered in Austin and CrowdStrike recently moved there too.

bhouston2• 2 years ago

The SolarWinds stock has never recovered from its high before the hack. And it is on a downward trend.

tbgilson• 2 years ago

Yes indeed. That's kind of how Chernobyl happened.

martopix• 2 years ago

Crowdstrike is finished

Boeing is still there... we'll see

galdosdi2• 2 years ago

Why the fuck didn't MSFT just do blue/green canarying? No update should be rolled out to a billion devices at once until it's baked in a million devices for a bit, and that only after baking in 10,000 devices for a bit.

BenjiWiebe• 2 years ago

CrowdStrike is not MSFT. This also affected Linux installations with CrowdStrike installed, from what I've read.

hulitu3• 2 years ago

Crowdstrike is finished.

We thought about Microsoft the same way, some 15 years ago. /s

rvba2• 2 years ago

How is the * (star / asterisk) character allowed in the file name?

I thought such characters are forbidden by Windows.

https://learn.microsoft.com/en-us/windows/win32/fileio/namin...

How did the tool even manage to create such a file?

copywrong2• 2 years ago

echo lol > 'l*l'; ls 'l*l'

I bet it's a glob pattern and indicates "anything"

fragmede2• 2 years ago

it's deleting all matching files

martyvis• 2 years ago

There was only one file matching it on my machine. The * just saves typing.

alex_f_k2• 2 years ago

https://cyberplace.social/@GossiTheDog/112812260542179660

I've obtained copies of the .sys driver files Crowdstrike customers have. They're garbage. Each customer appears to have a different one.

https://cyberplace.social/@GossiTheDog/112812454405913406

The .sys files causing the issue are channel update files, they cause the top level CS driver to crash as they're invalidly formatted. It's unclear how/why Crowdstrike delivered the files and I'd pause all Crowdstrikes updates temporarily until they can explain.

pdw2• 2 years ago

They might just be encrypted with a customer-specific key. That wouldn't surprise me.

tux33• 2 years ago

They weren't last time I looked. They seem to contain a bunch of different things, but you can absolutely download and parse them without needing to decrypt anything.

If you have a Crowdstrike customer ID (CID) — which you can pull from any device that has the implant — you can request any channel file you want from their file server.

Ask for metahash+/cfs/channelfiles/0000000291/<YOUR CUSTOMER ID>/C-00000291-00000000-00000001.sys and you should get something that starts with:

    00000000: aaaa aaaa 0100 2301 0000 0500 0000 0000  ......#.........
    00000010: 0100 0000 4808 0000 2c08 0000 0600 0004  ....H...,.......

That's a channel file, unencrypted.

aaron695• 2 years ago

No the hashes are the same.

There are different files that can differ between customers.

9ca565965198cf1a5073ce974c5826d14aa3ac3cf574b3d2d2e7f80624b9ed90 = C-00000291-00000000-00000033.sys = https://www.virustotal.com/gui/file/9ca565965198cf1a5073ce97...

61486fe1aa690260bd846245f0fac204b26f41ed83f66e962cb548837f3ceb98 = C-00000291-00000000-00000057.sys = https://www.virustotal.com/gui/search/61486fe1aa690260bd8462...

benmmurphy• 2 years ago

A malware delivery platform sponsored by the US security state. All customers get customised versions nothing to see here.

yert14• 2 years ago

New to IT, but this sure seems like a huge security risk. Even though the CEO and others have said otherwise. People who are more experienced, please let me know if I am wrong.

screwgauge12• 2 years ago

Can someone share a link to a copy of the offending channel file. Now a crowd strike customer, but interested in poking at its contents. Thanks!

ltadeut• 2 years ago

Does anyone understand what a channel file is? Some sort of patch/dll that a driver loads?

tux33• 2 years ago

It's a binary format specific to Crowdstrike for delivering updates. It's not a DLL or a plain patch, it's their own file format. And they have a lot of different things in there (config, regularly updated data, instructions to download the next driver version, etc etc)

Si1ent2• 2 years ago

Does anyone have the BSoD dump file when it crashed? our a C-00000291-00000000-00000032.sys output de-identified ?

Si1ent2• 2 years ago

Does anyone have the BSoD dump file our the C-00000291-00000000-00000001.sys de-identified to analyze both

megvt08• 2 years ago

Does anyone have the actual file, I have a copy but it seems to be a good version unfortunately. Really appreciate if anyone can upload it here

Ask HN: What is in C-00000291*.sys?

Related Stories