A cheap barcode scanner helped fix CrowdStrike'd Windows PCs in a flash

https://www.theregister.com/2024/07/25/crowdstrike_remediation_with_barcode_scanner/

by qdot76367 • 2 years ago

103 29 2 years ago

mrguyorama2• 2 years ago

I just had to reimage my girlfriend's Windows laptop, which managed to utterly corrupt it's Windows install, all by itself, to the point it couldn't even reset itself.

For some ungodly reason, this personal laptop to be used for watching netflix had bitlocker turned on by default. 48 digit keys are obscene. It was so painful to try any triage or repair step because every single reset would require typing in all 48 digits. It's so stupid.

Meanwhile, what wasn't turned on automatically? System restore. God forbid you set aside 20gb for a chance at recovery. I had to reinstall from raw Windows installer. Now the speakers don't work, because Asus doesn't aknowledge that they've even sold this model of laptop, only showing drivers for the version of the laptop with an OLED screen, which uses a different wifi chipset and audio chipset, so it keeps trying to stomp over the drivers!

pachouli-please• 2 years ago

use snappy driver installer origin and it will find all drivers based on hardware IDs. it rarely misses https://www.glenn.delahoy.com/snappy-driver-installer-origin...

I've used this on our fresh windows installs for years

technofiend• 2 years ago

This is the kind of logic Microsoft should include in Windows by default.

mrguyorama2• 2 years ago

Okay so uh, I tried this tool. It seemed awesome. Except out of the 30ish drivers it installed, several of them were entirely wrong and not needed, to the point that they made boot up hang as multiple drivers waiting on each other crashed and failed and windows finally killed them.

It didn't even install the missing/incorrect driver! Asus's nagware that got autoinstalled by windows update managed to install the correct one, which is insane because I feel like I installed 5 different versions of the exact driver Asus asked to install while troubleshooting and there was zero sound each time. WTF.

Anyway, that app is way too aggressive. It's just throwing Hardware IDs against some list and installing whatever it finds and that's not how Hardware IDs can work in practice.

WithinReason• 2 years ago

BTW YubiKeys can be programmed to input passwords by simulating a keyboard. Some mice and keyboards can also be programmed with macros stored in onboard memory. (e.g. A4Tech mice)

m-p-3• 2 years ago

I use an InputStick to paste the recovery keys I need on affected machines, works quite well.

http://inputstick.com/

Disclaimer: not affiliated, just a happy customer

BobbyTables2• 2 years ago

Neat idea, but why not just save the recovery files to a USB drive ?

Windows can find that automatically!

karlgkk• 2 years ago

Article answers that

wildzzz• 2 years ago

Because then you'd need to mail out these USB keys and hope that they don't go missing or are misused before IT can force a key rotation. Also the time involved in buying and creating the USB keys for all remote employees. Just have everyone bring their laptop to the closest office, IT can scan the key off their machine for the laptop, and now they can quickly delete the offending CrowdStrike files. If you mailed them out, employees would still need to be walked through on deleting the files and would need the right access to do so.

If you have 5 IT workers processing 200 remote employees at each office and the resolution takes only 5 minutes, you can get the work done in 3 hours. Building USB keys and waiting for them to be mailed out for every employee probably takes longer than it took to write the basic barcode script.

vladvasiliu• 2 years ago

before IT can force a key rotation

How can you rotate the bitlocker key? I was under the impression that it’s permanent.

NoPicklez• 2 years ago

Whilst there may have been a better solution, I am enjoying all of the quirky ways IT admins were implementing fixes, like these

Cordiali• 2 years ago

I used to work in an archive, and the Symbol LS2208 was a pretty great scanner. The model is also old enough, that you can find them branded Symbol, Motorola, and Zebra.

I had my own cheat sheet to reprogram it, eg. changing the final character to tab or enter, scan on trigger press or always scan. It struggled a little with black barcodes on navy blue labels, but that's a terrible idea anyway.

Genbox• 2 years ago

Pretty interesting solution. At least it removes many of the errors stemming from reading keys over the phone, etc., but it also proclaims to remove the risk of distributing BitLocker keys - but that's precisely what they did - just in barcode form.

The obfuscation might prevent the intern from figuring out what is going on, but there are plenty of barcode-scanning apps for phones that show you the data stored in a barcode.

pmx• 2 years ago

They didn't distribute the bar codes, they had peoples bring their laptops to IT where the IT staff used the scanner to scan the code from the screen of a machine they themselves controlled.

account422• 2 years ago

You're right that the article later on describes it like that but then the concerns about distributing the key or dictating it over the phone don't make sense.

joshstrange• 2 years ago

I have a friend who worked somewhere with a draconian password policy (changing every 2 weeks, long length, no overlap with old passwords, etc). That company also had barcode scanners attached to most of their computers. He told me that a lot of people would have a barcode taped up under their desk and just point the scanner at the barcode to login (since most scanners just sent what they scan as keyboard input).

reginald782• 2 years ago

Awhile back I was looking at cheap ways to automate drive imaging on a air gapped PC. There are KVM hardware products that simulate mouse,keyboard, sometimes USB drives. I have a couple of them from that time period, the main problem is they have their own janky software that only works on Windows to run them.

It occurs to me that barcode scanner is an adjacent idea and probably has some versatility advances. Really what they wanted was a way to send stored keystrokes from one PC to another and the barcode was just a commonly available way to do it.

ndiddy• 2 years ago

Something like a USB rubber ducky (https://shop.hak5.org/products/usb-rubber-ducky) would probably work great for this use case. They market it towards pentesting but it's useful for automating general system administration as well.

account422• 2 years ago

When PCs boot, they consider barcode scanners no differently to keyboards.

This is actually usually a mode of the barcode scanner that can be configured by ... scanning a special barcode.

That response could not, however, involve distributing BitLocker keys – doing so was just too risky to contemplate.

So instead they distributed the BitLocker keys but wrapped in a barcode?

I mean using a barcode scanner as ad-hoc keyboard input automation is nice but this theatrical approach to computer security is not encouraging.

odo1242• 2 years ago

No - instead of giving every person in the company BitLocker keys, they had to do all the fixing within IT, hence, automation via barcode scanning.

Eater_of_food• 2 years ago

Woltz is pleased that his idea translated into a swift recovery, but also a little regretful he didn't think of using QR codes – they could have encoded sufficient data to automate the entire remediation process.

I don't follow this, what could they have done with QR codes?

michilehr• 2 years ago

We have QR codes for installing for example cups printers and way more more things.

I am now using my Flipper Zero for such things including entering passwords at our Dashboards.

A cheap barcode scanner helped fix CrowdStrike'd Windows PCs in a flash

Related Stories