News for hackers. Stuff that matters.

A comment on Deleting System32\curl.exe. Parent comment

Re:Deleting System32\curl.exe by yourusername on Monday April 24, 2023 @06:42AM (#35685862)
There are people responsible for the security of Windows systems in some organisations that do not understand their job. They look into their AV solution and it says vulnerable file detected on $x systems and they instruct their IT department to remove the file.
[ Parent | on HN ]
Re:Deleting System32\curl.exe by robertlagrant on Monday April 24, 2023 @06:49AM (#35685907)
Indeed. Whole companies such as Crowdstrike exist just to sit in between automated tools and heavy-handed action based on tool output.
[ Parent | on HN ]
Re:Deleting System32\curl.exe by hardware2win on Monday April 24, 2023 @07:33AM (#35686291)
Ive been actually impressed by Crowdstrike product (I guess)

Ive tested a two or three years old Chrome version with JIT compiler vulnerability and guess what - on empty Linux vm it managed to escape chrome and execute code

Meanwhile on Windows with Crowdstrike Chrome just showed some error message about mem. access

Im not sure who handled that attack - was it Windows or Crowdstrike, but eitherway Ive been impressed

[ Parent | on HN ]