News for hackers. Stuff that matters.

A comment on Initial details about why CrowdStrike's CSAgent.sys crashed. Parent comment

Re:Initial details about why CrowdStrike's CSAgent.sys crashed by londons_explore on Sunday July 21, 2024 @08:47AM (#41024700)
AV software needs kernel privilidges to have access to everything it needs to inspect, but the actual inspection of that data should be done with no privilidges.

I think most AV companies now have a helper process to do that.

If you successfully exploit the helper process, the worst damage you ought to be able to do is falsely find files to be clean.

[ Parent | on HN ]
Re:Initial details about why CrowdStrike's CSAgent.sys crashed by bornfreddy on Monday July 22, 2024 @07:17AM (#41033114)
> ...the worst damage you ought to be able to do is...

Ought. But it depends on the way the communication with the main process is done. I wouldn't be surprised if the main process trusts the output from the parser just a tiny bit too much.

[ Parent | on HN ]