News for hackers. Stuff that matters.

A comment on Initial details about why CrowdStrike's CSAgent.sys crashed. Parent comment

Re:Initial details about why CrowdStrike's CSAgent.sys crashed by layer8 on Sunday July 21, 2024 @01:31PM (#41026621)
You don’t want to boot into safe mode with networking enabled if the software that is supposed to detect attacks from the network isn’t running. Safe mode doesn’t protect you from malicious code in userspace, it only “protects” you from faulty drivers. Safe mode is for troubleshooting system components, not for increasing security.

I don’t know the exact reasoning why safe mode requires the BitLocker recovery key, but presumably not doing so would open up an attack vector defeating the BitLocker protection.

[ Parent | on HN ]
Re:Initial details about why CrowdStrike's CSAgent.sys crashed by Uvix on Sunday July 21, 2024 @03:44PM (#41027579)
Normally BitLocker gets the key from the TPM, which will have its own driver that's likely disabled in Safe Mode.
[ Parent | on HN ]
Re:Initial details about why CrowdStrike's CSAgent.sys crashed by discostrings on Sunday July 21, 2024 @04:43PM (#41027930)
The BitLocker configurations I've seen over the last few days don't require the recovery key to enter safe mode.
[ Parent | on HN ]