Boy, my work is in the process of buying crowdstrike. Very cool... Shit seemed like just another McAfee with fancy graphs and the NSAs wet dream of telemetry.

If I'm reading this correctly modern AVs work by looking for patterns in software behavior that resemble the actions of currently circulating viruses to try to stay ahead of the rapid proliferation of new viruses and threats. So if program A.) behaves in some way like known virus 1.) the software will shut down program A.), not because it's a known threat, but because it behaves like a known threat. So if I'm following this guy something in the stream of behavioral information Crowdstrike sends to all it's client computers in real time flagged some core windows process or something as a threat and began attacking it. This resulted in BSOD bootloops across their network of clients.

Short version; Computer auto-immune disorder, the immune system is attacking the body because it's incorrectly identified some part of the body as a threat.

But for some cloud systems though, such as AWS, booting to “safe mode” is not even possible so this fix can’t be applied. Virtual servers need to be shut down, their disks cloned, attached to another server, edited to remove the offending files and then finally reattached to the original server.

Lol

BUT, if you’re protecting your data properly you would have used BitLocker for disk encryption and so you need to manually decrypt the disk with a BitLocker Recovery Key, which is probably - for most companies - stored digitally on one of the servers that is currently booting over and over 🫠

AHAAAAAHAAHHAHAAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAH HEY FUCKWITS MAYBE PUTTING ALL YOUR SHIT ON REMOTE ALWAYS ONLINE SERVERS OVER WHICH YOU HAVE NO CONTROL WAS A CRITICAL STRATEGIC FAILURE TO RETAIN CONTROL OF YOUR CORE ASSETS YOU DUMB FUCKS YOU GAVE AWAY THE KEYS TO THE VAULT TO A GUY IN BLANK WHITE MASK WITH "TRUST ME" WRITTEN ON IT HAHAHAHAHAHAHAHAHAHAHAHAHA

The cloud was always an obvious, utterly inexplicable mistake of astonishing proportions and it's hilarious that capitalism drove everyone to turn their systems in to dumb terminals over which they have little if any control. I'll just be here basking in my "I called it" from well over a decade ago.

I read somewhere else that this analysis is incorrect. They were saying it wasn't caused by something in the threat intelligence feed, but an updated .sys file(a driver component) that CrowdStrike inexplicably pushed to all clients at once.

That explanation is even funnier, because they pushed a software update to everyone at once instead of the widely used practice of staged rollouts of updates. Normally big companies push updates to a very small number of users first, then gradually increasing the number so they can get bug reports before wrecking every system.

His explanation: "CrowdStrike is an antivirus. It updates threats constantly. Then the rest of the problem happened causing everything to crash worldwide.

It's a kind of 'draw the rest of the owl' explanation

It is every hexbear user's duty to spread FUD that this was caused by AI (and tbh I'm still not convinced it wasn't)

From the description this doesn't sound like it will be fixed right away for most systems, any idea what kind of impact this will have? I would hope for anything crucial there would be fail-safes

This is a total non-explanation.