Several people who received the CrowdStrike offer found that the gift card didn't work, while others got an error saying the voucher had been canceled.
They are going to get sued for billions and this little stunt isn’t going to change that. Should have implemented proper software testing before you took ever corporate computer in the world, but companies like this always force their developers to rush instead of do the right thing and when it bites them expect that things will carry on as normal. I can’t see many renewals in their future.
Not even that. Kernel drivers are supposed to be Microsoft WHQL certified through a thorough testing process (that would have caught it in 3 minutes) before Microsoft will cryptographically sign them.
…but apparently Microsoft allows AV vendors to skip WHQL certification testing.
…sorta. The complexity here is their driver is signed, but it’s also loading code from their channel file (that was all zeroed out), and it seems the necessary error checking wasn’t implemented.
I haven’t yet got to the root cause they published, this is just what I gathered from the video of a retired MS kernel dev who posts stuff.
Obviously with their design it allowed them to be flexible at the cost of playing with fire - I’m impressed they got away with it for so long, really
Thank you for the clarification. WHQL is such a pain to set up, I’m sure the AV vendors whined, “but, security! Do we have to test everything every time? That would slow an urgent 0day release!”
Yeah, there’s some limits to what they could do while maintaining pace for the 0 day stuff…
Some input validations would be the most basic things they should have done years ago. I’m aware of the hashing mature vendors do of any content they download for updates or deployments. Signature checking as well, and that’s before the code is even inspected - why don’t they include their automated tests they obviously aren’t using in the update as a sanity check client-side? (I’m not aware of anyone doing this or even if it’s possible without the rest of the IDE, stack, I’m no dev)
They are going to get sued for billions and this little stunt isn’t going to change that. Should have implemented proper software testing before you took ever corporate computer in the world, but companies like this always force their developers to rush instead of do the right thing and when it bites them expect that things will carry on as normal. I can’t see many renewals in their future.
Not even that. Kernel drivers are supposed to be Microsoft WHQL certified through a thorough testing process (that would have caught it in 3 minutes) before Microsoft will cryptographically sign them.
…but apparently Microsoft allows AV vendors to skip WHQL certification testing.
…sorta. The complexity here is their driver is signed, but it’s also loading code from their channel file (that was all zeroed out), and it seems the necessary error checking wasn’t implemented.
I haven’t yet got to the root cause they published, this is just what I gathered from the video of a retired MS kernel dev who posts stuff.
Obviously with their design it allowed them to be flexible at the cost of playing with fire - I’m impressed they got away with it for so long, really
Thank you for the clarification. WHQL is such a pain to set up, I’m sure the AV vendors whined, “but, security! Do we have to test everything every time? That would slow an urgent 0day release!”
Yeah, there’s some limits to what they could do while maintaining pace for the 0 day stuff…
Some input validations would be the most basic things they should have done years ago. I’m aware of the hashing mature vendors do of any content they download for updates or deployments. Signature checking as well, and that’s before the code is even inspected - why don’t they include their automated tests they obviously aren’t using in the update as a sanity check client-side? (I’m not aware of anyone doing this or even if it’s possible without the rest of the IDE, stack, I’m no dev)