Windows Crashes Due to Crowdstrike Updates

Windows Crashes Due to Crowdstrike Updates

Date of Publish : July 20,2024

Severity-Critical

System Affected

• Windows hosts

Non Affected systems

• MacOS
• Linux system

Summary

Crowdstrike released an update that is causing widespread "blue screens of death" (BSOD) on Windows systems.

Description,

This situation occur may be by sending a phishing emails circulating claiming come from "Crowdstrike Support" or "Crowdstrike Security" to update the component. One domain possibly associated with these phishing attacks is : crowdfalcon-immed-update [ .] com .once copned and download it will cause BSOD attack.

Workaround steps for individual hosts:

• Reboot the host to give it an opportunity to download the reverted channel file. We strongly recommend putting the host on a wired network (as opposed to WiFi) prior to rebooting as the host will acquire internet connectivity considerably faster via ethernet.
• If the host crashes again, then:
• Boot Windows into Safe Mode or the Windows Recovery Environment
• NOTE: Putting the host on a wired network (as opposed to WiFi) and using Safe Mode with Networking can help remediation.
• Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory
• Windows Recovery defaults to X:\windows\system32
• Navigate to the appropriate partition first (default is C:\), and navigate to the crowdstrike directory:
• C:
• cd windows\system32\drivers\crowdstrike
• Note: On WinRE/WinPE, navigate to the Windows\System32\drivers\CrowdStrike directory of the OS volume
• Locate the file matching “C-00000291*.sys” and delete it.
• Do not delete or change any other files or folders
• Cold Boot the host
• Shutdown the host.
• Start host from the off state.

Note: BitLocker-encrypted hosts may require a recovery key

References.

Vendor Reference.

https://www.crowdstrike.com/blog/statement-on-windows-sensor-update/.

NOTE : The information is provide is on “as is “ basis, without assurance of any kind .

Revision history

1. 19-Jun-24 - First advisory released. ---update -workaround available 

Read More

DLP- Data Leakage prevention -Explained

DLP- Data Leakage prevention -Explained

DLP provides cybersecurity solution that detects and prevents data breaches. implements a set of processes, procedures, and tools to prevent the loss, misuse of data from cyber threats.

Type of DLP

•        Network DLP
• Endpoint DLP
• Cloud DLP
• Storage /Data center DLP

 

DLP Tools:

•    Teramind
•     Safetica
•     Code42 Incydr
•     Check Point
•     Trend Micro IDLP
•     Sophos
•     Endpoint Protector
•     Symantec DLP
•     Digital Guardian
•     Trelix
•     Forcepoint DLP
•     Proofpoint DLP
•     Fidelis
•     Clumio
•     Microsoft Purview DLP
•     DTEX inTERCEPT

Network DLP is a Data Loss Prevention solution that monitors risky user behaviour on the network to detect and block potential data exfiltration.

 

·        Data Packet Inspection

·        Protocol Inspection

·        Data Filtering

·        User Activity Monitoring

 

Endpoint DLP: Focuses on securing data at the endpoint– individual devices such as individual employee computers. 

 

• Data Discovery and Classification
• Data Encryption
• Device Control
• User Behaviour Monitoring

Cloud data loss prevention (DLP) helps keep an organization’s sensitive or critical information safe from cyber-attacks, insider threats and accidental  exposure. Cloud DLP provides protection for sensitive data in SaaS and IaaS applications.

·       API Monitoring

·       Data Encryption

·       Cloud access control

·       Shadow IT detection

 

Storage /Data-center DLP- security strategy and focuses on detecting and preventing the loss, leakage, or misuse of data through breaches, exfiltration transmissions, and unauthorized use.

 

·       Data access control

·       Data activity Monitoring

·       Data anonymization

·       Data masking

 

 

NOTE : The information is provide is on “as is “ basis, without assurance of any kind .

 

Read More

Threat Modeling and Security Architecture Analysis

 What is Threat Modeling?

It provides the software development team an attacker’s or hostile user’s viewpoint, as the threat modeling exercise aims at identifying entry and exit points that an attacker can exploit.

It also helps the team to make design and engineering tradeoff decisions by providing insight into the areas where attention is to be

prioritized and focused, from a security viewpoint.

 Benefits of Threat Modelling

•The primary benefit of threat modeling during the design phase of the project is that design flaws can be addressed before a 

  single line of code is written, thereby reducing the need to redesign and fix security issues in code at a later time.

•Once a threat model is generated, it should be iteratively visited and updated as the software development project progresses.

•In the design phase, threat models development commences as the software architecture teams identify threats to the software.

 Challenges of Threat Modelling

•Though the benefits of threat modeling are extensive, threat modeling does come with some challenges.

•Can be a time-consuming process when done correctly.

•Requires a fairly mature SDLC.

• Requires the training of employees to correctly model threats and address vulnerabilities.

•Is often deemed to not be a very preferential activity. Developers prefer coding and quality assurance personnel prefer testing \

over threat modeling.

•Is often not directly related to business operations and it is difficult to show demonstrable return on investment for threat models. 

 

Threat Modeling Process  

 

STRIDE category of threats 

	Goal	Description
S	Spoofing	Can an attacker impersonate another user or identity?
T	Tampering	Can the data be tampered with while it is in transit or in storage or archives?
R	Repudiation	Can the attacker (user or process) deny the attack?
I	Information Disclosure	Can information be disclosed to unauthorized users?
D	Denial of Service	Is denial of service a possibility?
E	Elevation of Privilege	Can the attacker bypass least privilege implementation and execute the software at elevated or administrative privileges?

 -----In Progress-

NOTE:The Information provided is on "as is" basis, without assurance of any kind. 

Read More

OWASP Mobile security guideline

OWASP finally released Mobile security guidelines:

click link below:
https://www.owasp.org/images/0/04/Security_Testing_Guidelines_for_mobile_Apps_-_Florian_Stahl%2BJohannes_Stroeher.pdf

Read More