Cyber nerd who enjoys hunting for evil and helping others fight black hats. Can close Vim without consulting Google. Probably sipping ☕.
Opinions are my own.
@CroodSolutions
@SamunoskeX
@MalwareJake
@UK_Daniel_Card
@SwiftOnSecurity
The .sys files responsible for the issue, named C-00000291-*.sys, cause the actual CS driver (CSAgent.sys) to crash, possibly due to their invalid formatting. Not sure why. I wish CrowdStrike would inform us more comprehensively rather than leaving us to piece this together.
Mallard Spider’s Qakbot is being delivered with a new strategy, Windows Script files (.wsf). Malicious JS embedded within the certificate portion of .wsf file.
Stay vigilant!
@CroodSolutions
@SamunoskeX
@MalwareJake
@UK_Daniel_Card
@SwiftOnSecurity
Regarding the speculation of the 2015 first-seen date in VT.
I believe this is not related to Crowdstrike at all.
One submission file name is `dbwen-US.res`, LirbreOffice Database wizard functionalities resource files. This just also happened to have the same null bytes.
@CroodSolutions
@SamunoskeX
@MalwareJake
@UK_Daniel_Card
@SwiftOnSecurity
While I am pontificating with little evidence:
There seem to be variations of this 3x series channel file. I wonder if it is something that is based on the OS flavor.
Others have also reported my first observed c2076***0f8b9, but there are other corrupted versions as well.
Crowdstrike came out with a Falcon Windows Host Recovery Tool. It helps create a bootable USB for just this task. Many of us have been using live Linux boot USBs (or images for Virtual infrastructure). If you're still struggling with the Crowdstrike outage, this tool simplifies
This is my big problem with this.
Mistakes will happen. I'm sure I make more than the average dev at CrowdStrike.
Out-of-band content updates ignoring customer rollout/update policy should not include changes that have the capacity to BSOD.
Note "channel updates ...bypassed client's staging controls and was rolled out to everyone regardless"
A few IT folks who had set the CS policy to ignore latest version confirmed this was, ya, bypassed, as this was "content" update (vs. a version update)
@RobertMLee
Indeed. It's painful to hear finance and tech influencers call it a store of value and even an inflation hedge. At best it's a speculative asset.
Too bad. I think crypto's strength was never as a store of value or growth investment but as a decentralized exchange of value.
Love my CS friends, just memeing through the pain.
PRC to hire laid-off CrowdStrike staff to create a new team for developing new methods ways to bring down entire countries' IT systems.
#CrowdStrikeUpdate
#bsod
@IamRenganathan
@cyberpion
I didn't believe in magic until cyberpion
But seriously, the data they can give you to prioritize vulnerabilities is phenomenal.
Also,
@corelight_inc
. Not sure if it's still a startup. Benefits of FOSS with the features and polish of an Enterprise product.
I'd like to retweet this post that I didn't fully understand the technical aspects of, where the author talks about people retweeting posts they didn't understand.
I used ChatGPT to explain it all to me like I was five. It helped a little.
This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n
@vxunderground
Starting a web store where you sell access to the password for a nominal fee.
They will Google it.
If that fails, you might make some cheddar.
Diving deep into the OpenAI API from the terminal has never been easier. My CLI tool lets you swiftly "train" ChatGPT on your local tools, supports markdown rendering, and the peace of mind that your inputs won't be used for future model training.
I finished compiling some of my research on what's new with Qbot this fall. Hoping it is a helpful analysis and summary of what we have learned from the last few weeks facing Qbot.
Happy Duck Hunting!
#qakbot
#bot
#malware
#threatintel
Sharing an article on the CrowdStrike BSOD issue I contributed to with
@CroodSolutions
.
Initially, chaos ensued, and various theories were circulated. As experts provided clarity, at least by dispelling theories and correcting Twitter threads, the fight against misinformation
Did CrowdStrike do to Linux what it did to Windows months before the BSOD-magedon?
I've noticed a lot of casual references to the "Linux kernel panics CrowdStrike caused" and not enough analysis of it. After responding to numerous questions from colleagues, I decided to compile
@AccidentalCISO
@CroodSolutions
@SamunoskeX
Agreed, well put. This problem exists in other security solutions as well but it is particularly present in SIEM products. There is such a spectrum. Some offerings are so weak that orgs use other tools to fill the futures that their SIEM lacks. One reason I like leveraging FOSS.
This is true... For Manjaro. One Nvidia driver update away from bricking your system. Don't get me started on their security experiences. Glad to say I've put less work into maintaining my system since switching to Debian Test. EndeavorOS has also treated me well.
@cyb3rops
This sad. Under the guise of sharing Intel, Threat Hunting is being turned into a sales opportunity to sell more MS product by teasing people with a solutions only readily available if you buy more.
This behavior makes adopting Sigma even more important.
@nixcraft
Audio was a pain until last year I moved to Dell XPS 13 and XPS 15. I haven't had issues since.
Now it's using Teams on Linux. I use the PWA and it doesn't keep track of my availability status well at all. It thinks I'm gone unless I am working in Teams itself.
@UK_Daniel_Card
♥️
Right on. This is a tough day.
Another potential lesson. System drivers should go to n, then n-1, then n-2, etc. A system driver capable of BSOD is not an out-of-band minor "content update."
Said from a recovering Arch Linux user.
@CroodSolutions
@BHinfoSecurity
I never bought the expansion pack yet. Been years since I played.
Great one to play with kids to. You can talk about the concepts on the cards as they come up.
@cyb3rops
A time attribute is a valuable property in datasets. Whenever I teach on Threat Intel feeds, I always recommend that indicator matching be done against logs a few weeks old in addition to recent data. Sometimes the intel is a few weeks old. You have to use it appropriately.
@TechnoTimLive
I use KVM + QEMU for my home servers. I have some cloud instances on Digital Ocean but have been checking out AWS more and have some always free tier services. Loving AWS + Terraform.
Crowdstrike Overwatch made some excellent points regarding internal threat hunting. But I disagree with their conclusion. In this post, I offer a different perspective along with strategies to make part-time threat hunting more effective and efficient.
I, like many, like to make jokes about Ubuntu. I'm not a fan of snap. It is no longer one of the few easy to install and use distros, most modern options are just as polished. But if it gets you on Linux, then welcome to the community! You can always distro hop around later.
Debian 12 is 6 days old! One of the most stable flavors has all the latest and greatest right now. Great time to try leaving windows.
Don't even have audio issues. But this is still too funny.
I am at the front of the line wanting to avoid a Log4j type situation again, but the implications of making the non-profit foundations liable will result in new open source licensing which will make it illegal to use open source wherever such laws apply.
@nixcraft
Debian for stability. Debian Test for my personal laptop and Debian Stable for my work laptop.
For some reason I gravitate back to RHEL variants for personal servers (CentOS Stream and soon Alma Linux).
Alpine for specific cases.
Mallard Spider's
#QakBot
is back in significant volume! Some to know.
1. The adversary effectively uses Email Chain Compromise / Email Thread Injection, where they reply to an existing conversation obtained from a previously compromised account.
The more I try other IDEs, I appreciate more about Atoms simplicity and power. Not saying others are bad, but Atom was an IDE was pretty great. Who knows what could have been had Microsoft not bought GitHub.
Finished the Windows installer and tested on Windows 10 & 11 with Windows Terminal. Mac and Linux installers have been improved as well.
Check out the tool I built to integrate the GPT models into your terminal.
@GossiTheDog
I saw a screenshot I took was shared on LinkedIn. The screenshot was boring showing nothing interesting in my post was basically a "yeah I have no idea in the world what this is" - hoping others would explain.
I guess it doesn't take much.
@SecurePeacock
@klrgrz
I aliken it to a doctor visit.
Reactive SOC: go to doctor for a fever and sore throat
Proactive Hunter: coming in for check up to ensure nothing is wrong
Both visits will have some overlap in what is examined. Both visits have similar purposes, but different functions.
@AccidentalCISO
a few of us wrote up this new CVE based upon our frustration with email backlog, and I immediately thought of you.
CVE-2020-65837 "Read After Months Flaw, Allowing Messages and Customer Requests in Queue to Go Unread"
CVSS score of 3.1 / Exploitability Level
@cyberqueenmeg
Lol! It's Saturday, I spoke highly of Ubuntu this week while teaching a Linux class about enterprise Linux use, and I haven't bothered with Manjaro in well over 6 months.
I'll keep it at, if I were to compromise in a delay in package releases, which can delay security fixes...
@cyb3rops
Interesting thought.
The -f option already exists and allows users to specify patterns to match from a file.
Many programs accept options specified with flags but do not require a flag to specify the file/path the file will be executed upon.
Example: we dont cat - f a file.
Signed a lease for a third year at my apartment.
My new monthly rent is now 48% more than my initial rent in 2020 for the same apartment. In that same time, the FED reports a 6.1% increase in rent for Primary Residence in U.S. City.
I must be one very unfortunate outlier.
4. Watching out for command script files like .bat or .cmd files.
5. They use compromised web servers; the domains and registration may be "clean" in Threat Intel and more than several years old.
Join us online or in person on January 27th with
@christian_tail
presenting:
"Can Ducks Teach Us how to Share: What hunting Qakbot and other threats teach us about CTI"
Register now or check out our amazing schedule @ !
#infosec
#cc11
@ReplikaMr
I ping-ping between skill development for either from months to month. Thankfully, they arent mutually exclusive.
Depending on licenses, organizations, or research partnerships you have, some forensics capabilities can be fine fule for CTI!
I'm thankful to say I don't have problems with Linux audio. The audio issues I've experienced using Linux for work have been user error.
Still, the concept is so relatable.
For example, Linux tried to dim brightness on my OLED by sending signal to decreasing backlight. Lol.
@vxunderground
It was really convenient!
I haven't booted a Windows device in years, but I woke up and just like everyone else, was an expert in drivers, Windows EDR dev, and BSOD - like everyone else on Twitter.
Please, Crowdstrike should have been asking me what happened!
#CrowdStroke
@AlyssaM_InfoSec
Well said. ♥️
I'm a bit of a CS fan here.
I'll take a moment to express my appreciation to everyone in an IT Support role today.
My time in IT Support helps me see that many people are venting, with some decent justification. IT Support is hearing a lot today. They can vent
Jia Tan's git commit to turn off Landlock sandboxing one week after Lasse Collin improved it. I understand the sandbox is for xz, the command line tool, and Jia did not need to disable it for the SSHD backdoor. 🤔The xz command also activates the backdoor?