Microsoft releases Windows repair tool to remove CrowdStrike driver (www.bleepingcomputer.com)
from kid@sh.itjust.works to cybersecurity@sh.itjust.works on 22 Jul 2024 13:20
https://sh.itjust.works/post/22605170

#cybersecurity

threaded - newest

toasteecup@lemmy.world on 22 Jul 2024 13:30 next collapse

This is great and a hats off to Microsoft for whipping it up so fast,that being said you’ll still need the recovery key for bitlocker which is the ultimate problem; a bitlockered crowdstriked active directory server storing all of the bitlocker recovery keys.

wreckedcarzz@lemmy.world on 22 Jul 2024 13:33 next collapse

Sounds like someone didn’t plan for the worst-case scenario…

stringere@sh.itjust.works on 22 Jul 2024 18:56 collapse

Second-to-worst-case scenario was the best we could do at the time.

cm0002@lemmy.world on 22 Jul 2024 14:44 next collapse

a bitlockered crowdstriked active directory server storing all of the bitlocker recovery keys.

If you didn’t make a backup of the recovery key to the master server holding all other keys that’s on you

Rhaedas@fedia.io on 22 Jul 2024 14:52 next collapse

I did make a backup. Then I put it on that other computer. That's also blue screen.

Post-It security is best security.

SpaceNoodle@lemmy.world on 22 Jul 2024 16:27 collapse

This is why all my passwords are on Post-Its

stringere@sh.itjust.works on 22 Jul 2024 18:55 collapse

A lot of teams only made it through the weekend with help from Postmates.

toasteecup@lemmy.world on 22 Jul 2024 19:13 collapse

Oh I’m not affected by this at all. I’m just explaining the issue and why we’re not out of the forest yet. I fully agree that this is the fault of the companies for having garbage update and back up policies. I also blame crowdstrike for having a shit tier qa policy.

Buelldozer@lemmy.today on 22 Jul 2024 16:50 collapse

It’s a PITA but you can restore a backup from last Wednesday or earlier into a VM, boot it up, and then retrieve the key for one of your regular ADCs.

Also, why are all your ADCs using BitLocker? I get that you want data encrypted at rest but why not use your RAID controller instead?

toasteecup@lemmy.world on 22 Jul 2024 19:55 collapse

I’m not impacted. I’m just outlining why people are still impacted.

EmperorHenry@infosec.pub on 23 Jul 2024 05:59 collapse

Crowdstrike has always been a shitty company.

They’ve never cared about making a good product, only about marketing and making things look pretty