I've seen quite a few posts of people asking for a copy of the file that caused all the carnage, curious as to just what it did to bring the systems down.

Given that the app. is an anti-malware suite and the repair directions, it's a kernel-mode (highest-privilege) code update possibly kernel-mode driver that was not tested before deployment or accidentally released or equivalent.

Their removal directions:

Boot Windows into Safe Mode or the Windows Recovery Environment
NOTE: Putting the host on a wired network (as opposed to WiFi) and using Safe Mode with Networking can help remediation.
Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory
Note: On WinRE/WinPE, navigate to the Windows\System32\drivers\CrowdStrike directory of the OS volume
Locate the file matching “C-00000291*.sys” and delete it.
Boot the host normally.

---

---

Seems that those Southern, and Northern, Lights are going to put on another show.

[url=Aussies turned their heads to the sky just months ago for what is usually a rare experience, but the lucky country will get another chance to witness it tonight.]Aussies turned their heads to the sky just months ago for what is usually a rare experience, but the lucky country will get another chance to witness it tonight.[/url]

I'm a bit too far north to see the display.

Cheers.

Still got a bunch of floppies that you need to use every now & then?
If so, then this is what you need.

A car wash for floppy disks.

---

Grant
Darwin NT

Seems that those Southern, and Northern, Lights are going to put on another show.

Aussies turned their heads to the sky just months ago for what is usually a rare experience, but the lucky country will get another chance to witness it tonight.

I'm a bit too far north to see the display.

Link fixed.

Cheers.

NASA has a 30-minute forecast that shows you where the Aurora will be visible.

Seems that those Southern, and Northern, Lights are going to put on another show.

Yep.
It kicked off again last night.

---

Grant
Darwin NT

Neat pics Grant (SSSF), some would of course not say that, they would not approve, idiots.

---

Savoir-Faire is everywhere!
The T1 Trust, T1 Class 4-4-4-4 #5550, America's First HST

I love those pics too.

---

With each crime and every kindness we birth our future.

Really nice pics. Thanks for posting them here.

In 'regular' Aurora photos from northern arctic regions you mostly see greenish Aurora 'curtains'. The red ones are more rare. I only know that the color depends on which matter is forced to emit light energy: oxygen or nitrogen. I'm curious why in these lower latitude Aurora photographs you can only see red but not green colors.

The green we see in the aurora is characteristic of oxygen, while hints of purple, blue or pink are caused by nitrogen. “We sometimes see a wonderful scarlet red colour, and this is caused by very high altitude oxygen interacting with solar particles,”

---

Very good pics, thanks, we'd never see the auroras since where I live it's either too hot or too cold at night or sometimes cloudy, normally we'd be too far away, but you never know how far south or north these lights might stretch.

---

Savoir-Faire is everywhere!
The T1 Trust, T1 Class 4-4-4-4 #5550, America's First HST

---

Thinking Hard Really Can Make Your 'Brain Hurt'

Folks who rub their forehead and complain that a complex problem is making their brain hurt aren’t overstating things, a new review suggests.

Mental exertion appears to be associated with unpleasant feelings in many situations, researchers reported Aug. 5 in the journal Psychological Bulletin.

In fact, the greater a person’s mental effort, the more they experience feelings like frustration, irritation, stress or annoyance, results showed.

“Our findings show that mental effort feels unpleasant across a wide range of populations and tasks,” said senior researcher Erik Bijleveld, an associate professor of psychology with Radboud University in the Netherlands.

Article about CrowdStrike's analysis of what went wrong.

When updates are sent, it changes the location or the number of sensors to check for a potential attack.

In this instance, Falcon expected the update to have 20 input fields, but it had 21 input fields.

This "count mismatch" is what caused the global crash, CrowdStrike said.

"The Content Interpreter expected only 20 values," the RCA report states.
"Therefore, the attempt to access the 21st value produced an out-of-bounds memory read beyond the end of the input data array and resulted in a system crash."

Because Falcon is so tightly integrated into the core of Windows, when it crashed it bought down the entire system causing the BSOD.
....

"The fact that the CrowdStrike developers were able to have this obvious inconsistency between the data file format and the software code means that the most basic forms of quality review and assurance were not being correctly carried out."

---

Grant
Darwin NT

If this line is actually true:

"Therefore, the attempt to access the 21st value produced an out-of-bounds memory read beyond the end of the input data array and resulted in a system crash."

Several stages of inspection and testing were not properly undertaken. At the very least:
A code walk of the new code would have flagged a potential problem;
Running the segment of code in a sandbox and feeding it "defective" data;
and doing much the same one the "sensor" side to make sure the sensors cannot send more than 20 items in their output array.

Add to that, making sure that erroneous data is safely handled and flagged as such, not just take that data and either crash the system or produce wrong results.

All in all a couple of very simple steps could so easily prevented this system crash. (Does that ring a bell?)

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Years ago, picked 20 because it was a huge number that never would be approached. Sounds about like Y2K and just two digits for the year. Or Unix End of Time.

As to tightly integrated - they wrote a kernel driver -- code that can't crash and must catch all its errors itself.

---

Grant
Darwin NT

Darwin award failure.
https://www.youtube.com/watch?v=2tueHPHmOkU

I understand arson but hot plum pudding is going a bit far. Ouch!!

---