• Mikina@programming.dev
    link
    fedilink
    arrow-up
    0
    ·
    4 months ago

    I might be wrong, but from how I understand it it probably wouldn’t help. Kernel drivers have a rigorous QA and cert by Microsoft if you want to get them signed, which is a process that may take a long time - longer than you can afford when pushing updates to AV/EDR to catch emerging threats. What Crowdstrike does to bypass this requirement is that the CS Falcon is just an engine, that loads, interprets and executes code from definition files. The kernel driver code then doesn’t need to change, so no need for new MS cert, and they can just push new definition files. So, they kind of have to deal with unsafe in this case, since you are executing a new code.

    • zaphod@sopuli.xyz
      link
      fedilink
      arrow-up
      0
      ·
      4 months ago

      What Crowdstrike does to bypass this requirement is that the CS Falcon is just an engine, that loads, interprets and executes code from definition files.

      If Microsoft really has “rigorous QA and cert” for kernel drivers then they shouldn’t have certified this, because now it’s a certified bypass for the certification.