This is correct, as in windows a driver is the most straightforward method to runlevel0 access. It absolutely could at any time do exactly what crowdstrike did. But also so could Nvidia/amd with GPU drivers, your motherboard manufacturer with chipset and RGB drivers, etc. it’s not quite the smoking gun people make it out to be, as there are a lot of legitimate reasons to have this kind of system access.
The egregious part was that crowdstrike users agreed to allow a vendor to bypass canary channels and deploy straight to their endpoints.
And that’s the problem, like CrowdStrike Vanguard will update itself in the background unlike your GPU driver which you need to go through an update process explicitly, so if the same thing happens where they pushed a bad update, the same outcome of causing failed boots without prompt could happen.
Does Vanguard not seek testing and validation by Microsoft before pushing updates?
I saw the recent video from the Task Manager designer Dave’s Garage on YouTube, lack of thorough official validation seemed to be an important part of the CrowdStrike problem.
Of course it’s not a smoking gun. That’s the wrong metaphor. It’s an extra stick of dynamite that isn’t needed, just waiting to explode at the flip of a coin. That there are other sticks of dynamite doesn’t negate the risk posed by this one.
This is correct, as in windows a driver is the most straightforward method to runlevel0 access. It absolutely could at any time do exactly what crowdstrike did. But also so could Nvidia/amd with GPU drivers, your motherboard manufacturer with chipset and RGB drivers, etc. it’s not quite the smoking gun people make it out to be, as there are a lot of legitimate reasons to have this kind of system access.
The egregious part was that crowdstrike users agreed to allow a vendor to bypass canary channels and deploy straight to their endpoints.
And that’s the problem, like CrowdStrike Vanguard will update itself in the background unlike your GPU driver which you need to go through an update process explicitly, so if the same thing happens where they pushed a bad update, the same outcome of causing failed boots without prompt could happen.
Does Vanguard not seek testing and validation by Microsoft before pushing updates?
I saw the recent video from the Task Manager designer Dave’s Garage on YouTube, lack of thorough official validation seemed to be an important part of the CrowdStrike problem.
Of course it’s not a smoking gun. That’s the wrong metaphor. It’s an extra stick of dynamite that isn’t needed, just waiting to explode at the flip of a coin. That there are other sticks of dynamite doesn’t negate the risk posed by this one.