I believe with APFS the kernel and core parts of the OS are in an isolated partition that is snapshot and locked down. Been a while since I read the change as it was when APFS was first introduced.
Guess what? That’s how it works on Linux too!! Do you think AV in Linux/OSX doesn’t attach to the kernel? And AV software has to update daily or it’s quite pointless. If tomorrow Trend Micro, Palo Alto, Rapid7, etc puts out a bad patch and kernel panics systems what are you going to say? It’s just as likely.
They do not write their own software (not more than I write mine) but they are in charge of verifying before accepting an update. They must understand what they are doing. And we are not speaking of a small company or a start-up, we are speaking mega corporations with lots of admin people for lots of reasons (fiscal, legal ...), they can pay for good IT people who understand their business and control it.
This is the normal reaction of people here in the forum, who first post and than - maybe - start thinking.
Exactly. I could have some sympathy for some singular alternative configuration. Or actually not as this level of software should cover that off as well. But causing an outage through a bad configuration being deployed like this on a global scale is unforgivable. One doesn’t need to know the ins and outs to realise they clearly did not have the correct controls in place in that organisatie. For a company like that, that is just insane.
Chillax, there is no reason to not find it hilarious and funny... No one who comes here is a world leader, this is just for fun...
Good find.
github.com
As much as I would like to blame the big ol'windblows, it really wasn't the OS's fault. Root Cause was an update that came from Crowdstrike, it tickled windows funny and things broke.
It is, was recommended practice to not do that for this. In a good configuration you should take at least every four hours security updates. This is classic risk management, typically the risk of not taking such security updates is greater than the risk of not testing it yourself. But, and these events are very rare, in this event for this company it wasn’t. I don’t think the risk profile materially changes. I would likely temporarily raise it, and demand more clarity and evidence from the companies involved opposed to relying on their credentials.
Ok once again this wasn’t a windows update it was a security definition update. So when the next zero day comes out how long should a company stay vulnerable to said zero day before they patch? If they run patches in dev once a week then patch prod the following week and get compromised in that timeframe what will you say then?
Youre not entirely wrong about humanity needing to go outside every few days...
Back a few years there was a similar example of a large company's CIO who lost his job, because he deployed the latest MS patches which were not compatible with the companies cybersecurity software used. Every windows PC on their intranet including some servers crashed and blue screened. The pairing of regular updates for windows and cybersecurity is not always timed well enough to allow IT staff to pre-test deployments. Today's example will likely see a lot of IT people cursing both MS and Crowdstrike.
Then I'd hold Apple responsible for creating a system that can be bricked by a random update from a 3rd Party.
Nonsense. A third party app update on a Mac is not going to cripple the machine and prevent it from booting. It is a Windows problem.
