You are viewing a single thread.
View all comments 
14 points
If the sensor was using eBPF (as any modern sensor on Linux should) then the faulty update would have made the sensor crash, but the system would still be stable. But CrowdStrike has a long history of using stupid forms of integration, so I wouldn’t put it past them to also load a kernel module that fucks things up unless it’s blacklisted in the bootloader. Fortunately that kind of recovery is, if not routine, at least well documented and standardized.
2 points
I did hear that one of their newer versions does use eBPF, but I haven’t even remotely looked into it.
1 point
