Was Unpriviledged User Namespaces exploited since it started to default to YES?

We had good discussions about it being safe or not five years ago, and it was defaulted to yes on the kernel way over 3 years ago (with a note calling anyone security conscious who disable it as paranoid)
So, was it exploited after all in … Continue reading Was Unpriviledged User Namespaces exploited since it started to default to YES?

Post-CrowdStrike Fallout: Microsoft Redesigning EDR Vendor Access to Windows Kernel

Microsoft is revamping how anti-malware tools interact with the Windows kernel to avoid another CrowdStrike faulty update catastrophe. 
The post Post-CrowdStrike Fallout: Microsoft Redesigning EDR Vendor Access to Windows Kernel appeared first on Secur… Continue reading Post-CrowdStrike Fallout: Microsoft Redesigning EDR Vendor Access to Windows Kernel

Scenarios to exploit CrowdStike as a massive attack on thousands of machines

On July 19, 2024, many witnessed an IT "outage" linked to CrowdStrike’s Falcon sensor on Windows machines. Some started to blame Microsoft for that, and some were figuring out what went wrong with CrowdStrike and the relationship… Continue reading Scenarios to exploit CrowdStike as a massive attack on thousands of machines

Highly suspicious System.Map (5.14.21-150500.55.68) – Linux compromised? [migrated]

I’m running the 5.14.21-150500.55.68 x86_64 kernel on OpenSuSe Leap 15.5. I have over 20 years of experience with many different distros, but I always come back to OpenSuSe for several reasons. I have knowledge about Assembler, C/C++ and L… Continue reading Highly suspicious System.Map (5.14.21-150500.55.68) – Linux compromised? [migrated]