{"id":2379,"date":"2024-07-21T05:47:01","date_gmt":"2024-07-21T05:47:01","guid":{"rendered":"https:\/\/tastycounter.net\/index.php\/2024\/07\/21\/ban-cap-nhat-loi-cua-crowdstrike-da-gay-ra-su-co-cho-85-trieu-thiet-bi-windows\/"},"modified":"2024-07-21T05:47:01","modified_gmt":"2024-07-21T05:47:01","slug":"ban-cap-nhat-loi-cua-crowdstrike-da-gay-ra-su-co-cho-85-trieu-thiet-bi-windows","status":"publish","type":"post","link":"https:\/\/tastycounter.net\/index.php\/2024\/07\/21\/ban-cap-nhat-loi-cua-crowdstrike-da-gay-ra-su-co-cho-85-trieu-thiet-bi-windows\/","title":{"rendered":"B\u1ea3n c\u1eadp nh\u1eadt l\u1ed7i c\u1ee7a CrowdStrike \u0111\u00e3 g\u00e2y ra s\u1ef1 c\u1ed1 cho 8,5 tri\u1ec7u thi\u1ebft b\u1ecb Windows"},"content":{"rendered":"<\/p>\n
\n

Theo Microsoft b\u1ea3n c\u1eadp nh\u1eadt l\u1ed7i c\u1ee7a CrowdStrike \u0111\u00e3 g\u00e2y ra m\u1ed9t s\u1ef1 c\u1ed1 c\u00f4ng ngh\u1ec7 to\u00e0n c\u1ea7u, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn 8,5 tri\u1ec7u thi\u1ebft b\u1ecb Windows v\u00e0o ng\u00e0y th\u1ee9 6 v\u1eeba qua. H\u00e3ng c\u0169ng cho bi\u1ebft \u0111\u00f3 l\u00e0 “d\u01b0\u1edbi m\u1ed9t ph\u1ea7n tr\u0103m t\u1ed5ng s\u1ed1 thi\u1ebft b\u1ecb ch\u1ea1y Windows<\/a>” nh\u01b0ng nhi\u00eau \u0111\u00f3 l\u00e0 c\u0169ng \u0111\u1ee7 \u0111\u1ec3 c\u00e1c nh\u00e0 b\u00e1n l\u1ebb, ng\u00e2n h\u00e0ng, h\u00e3ng h\u00e0ng kh\u00f4ng v\u00e0 nhi\u1ec1u ng\u00e0nh c\u00f4ng nghi\u1ec7p kh\u00e1c \u0111i\u00eau \u0111\u1ee9ng v\u00ec s\u1ef1 c\u1ed1 n\u00e0y c\u1ee7a CrowdStrike.<\/p>\n

Ngo\u00e0i ra, b\u1ea3n ph\u00e2n t\u00edch k\u1ef9 thu\u1eadt t\u1eeb CrowdStrike ph\u00e1t h\u00e0nh v\u00e0o th\u1ee9 S\u00e1u gi\u1ea3i th\u00edch th\u00eam v\u1ec1 nh\u1eefng g\u00ec \u0111\u00e3 x\u1ea3y ra v\u00e0 t\u1ea1i sao nhi\u1ec1u h\u1ec7 th\u1ed1ng b\u1ecb \u1ea3nh h\u01b0\u1edfng c\u00f9ng m\u1ed9t l\u00fac. CrowdStrike \u0111\u00e3 gi\u1ea3i th\u00edch r\u1eb1ng t\u1eadp tin c\u1ea5u h\u00ecnh l\u00e0 nguy\u00ean nh\u00e2n ch\u00ednh c\u1ee7a v\u1ea5n \u0111\u1ec1. C\u00e1c t\u1eadp tin c\u1ea5u h\u00ecnh \u0111\u01b0\u1ee3c \u0111\u1ec1 c\u1eadp \u1edf tr\u00ean \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 \u201cChannel Files\u201d v\u00e0 l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 h\u00e0nh vi \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng b\u1edfi c\u1ea3m bi\u1ebfn Falcon.<\/p>\n

\"crowdstrike\"<\/p>\n

C\u00e1c b\u1ea3n c\u1eadp nh\u1eadt cho Channel Files l\u00e0 m\u1ed9t ph\u1ea7n b\u00ecnh th\u01b0\u1eddng c\u1ee7a ho\u1ea1t \u0111\u1ed9ng c\u1ee7a c\u1ea3m bi\u1ebfn v\u00e0 x\u1ea3y ra v\u00e0i l\u1ea7n m\u1ed9t ng\u00e0y \u0111\u1ec3 ph\u1ea3n \u1ee9ng v\u1edbi c\u00e1c k\u1ef9 thu\u1eadt v\u00e0 quy tr\u00ecnh m\u1edbi \u0111\u01b0\u1ee3c CrowdStrike ph\u00e1t hi\u1ec7n. \u0110\u00e2y kh\u00f4ng ph\u1ea3i l\u00e0 m\u1ed9t quy tr\u00ecnh m\u1edbi; ki\u1ebfn tr\u00fac n\u00e0y \u0111\u00e3 t\u1ed3n t\u1ea1i t\u1eeb khi Falcon ra \u0111\u1eddi.<\/p>\n

<\/ins><\/div>\n

CrowdStrike gi\u1ea3i th\u00edch r\u1eb1ng t\u1eadp tin kh\u00f4ng ph\u1ea3i l\u00e0 tr\u00ecnh \u0111i\u1ec1u khi\u1ec3n nh\u00e2n (kernel driver) nh\u01b0ng ch\u1ecbu tr\u00e1ch nhi\u1ec7m cho “c\u00e1ch Falcon \u0111\u00e1nh gi\u00e1 th\u1ef1c thi named pipe tr\u00ean c\u00e1c h\u1ec7 th\u1ed1ng Windows.” Nh\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt v\u00e0 ng\u01b0\u1eddi s\u00e1ng l\u1eadp Objective See, Patrick Wardle, cho bi\u1ebft l\u1eddi gi\u1ea3i th\u00edch n\u00e0y ph\u00f9 h\u1ee3p v\u1edbi ph\u00e2n t\u00edch tr\u01b0\u1edbc \u0111\u00f3 c\u1ee7a anh v\u00e0 nh\u1eefng ng\u01b0\u1eddi kh\u00e1c v\u1ec1 nguy\u00ean nh\u00e2n g\u00e2y ra s\u1ef1 c\u1ed1, khi t\u1eadp tin v\u1ea5n \u0111\u1ec1 \u201cC-00000291-\u201d \u0111\u00e3 k\u00edch ho\u1ea1t l\u1ed7i logic d\u1eabn \u0111\u1ebfn s\u1ef1 c\u1ed1 h\u1ec7 \u0111i\u1ec1u h\u00e0nh (th\u00f4ng qua CSAgent.sys).<\/p>\n

\"crowdstrike\"<\/p>\n

V\u00e0o ng\u00e0y 19 th\u00e1ng 7, CrowdStrike \u0111\u00e3 ph\u00e1t h\u00e0nh m\u1ed9t b\u1ea3n c\u1eadp nh\u1eadt c\u1ea5u h\u00ecnh c\u1ea3m bi\u1ebfn cho c\u00e1c h\u1ec7 th\u1ed1ng Windows. C\u00e1c b\u1ea3n c\u1eadp nh\u1eadt c\u1ea5u h\u00ecnh c\u1ea3m bi\u1ebfn l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 n\u1ec1n t\u1ea3ng Falcon. B\u1ea3n c\u1eadp nh\u1eadt c\u1ea5u h\u00ecnh n\u00e0y \u0111\u00e3 k\u00edch ho\u1ea1t l\u1ed7i logic d\u1eabn \u0111\u1ebfn s\u1ef1 c\u1ed1 h\u1ec7 th\u1ed1ng v\u00e0 khi\u1ebfn cho “m\u00e0n h\u00ecnh xanh, \u0111i mu\u00f4n n\u01a1i”\u00a0 tr\u00ean c\u00e1c h\u1ec7 th\u1ed1ng b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

C\u00e1c h\u1ec7 th\u1ed1ng ch\u1ea1y c\u1ea3m bi\u1ebfn Falcon cho Windows 7.11 tr\u1edf l\u00ean \u0111\u00e3 t\u1ea3i xu\u1ed1ng c\u1ea5u h\u00ecnh c\u1eadp nh\u1eadt t\u1eeb 04:09 UTC \u0111\u1ebfn 05:27 UTC – c\u00f3 nguy c\u01a1 b\u1ecb s\u1ef1 c\u1ed1 h\u1ec7 th\u1ed1ng.<\/p>\n

Wardle l\u01b0u \u00fd r\u1eb1ng c\u00e1c b\u1ea3n c\u1eadp nh\u1eadt file channel c\u1ee7a CrowdStrike \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u1ea9y l\u00ean m\u00e1y t\u00ednh b\u1ea5t k\u1ec3 b\u1ea5t k\u1ef3 c\u00e0i \u0111\u1eb7t n\u00e0o \u0111\u01b0\u1ee3c thi\u1ebft l\u1eadp \u0111\u1ec3 ng\u0103n ch\u1eb7n c\u00e1c b\u1ea3n c\u1eadp nh\u1eadt t\u1ef1 \u0111\u1ed9ng nh\u01b0 v\u1eady.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Theo Microsoft b\u1ea3n c\u1eadp nh\u1eadt l\u1ed7i c\u1ee7a CrowdStrike \u0111\u00e3 g\u00e2y ra m\u1ed9t s\u1ef1 c\u1ed1 c\u00f4ng ngh\u1ec7 to\u00e0n c\u1ea7u, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn 8,5 tri\u1ec7u thi\u1ebft b\u1ecb Windows v\u00e0o ng\u00e0y th\u1ee9 6 v\u1eeba qua. H\u00e3ng c\u0169ng cho bi\u1ebft \u0111\u00f3 l\u00e0 “d\u01b0\u1edbi m\u1ed9t ph\u1ea7n tr\u0103m t\u1ed5ng s\u1ed1 thi\u1ebft b\u1ecb ch\u1ea1y Windows” nh\u01b0ng nhi\u00eau \u0111\u00f3 l\u00e0 c\u0169ng \u0111\u1ee7 \u0111\u1ec3 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2379","post","type-post","status-publish","format-standard","hentry","category-khong-phan-loai"],"_links":{"self":[{"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/posts\/2379","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/comments?post=2379"}],"version-history":[{"count":0,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/posts\/2379\/revisions"}],"wp:attachment":[{"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/media?parent=2379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/categories?post=2379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/tags?post=2379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}