Comment on Microsoft to host security summit after CrowdStrike disaster
lud@lemm.ee 3 weeks agoIs that the way that EDR is implemented on Linux or are you guessing?
Comment on Microsoft to host security summit after CrowdStrike disaster
lud@lemm.ee 3 weeks agoIs that the way that EDR is implemented on Linux or are you guessing?
progandy@feddit.org 3 weeks ago
Currently, cloudstrike offers two methods for Linux: a kernel driver / module and a theoretically safer alternative using epbf (you could call that “kernel level scripting”). Ironically, they triggered a kernel bug using that more second option. They did not test all kernels they listed as compatible or something like that.