Hacker News Reader

Although it's a .sys file, it's not a device driver.

"Although Channel Files end with the SYS extension, they are not kernel drivers."

https://www.crowdstrike.com/blog/technical-details-on-todays...

Yeah it's a way of delivering a payload to the driver, which promptly crashed.

Which is horrible!

Horrible for sure, not least because hackers now know that the channel file parser is fragile and perhaps exploitable. I haven't seen any significant discussion about follow-on attacks, it's all been about rolling back the config file rather than addressing the root cause, which is the shonky device driver.

I suspect the wiley hackors have known how fragile that code is for years.

Reply on news.ycombinator.com