Ep6: After CrowdStrike chaos, should Microsoft kick EDR agents out of Windows kernel?
About this episode
Three Buddy Problem - Episode 6: As the dust settles on the CrowdStrike incident that blue-screened 8.5 million Windows computers worldwide, we dig into CrowdStrike’s preliminary incident report, the lack of transparency in the update process and the need for more robust testing and validation. We also discuss Microsoft's responsibility to avoid infinite BSOD loops, risks of deploying EDR agents on critical systems, and how an EU settlement is being blamed for EDR vendors having access to the Windows kernel.
Other topics on the show include Mandiant's attribution capabilities, North Korea’s gov-backed hacking teams launching ransomware on hospitals, KnowBe4 hiring a fake North Korean IT worker, and new developments in the NSO Group surveillance-ware lawsuit.
Hosts: Costin Raiu (Art of Noh), Juan Andres Guerrero-Saade (SentinelLabs), Ryan Naraine (SecurityWeek)
Get every episode summarized
Each time Three Buddy Problem publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.
Email me new episodesFree for 3 shows. No card needed.
Hosts & guests
No transcript yet
This episode has not been transcribed. Request it and it moves to the front of the queue.
More episodes
More from Three Buddy Problem
A Thousand Agents Walk Into Hugging Face
Three Buddy Problem
Inside the EncroChat law-enforcement implant, Irregular's AI sandbox failure
Three Buddy Problem
A tiny 12 KB Windows backdoor, one victim, and a dead domain
Three Buddy Problem
Inside OpenAI's Black Hat Confession
Three Buddy Problem