Kernel mods with eBFP
Friday, July 19 2024 was a very interesting day, several Windows machines were down showing the blue screen of death. The problem was caused by a software update from a security company named Crowdstrike, which was installed on all the machines. The update was supposed to improve security by adding new threats definitions, but the update created a conflict with the Windows kernel, causing the machines to crash.
Today I found this article that explains how companies are using eBFP to modify the kernel and add new features to the operating system, specially security features.
Very interesting stuff, aligned with the WASM/WASI approach, but for the kernel.