I'm still surprised people use CrowdStrike. I guess there are no real alternatives. I know companies are getting CrowdStrike alerts for this very issue, but it still just seems like a MASSIVE attack surface.

Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.

I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.

I forgot entirely about superfish. That takes me back.

My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops.

I think higher end Lenovo laptops with cleaner windows images were not affected. And a lot of knowledgeable users wipe the OS anyway.