CrowdStrike

[El Heggunte]

I had never heard of this thing until this morning.

{{
July 2024 global cyber outages.

On 19 July 2024, various computer systems around the world experienced an outage that has led to ongoing disruptions across multiple different industries, relating to a faulty CrowdStrike update.

The incident involved causing blue screens of death for Windows machines. American cybersecurity company CrowdStrike has said that they were the cause of the issues. A driver update relating to CrowdStrike's Falcon Driver security software has been identified as the root cause of the issue.
}}

Read more @ https://en.wikipedia.org/wiki/July_2024_global_cyber_outages

[lordsmurf]

CrowdStrike is a security platform that makes something like Norton (or McAfee, AVG, whatever) look like a kid's Computer 101 programming project.

Complex corporate IT tools.

[Cornucopia]

And yet those other tools didn't experience issues today.



Scott

[Alwyn]

Touche.

[hydra3333]

"Programmers are human-shaped machines that transform alcohol into bugs."

Nice sig, never a truer word. Although I have seen a few red-faced ones get really creative !

PS I once knew someone who worked in QA in a small IT area. I was told mgt tried to cut it down/out as not necessary !
I guess the multiple billions lost in this, ahem "unfortunate circumstance", sort of proves such a thing's worth

[lordsmurf]

And yet those other tools didn't experience issues today.

Most of those overpriced consumer "anti-virus" tools never worked, placebo effect, a fuzzy warm blanket to make you feel better without actually protecting from a sub-zero freeze.

[netmask56]

The effect was quite strong in Australia due to the low level of cash used, the 2 big supermarket chains had to close as every second person is using their phone these days, even the proverbial "little old lady". Fast becoming a cashless society.

[DB83]

Little did they know how apt their Company Name would be

[frank_footer]

Windows 3.1 saved the day for at least one airline:

https://www.yahoo.com/tech/windows-version-1992-saving-southwest-171922788.html

[thecoalman]

And yet those other tools didn't experience issues today.



Scott

The software in question loads at the kernel level, the application doesn't crash, the system does.

If I understand correctly they were using a "driver" that didn't actually control any hardware. Driver needs to be signed by MS so since these are time critical updates the "driver" was loading frequently updated definition lists that are not signed. Since the system can't boot there is no way to get rid of the corrupt definition file automatically. That corruption can be caused by single misplaced or missing character.

It's actually not difficult to fix, you only need to boot into safe mode and delete the corrupt file(s). Certainly a big problem in large organization with thousands or tens of thousands machines.

[frank_footer]

also effects linux systems:

https://www.theregister.com/2024/07/21/crowdstrike_linux_crashes_restoration_tools/

https://www.neowin.net/news/crowdstrike-broke-debian-and-rocky-linux-months-ago-but-no-one-noticed/