(CrowdStrike) Major Windows BSOD issue takes banks, airlines, and broadcasters offline

aeric

Expert
Licensed User
Longtime User
This has caused issues at local airport.
 

amorosik

Expert
Licensed User
AnandGupta said:
As we all slowing becoming depended on Net, killing the net is becoming equivalent to killing all now.
So easy.
Click to expand...

Mmmmm... maybe don't kill us all
But 'turn off' the conveniences that come from online communications
If I have to shop at the vegetable shop or the baker or go and get an ice cream, nothing changes at all
(of course paying with POS will not be possible)
 

aeric

Expert
Licensed User
Longtime User
I am creating a POS that can run on Linux.
 

AnandGupta

Expert
Licensed User
Longtime User
Yes, as shown in movies. Back to stone age to protect from Sky-net.
Well not so far back then.
 

AnandGupta

Expert
Licensed User
Longtime User
Jokes apart, just think how depending on others for our own business (life indirectly) is becoming dangerous if it is critical for our business.
And there is no simple solution it.
 

aeric

Expert
Licensed User
Longtime User
AnandGupta said:
Jokes apart, just think how depending on others for our own business (life indirectly) is becoming dangerous if it is critical for our business.
And there is no simple solution it.
Click to expand...
I don't get you.
If business is important for you, you should have an IT department to take care the IT stuff, do testings before deployment.
 

aeric

Expert
Licensed User
Longtime User
AnandGupta said:
Don't all those Airlines, Banks knocked out had business important to them.
Now I am confused.
Click to expand...
This is a question you should ask them. The IT departments of these businesses need to take the responsibility too.
 

AnandGupta

Expert
Licensed User
Longtime User
aeric said:
This is a question you should ask them. The IT departments of these businesses need to take the responsibility too.
Click to expand...
Well I read the full news (I was worried), and in summery it is like an Antivirus auto update which knocked all Ms laptops and more.

It had happened to us on MS Win update, which is auto mostly, in all laptops of our office. The IT department job is to douse the fire put on by others auto. So yes, IT department are all running to fix it by reverting back the update done auto by MS or Crowdstrike or else.
 

AnandGupta

Expert
Licensed User
Longtime User
Just read this,

B4X: 
This is literally huge, more than we think. This is gonna be remembered in History!
Exposed a major single point of failure in essential and important services !
[LIST=1]
[*]More than half the world is down, aeroplanes grounded, banking systems fucked, 911 down on some parts and everything.
[*]Cannot push an update!! For fucking real! This is the most serious issue, Each machine needs a manual intervention to boot into safe mode and delete the update file, imagine millions of systems and some are bitlocker encrypted (entering keys manually in each system), have fun there.
[/LIST]
This company is cooked.
Edit: Only Crowdstrike clients are affected, your personal computers and laptops would be fine!!
 

aeric

Expert
Licensed User
Longtime User
When I was working in a local bank many years ago, the wintel team will test any new updates and only push the update to the users through group policies. Why this SOP was skipped? Isn't this no longer a practice now?
 

aeric

Expert
Licensed User
Longtime User
"causing catastrophic... "
 

agraham

Expert
Licensed User
Longtime User
Apparently it was not an actual software patch but a configuration file change with bad data that baffled the CrowdStrike Falcon software and caused it to crash. As this software is a kernel mode driver Windows couldn't catch the crash and affected computers entered a boot loop. Some computers recovered by themselves after a few boot attempts as if the timing works out favourably the network stack can get loaded before the Falcon driver is fully active and can then download a newer corrected file that solves the problem. Other unluckier computers will need manual intervention to delete the faulty file which is a bit more complicated if Bitlocker is used on the boot drive as Safe mode, needed to get the computer up to actually delete the bad file, needs the Bitlocker key to be available. VMs can be a bit easier to fix as their virtual disk can be detached, connected to another working VM, the file deleted and the disk reattached to the original VM and the VM bought up again. Undoubtedly there will be tens or hundreds of thousands of IT staff man hours spent recovering the millions of computers affected.

This threat configuration file seems to be, and needs to be, very frequently updated and uploaded, perhaps several times a day, as the perceived threats that CrowdStrike identifies change so a classic test and gradual roll out mechanism is not really practical. However it does seem that the core software has weak data validation of data in this file for a mere data glitch to cause such a massive problem.
 
You must log in or register to reply here.
Menu
Log in
Register
Cookies are required to use this site. You must accept them to continue using the site. Learn more…