That CrowdStrike IT world outage

[Retro]

When I woke up this morning to the news of this massive global IT outage, I was sure it was a cyberattack, especially given the timing of Zelensky visiting the UK today and Trump's inflamatory acceptance presidential nomination speech overnight. However, it turned out instead to be some dodgy little update from CrowdStrike that took everything out! It wasn't even meant to be a very important update, hence it wasn't tested as thoroughly as others which is why it wasn't caught before release. Seriously, if this had been a movie plot, one would have said nah, too implausible, yet here we are, with the continuing aftermath of this royal cockup. Let's see how it develops.

Cyber-security firm Crowdstrike has admitted that the problem was caused by an update to its antivirus software, which is designed to protect Microsoft Windows devices from malicious attacks.

Microsoft has said it is taking "mitigation action" to deal with "the lingering impact" of the outage.

Crowdstrike and Microsoft: What we know about global IT outage

A mass IT outage has caused chaos around the world, with major airlines among the victims.

www.bbc.co.uk

Live news coverage:

Microsoft IT outage live updates: Global IT chaos persists as Crowdstrike boss admits outage could take time to fix

Airports, banking and healthcare were all hit when a Crowdstrike update triggered huge Microsoft outages.

www.bbc.co.uk

 

[Retro]

Full recovery from ‘largest IT outage in history’ could take weeks

Fault in CrowdStrike software update linked to Windows PCs may require each computer to be fixed individually

www.theguardian.com

 

[live627]

The internet was never designed for centralization like this.

 

[Retro]

An interesting editorial on the fragility of our digital world.

IT outage exposes fragility of tech infrastructure

Ultimately, when systems wobble, there is little that can be done - except wait for a fix.

www.bbc.co.uk

 

[Geffers]

When I woke up this morning to the news of this massive global IT outage, I was sure it was a cyberattack, especially given the timing of Zelensky visiting the UK today and Trump's inflamatory acceptance presidential nomination speech overnight.

Trump's fault

 

[Retro]

Trump's fault

I wish I could pin this one on him, lol.

 

[Tiffany]

Mac and Linux users weren't affected by this.

 

[Astro What]

I wish I could pin this one on him, lol.

Hey, he did fire the top election security expert head (Krebs) that was good at what he did.... because he had the temerity to say that the election was one of the most secure in history and that went against the fairy-tale of massive fraud that Trump was banging the toy drum over. But Krebs didn't have anything to do with regular worldwide computer security... but his firing does show a disturbing trend.

As for this latest SNAFU (the acronym), this is not the first time an update from a software provider has caused massive issues. It just happens that it was one of the largest so far since more and more companies are becoming reliant on smaller pool of providers. And once more it was because of sloppy QC on the part of a company. From some of the stuff I've read, they didn't adequately check the "update" before they pushed it out.
Microsoft has also been a victim of this type of lack of quality assurance when pushing out updates. So has IBM.
So it's not limited to any particular company. It's just telling on how quickly being lazy/sloppy in your QC can affect so many people so quickly.

Mac and Linux users weren't affected by this.

Not directly, no. And not even on my desktop machines.
It's been estimated that it only affected about 1% of existing Windows computers.

 

[Retro]

Dave explains in fascinating technical detail what actually happened to cause all those blue screens.

Watching this, one gets a better sense of how malware can generally compromise a system if it gets into the wrong places.

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[live627]

Just came here to post that. I dont quite understand why that software needs kernel-leevel access. Or maybe I should actually learn what it is first.

 

[Retro]

It's antivirus software so it needs to work at the lowest level. The video is well worth watching.

 

[live627]

oh I see. Found some delicious nerdy details, programmer approved:

CrowdStrike needs kernel space to override syscalls like reading files, mmap, etc. Rootkits and other malware will rewrite syscalls as well. There is no way to intercept calls/access memory for other processes in userspace, and AV is perpetually trying to be "on top", hence the kernel-mode drivers. All AV works like this - once it's hooked in, processes that e.g. read files will be accessing it through a rewritten fopen() syscall that goes through CrowdStrike's driver.

 

[Retro]

Dave has an update on the CrowdStrike issue.

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies