CrowdStrike: Technical Details on Microsoft Outage
CrowdStrike is conducting a thorough root cause analysis to prevent future incidents.
image for illustrative purpose
On July 19, 2024, a routine sensor configuration update by CrowdStrike triggered widespread system crashes on Windows systems around globe.
The update, aimed at enhancing protection mechanisms against new cyber threats, accidentally triggered a logic error in "Channel File 291," located in C:-Windows-System32-drivers-CrowdStrike-.
“Customers running Falcon sensor for Windows version 7.11 and above, that were online between Friday, July 19, 2024, 04:09 UTC and Friday, July 19, 2024, 05:27 UTC, may be impacted. Systems running Falcon Sensor for Windows 7.11 and above that downloaded the updated configuration from 04:09 UTC to 05:27 UTC – were susceptible to a system crash,” CrowdStike told in its blog post.
Named pipes, crucial for interprocess communication on Windows, were the focus of the update but instead caused blue screen of death (BSOD) errors.
CrowdStrike swiftly addressed the issue by updating Channel File 291 and clarified that the incident was not caused by a cyberattack. It is also sad that Linux or macOS systems remained unaffected.
CrowdStrike is conducting a thorough root cause analysis to prevent future incidents (like Microsoft’s outage) and has advised affected customers to seek support through their official channels.
The incident highlights the challenges of balancing security updates with operational stability in cybersecurity practices, emphasising the importance of rigorous testing and monitoring in safeguarding digital systems.
