The Crowdstrike Incident - Revision history

ABramer: /* Practical Part and Experiment */

2024-12-19T09:59:03Z

Practical Part and Experiment

← Older revision		Revision as of 09:59, 19 December 2024
Line 86:		Line 86:

	Now we want to demonstrate how those mentioned effects finally leads to the incident.		Now we want to demonstrate how those mentioned effects finally leads to the incident.

	You find the full experiment here:		You find the full experiment here:
	https://wiki.elvis.science/index.php?title=The_Crowdstrike_Incident_-_Practical_Part		https://wiki.elvis.science/index.php?title=The_Crowdstrike_Incident_-_Practical_Part

ABramer at 09:35, 19 December 2024

2024-12-19T09:35:26Z

← Older revision		Revision as of 09:35, 19 December 2024
Line 42:		Line 42:

	[[File:Crowdstrike_bsod.png\|500px\|thumb\|left\|From faulty Channel File to BSOD (own representation based on [12]; 1:30 min)]]		[[File:Crowdstrike_bsod.png\|500px\|thumb\|left\|From faulty Channel File to BSOD (own representation based on [12]; 1:30 min)]]


	== Political Background ==		== Political Background ==

ABramer at 09:34, 19 December 2024

2024-12-19T09:34:36Z

← Older revision		Revision as of 09:34, 19 December 2024
Line 41:		Line 41:
	However, in this case, this function led to a race condition - the faulty file was loaded at startup because it was a software-specific component. As a result, the agent essentially overtook itself, leading to a Blue Screen of Death (BSOD).[6]		However, in this case, this function led to a race condition - the faulty file was loaded at startup because it was a software-specific component. As a result, the agent essentially overtook itself, leading to a Blue Screen of Death (BSOD).[6]

	[[File:Crowdstrike_bsod.png\|500px\|thumb\|left\|From faulty Channel File to BSOD (own representation based on [13]; 1:30 min)]]		[[File:Crowdstrike_bsod.png\|500px\|thumb\|left\|From faulty Channel File to BSOD (own representation based on [12]; 1:30 min)]]


	== Political Background ==		== Political Background ==

ABramer at 09:34, 19 December 2024

2024-12-19T09:34:00Z

← Older revision		Revision as of 09:34, 19 December 2024
Line 129:		Line 129:

	[11] https://www.researchgate.net/publication/383597403_Key_Lessons_Learned_for_Technology_Managers_from_CrowdStrike_Global_IT_Outage		[11] https://www.researchgate.net/publication/383597403_Key_Lessons_Learned_for_Technology_Managers_from_CrowdStrike_Global_IT_Outage

			[12] https://app.pluralsight.com/ilx/video-courses/clips/13aeb538-8039-44b5-b246-226901becc68

	[[Category:Documentation]]		[[Category:Documentation]]

ABramer: /* Software Architecture of Falcon */

2024-12-19T09:33:19Z

Software Architecture of Falcon

← Older revision		Revision as of 09:33, 19 December 2024
Line 40:		Line 40:

	However, in this case, this function led to a race condition - the faulty file was loaded at startup because it was a software-specific component. As a result, the agent essentially overtook itself, leading to a Blue Screen of Death (BSOD).[6]		However, in this case, this function led to a race condition - the faulty file was loaded at startup because it was a software-specific component. As a result, the agent essentially overtook itself, leading to a Blue Screen of Death (BSOD).[6]

			[[File:Crowdstrike_bsod.png\|500px\|thumb\|left\|From faulty Channel File to BSOD (own representation based on [13]; 1:30 min)]]

	== Political Background ==		== Political Background ==

ABramer at 00:34, 19 December 2024

2024-12-19T00:34:28Z

← Older revision		Revision as of 00:34, 19 December 2024
Line 103:		Line 103:
	* Patch management solutions: These tools help efficiently manage software updates and minimize risks.		* Patch management solutions: These tools help efficiently manage software updates and minimize risks.
	* Virtual desktops and containers: These technologies can mitigate the effects of software errors by creating an isolated environment for applications.[11]		* Virtual desktops and containers: These technologies can mitigate the effects of software errors by creating an isolated environment for applications.[11]


	== References ==		== References ==

ABramer: /* Practical Part and Experiment */

2024-12-18T23:15:29Z

Practical Part and Experiment

← Older revision		Revision as of 23:15, 18 December 2024
Line 85:		Line 85:
	Now we want to demonstrate how those mentioned effects finally leads to the incident.		Now we want to demonstrate how those mentioned effects finally leads to the incident.
	You find the full experiment here:		You find the full experiment here:
			https://wiki.elvis.science/index.php?title=The_Crowdstrike_Incident_-_Practical_Part

	== Summary ==		== Summary ==

ABramer at 23:14, 18 December 2024

2024-12-18T23:14:58Z

← Older revision		Revision as of 23:14, 18 December 2024
Line 107:		Line 107:

	[01] https://www.wsj.com/articles/u-s-justice-department-to-charge-chinese-army-workers-hacked-u-s-firms-1400499708		[01] https://www.wsj.com/articles/u-s-justice-department-to-charge-chinese-army-workers-hacked-u-s-firms-1400499708

	[02] https://www.finanzen.net/fundamentalanalyse/crowdstrike		[02] https://www.finanzen.net/fundamentalanalyse/crowdstrike

	[03] https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-257485-10F1.pdf?__blob=publicationFile&v=3		[03] https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-257485-10F1.pdf?__blob=publicationFile&v=3

	[04] https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/		[04] https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/

	[05] https://www.computerweekly.com/news/366598838/Why-is-CrowdStrike-allowed-to-run-in-the-Windows-kernel		[05] https://www.computerweekly.com/news/366598838/Why-is-CrowdStrike-allowed-to-run-in-the-Windows-kernel

	[06] https://www.theregister.com/2024/07/23/crowdstrike_failure_shows_need_for/		[06] https://www.theregister.com/2024/07/23/crowdstrike_failure_shows_need_for/

	[07] https://www.computerweekly.com/blog/Cliff-Sarans-Enterprise-blog/CrowdStrike-reveals-Windows-weakness		[07] https://www.computerweekly.com/blog/Cliff-Sarans-Enterprise-blog/CrowdStrike-reveals-Windows-weakness

	[08] https://www.linkedin.com/pulse/crowdstrike-falcon-incident-deep-dive-july-2024-global-igor-kirisyuk-jdqoe/		[08] https://www.linkedin.com/pulse/crowdstrike-falcon-incident-deep-dive-july-2024-global-igor-kirisyuk-jdqoe/

	[09] https://support.microsoft.com/en-us/topic/kb5042421-crowdstrike-issue-impacting-windows-endpoints-causing-an-0x50-or-0x7e-error-message-on-a-blue-screen-b1c700e0-7317-4e95-aeee-5d67dd35b92f		[09] https://support.microsoft.com/en-us/topic/kb5042421-crowdstrike-issue-impacting-windows-endpoints-causing-an-0x50-or-0x7e-error-message-on-a-blue-screen-b1c700e0-7317-4e95-aeee-5d67dd35b92f

	[10] https://www.ijfmr.com/papers/2024/4/25310.pdf		[10] https://www.ijfmr.com/papers/2024/4/25310.pdf

	[11] https://www.researchgate.net/publication/383597403_Key_Lessons_Learned_for_Technology_Managers_from_CrowdStrike_Global_IT_Outage		[11] https://www.researchgate.net/publication/383597403_Key_Lessons_Learned_for_Technology_Managers_from_CrowdStrike_Global_IT_Outage

	[[Category:Documentation]]		[[Category:Documentation]]

ABramer: /* Practical Part and Experiment */

2024-12-18T23:12:41Z

Practical Part and Experiment

← Older revision		Revision as of 23:12, 18 December 2024
Line 81:		Line 81:
	Another issue is the use of outdated software that is no longer supported with current updates, as well as the incorrect configuration of update mechanisms. Therefore, the regular and correct application of updates remains one of the most important measures for avoiding security risks.		Another issue is the use of outdated software that is no longer supported with current updates, as well as the incorrect configuration of update mechanisms. Therefore, the regular and correct application of updates remains one of the most important measures for avoiding security risks.

	=== Practical Part and Experiment ===		== Practical Part and Experiment ==

	Now we want to demonstrate how those mentioned effects finally leads to the incident.		Now we want to demonstrate how those mentioned effects finally leads to the incident.
	You find the full experiment here:		You find the full experiment here:


	== Summary ==		== Summary ==

ABramer at 23:12, 18 December 2024

2024-12-18T23:12:23Z

Show changes